€•žO      Œdocutils.nodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”h Œsection”“”)”}”(hhh]”(h Œtitle”“”)”}”(hŒ Metacat Authentication Mechanism”h]”h ŒText”“”Œ Metacat Authentication Mechanism”…””}”(hhŒparent”hhhŒsource”NŒline”NubaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”uŒtagname”hhhhhhŒ_/var/lib/jenkins/jobs/metacat_beta/workspace/metacat/docs/user/metacat/source/authinterface.rst”hKubh Œ	paragraph”“”)”}”(hXZ  Metacat supports either an internal password file authentication or the use of LDAP
as an external authentication mechanism.  It does this by supplying two classes
(``AuthFile`` or ``AuthLDAP``) that implement authentication via a password file or
an external LDAP server. You may choose the authentication mechanism during initial configuration.”h]”(hŒ¥Metacat supports either an internal password file authentication or the use of LDAP
as an external authentication mechanism.  It does this by supplying two classes
(”…””}”(hŒ¥Metacat supports either an internal password file authentication or the use of LDAP
as an external authentication mechanism.  It does this by supplying two classes
(”hh-hhhNhNubh Œliteral”“”)”}”(hŒ``AuthFile``”h]”hŒAuthFile”…””}”(hhhh8ubah}”(h]”h!]”h#]”h%]”h']”uh)h6hh-ubhŒ or ”…””}”(hŒ or ”hh-hhhNhNubh7)”}”(hŒ``AuthLDAP``”h]”hŒAuthLDAP”…””}”(hhhhKubah}”(h]”h!]”h#]”h%]”h']”uh)h6hh-ubhŒ™) that implement authentication via a password file or
an external LDAP server. You may choose the authentication mechanism during initial configuration.”…””}”(hŒ™) that implement authentication via a password file or
an external LDAP server. You may choose the authentication mechanism during initial configuration.”hh-hhhNhNubeh}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKhhhhubh,)”}”(hXç  If neither of these choices is suitable for your deployment, a custom authentication mechanism can be built.
Metacat is written such that this Authentication provider is replaceable with
another class that implements the same interface (``AuthInterface``). As
an Administrator, you have the choice to provide an alternative implementation
of ``AuthInterface`` and then configuring ``metacat.properties`` to use that
class for authentication instead of LDAP or the internal password file.”h]”(hŒíIf neither of these choices is suitable for your deployment, a custom authentication mechanism can be built.
Metacat is written such that this Authentication provider is replaceable with
another class that implements the same interface (”…””}”(hŒíIf neither of these choices is suitable for your deployment, a custom authentication mechanism can be built.
Metacat is written such that this Authentication provider is replaceable with
another class that implements the same interface (”hhdhhhNhNubh7)”}”(hŒ``AuthInterface``”h]”hŒAuthInterface”…””}”(hhhhmubah}”(h]”h!]”h#]”h%]”h']”uh)h6hhdubhŒX). As
an Administrator, you have the choice to provide an alternative implementation
of ”…””}”(hŒX). As
an Administrator, you have the choice to provide an alternative implementation
of ”hhdhhhNhNubh7)”}”(hŒ``AuthInterface``”h]”hŒAuthInterface”…””}”(hhhh€ubah}”(h]”h!]”h#]”h%]”h']”uh)h6hhdubhŒ and then configuring ”…””}”(hŒ and then configuring ”hhdhhhNhNubh7)”}”(hŒ``metacat.properties``”h]”hŒmetacat.properties”…””}”(hhhh“ubah}”(h]”h!]”h#]”h%]”h']”uh)h6hhdubhŒT to use that
class for authentication instead of LDAP or the internal password file.”…””}”(hŒT to use that
class for authentication instead of LDAP or the internal password file.”hhdhhhNhNubeh}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKhhhhubh
)”}”(hhh]”(h)”}”(hŒFile-Based Authentication”h]”hŒFile-Based Authentication”…””}”(hh±hh¯hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)hhh¬hhhh*hKubh,)”}”(hŒéThis is the default authentication mechanism in Metacat. The password file
path can be specified during initial configuration. The Tomcat user should have
write/read permission to access the file. The password file follows this form:”h]”hŒéThis is the default authentication mechanism in Metacat. The password file
path can be specified during initial configuration. The Tomcat user should have
write/read permission to access the file. The password file follows this form:”…””}”(hh¿hh½hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKhh¬hhubh Œliteral_block”“”)”}”(hXÂ  <?xml version="1.0" encoding="UTF-8"?>
<subjects>
      <users>
              <user dn="uid=john,o=NCEAS,dc=ecoinformatics,dc=org">
                      <password>csilPspPJdMx8zt7L9XKXeUxZjkPgKZd.o7TTPC0oJOFmT2kQ/E92</password>
                      <email>foo@foo.com</email>
                      <surName>Smith</surName>
                      <givenName>John</givenName>
                      <organization>NCEAS</organization>
                      <memberof>cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org</memberof>
              </user>
              <user dn="uid=brand,o=NCEAS,dc=ecoinformatics,dc=org">
                      <password>$2a$10$j8eGWJBEpj5MubdaqOeJje7oYw6JNc2aq2U7buoRw16kthwOEcWkC</password>
