myproxy-admin-adduser(8)

✨ myproxy-admin-adduser — the manual, but make it make sense ✨

okay bestie, you found the myproxy-admin-adduser(8) page in section 8 of the MyProxy manual and honestly? it's giving "i make credentials and i'm not sorry about it." sit down, grab a strawberry 🍓, and let's get into it.

💖 NAME 💖

myproxy-admin-adduser — add a user or service credential. that's the whole vibe. you're literally creating a brand new credential and dropping it into the MyProxy repository. slay.

🎀 SYNOPSIS 🎀

myproxy-admin-adduser [ options ]

myproxy-admin-addservice [ options ]

two names, same energy. myproxy-admin-addservice is just the service-credential-flavored twin, iykyk. 💅

🦋 DESCRIPTION 🦋

okay so here's the tea. myproxy-admin-adduser and myproxy-admin-addservice create a new credential for a user or a service, and then load it into the MyProxy repository. iconic behavior.

they're perl(1) scripts — yes, perl, we respect the elders — and they run grid-cert-request (that's a standard Grid Community Toolkit program) plus grid-ca-sign (which comes from the Globus Simple CA package) to actually create the credential. then they run myproxy-admin-load-credential(8) to load that credential into the MyProxy repository. teamwork, honestly. 🤝

now, the command is gonna prompt you for a few things:

• the common name to be included in the new certificate (unless you passed the -c argument, then it already knows 💅)
• the Globus Simple CA key password, for signing the certificate
• the MyProxy username (unless you gave it -l or -d)
• the MyProxy passphrase for the credential

and like, most of the command-line options for this command get passed directly to the myproxy-admin-load-credential(8) command. so if you've read that page, you already have main character energy here.

⚠️ important, bestie: the grid-ca-sign program is not provided in the MyProxy distribution. it must be installed separately, from the Globus Simple CA package. no, you can't skip this. it will not work. periodt.

✨ OPTIONS ✨

one bullet per option, no skipping, we're doing all of them. 👑

• -h — displays command usage text and exits. the classic "help me" move. 🙈
• -u — displays command usage text and exits. yes, it's basically the same as -h. they said "two options, both iconic." 💅
• -v — enables verbose debugging output to the terminal. turn this on when you wanna see everything that's happening, no secrets in this group chat. 🔍
• -c cn — specifies the Common Name for the new credential. for example: "Jim Basney". 🪪
• -s dir — specifies the location of the credential storage directory. lowkey a big deal: the directory must be accessible only by the user running the myproxy-server process, for security reasons. Default: /var/lib/myproxy or /var/myproxy or $GLOBUS_LOCATION/var/myproxy. 🗂️
• -l username — specifies the MyProxy account under which the credential should be stored. 🏷️
• -t hours — specifies the maximum lifetime of credentials retrieved from the myproxy-server(8) using the stored credential. Default: 12 hours. ⏰
• -p CA-password — specifies the password for the CA's private key, using the format documented in the PASS PHRASE ARGUMENTS section of openssl(1). 🔐
• -n — disables passphrase authentication for the stored credential. if you specify this: the command will not prompt for a passphrase, the credential will not be encrypted by a passphrase in the repository, and the credential will not be retrievable using passphrase authentication with myproxy-logon(1). this one is used for storing renewable credentials, and it's implied by -R. 🚫
• -d — use the certificate subject (DN) as the username. easy. 💫
• -a — allow credentials to be retrieved with just pass phrase authentication. by default, only entities with credentials that match the myproxy-server.config(5) default retriever policy may retrieve credentials. this option allows entities without existing credentials to retrieve a credential using pass phrase authentication, by including "anonymous" in the set of allowed retrievers. heads up though: the myproxy-server.config(5) server-wide policy must also allow "anonymous" clients for this option to actually have an effect. 👀
• -A — allow credentials to be renewed by any client. any client with a valid credential whose subject name matches the stored credential may retrieve a new credential from the MyProxy repository if this option is given. and here's the dramatic part: since this effectively defeats the purpose of proxy credential lifetimes, it is not recommended. it's included only for sake of completeness. 😭
• -r name — allow the specified entity to retrieve credentials. see the -x and -X options for controlling name matching behavior. 📛
• -R name — allow the specified entity to renew credentials. see -x and -X for controlling name matching behavior. this option implies -n, since passphrase authentication is not used for credential renewal. 🔁
• -Z name, --retrievable_by_cert name — allow the specified entity to retrieve credentials without a passphrase. see -x and -X for controlling name matching behavior. this option implies -n. 🎫
• -x — specifies that names used with the following options — -r, -R, and -Z — will be matched against the full certificate subject distinguished name (DN), according to REGULAR EXPRESSIONS in myproxy-server.config(5). 🧬
• -X — specifies that names used with the following options — -r, -R, and -Z — will be matched against the certificate subject common name (CN), according to REGULAR EXPRESSIONS in myproxy-server.config(5). for example, if an argument of -r "Jim Basney" is specified, then the resulting policy will be "*/CN=Jim Basney". this is the default behavior. ⭐
• -k name — specifies the credential name. 🏷️✨
• -K description — specifies credential description. 📝

🌈 EXIT STATUS 🌈

• 0 on success ✅
• >0 on error 💀

👑 AUTHORS 👑

See http://grid.ncsa.illinois.edu/myproxy/about for the list of MyProxy authors. we love a credits section, honestly. 🫶

🌸 SEE ALSO 🌸

the whole friend group, in order:

myproxy-change-pass-phrase(1), myproxy-destroy(1), myproxy-info(1), myproxy-init(1), myproxy-logon(1), myproxy-retrieve(1), myproxy-store(1), myproxy-server.config(5), myproxy-admin-change-pass(8), myproxy-admin-load-credential(8), myproxy-admin-query(8), myproxy-server(8)

that's the whole page, bestie, you ate it. 💅✨

💌 cute sign-off: this was the MyProxy manual, page myproxy-admin-adduser(8), dated 2011-09-05. the MyProxy era of this doc is truly timeless, no cap. 🦋🎀