              </user>
      </users>
      <groups>
              <group name="cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org">
                      <description>Developers at NCEAS</description>
              </group>
      </groups>
</subjects>”h]”hXÂ  <?xml version="1.0" encoding="UTF-8"?>
<subjects>
      <users>
              <user dn="uid=john,o=NCEAS,dc=ecoinformatics,dc=org">
                      <password>csilPspPJdMx8zt7L9XKXeUxZjkPgKZd.o7TTPC0oJOFmT2kQ/E92</password>
                      <email>foo@foo.com</email>
                      <surName>Smith</surName>
                      <givenName>John</givenName>
                      <organization>NCEAS</organization>
                      <memberof>cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org</memberof>
              </user>
              <user dn="uid=brand,o=NCEAS,dc=ecoinformatics,dc=org">
                      <password>$2a$10$j8eGWJBEpj5MubdaqOeJje7oYw6JNc2aq2U7buoRw16kthwOEcWkC</password>
              </user>
      </users>
      <groups>
              <group name="cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org">
                      <description>Developers at NCEAS</description>
              </group>
      </groups>
</subjects>”…””}”(hhhhÍubah}”(h]”h!]”h#]”h%]”h']”Œ	xml:space”Œpreserve”uh)hËhKhh¬hhhh*ubh,)”}”(hŒNThe format of the DN must look like uid=john,o=NCEAS,dc=ecoinformatics,dc=org.”h]”hŒNThe format of the DN must look like uid=john,o=NCEAS,dc=ecoinformatics,dc=org.”…””}”(hhßhhÝhhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hK-hh¬hhubh,)”}”(hŒZThe format of the group name must look like cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org.”h]”hŒZThe format of the group name must look like cn=nceas-dev,o=NCEAS,dc=ecoinformatics,dc=org.”…””}”(hhíhhëhhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hK/hh¬hhubh,)”}”(hX.  The password stored in the file is hashed using Bcrypt algorithm.  If you have the "-i" in the
"useradd" or "usermod" commands when you run the command line utility (see the following section),
you will be prompted to input the password and the utility will hash the password and store it in
the file. You may also get the hash of a password from any online tool,
such as https://www.dailycred.com/blog/12/bcrypt-calculator (we don't have any guaranty on the security of those tools),
then use the "-h" to pass the hashed password to the file by the utility.”h]”(hX€  The password stored in the file is hashed using Bcrypt algorithm.  If you have the â€œ-iâ€ in the
â€œuseraddâ€ or â€œusermodâ€ commands when you run the command line utility (see the following section),
you will be prompted to input the password and the utility will hash the password and store it in
the file. You may also get the hash of a password from any online tool,
such as ”…””}”(hXt  The password stored in the file is hashed using Bcrypt algorithm.  If you have the "-i" in the
"useradd" or "usermod" commands when you run the command line utility (see the following section),
you will be prompted to input the password and the utility will hash the password and store it in
the file. You may also get the hash of a password from any online tool,
such as ”hhùhhhNhNubh Œ	reference”“”)”}”(hŒ3https://www.dailycred.com/blog/12/bcrypt-calculator”h]”hŒ3https://www.dailycred.com/blog/12/bcrypt-calculator”…””}”(hhhj  ubah}”(h]”h!]”h#]”h%]”h']”Œrefuri”j  uh)j  hhùubhŒ (we donâ€™t have any guaranty on the security of those tools),
then use the â€œ-hâ€ to pass the hashed password to the file by the utility.”…””}”(hŒ‡ (we don't have any guaranty on the security of those tools),
then use the "-h" to pass the hashed password to the file by the utility.”hhùhhhNhNubeh}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hK1hh¬hhubeh}”(h]”Œfile-based-authentication”ah!]”h#]”Œfile-based authentication”ah%]”h']”uh)h	hhhhhh*hKubh
)”}”(hhh]”(h)”}”(hŒ.Utility for Password File Based Authentication”h]”hŒ.Utility for Password File Based Authentication”…””}”(hj+  hj)  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)hhj&  hhhh*hK:ubh,)”}”(hŒ¤You can edit the password file manually or use Metacat's command line utility
for managing users and groups. The utility is located in the deployed Metacat webapp::”h]”hŒ¥You can edit the password file manually or use Metacatâ€™s command line utility
for managing users and groups. The utility is located in the deployed Metacat webapp:”…””}”(hŒ£You can edit the password file manually or use Metacat's command line utility
for managing users and groups. The utility is located in the deployed Metacat webapp:”hj7  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hK;hj&  hhubhÌ)”}”(hŒ1$METACAT/WEB-INF/scripts/bash/authFileManager.sh.”h]”hŒ1$METACAT/WEB-INF/scripts/bash/authFileManager.sh.”…””}”(hhhjF  ubah}”(h]”h!]”h#]”h%]”h']”hÛhÜuh)hËhK>hj&  hhhh*ubh,)”}”(hŒOYou must be in the directory - $METACAT/WEB-INF/scripts/bash/ to run the file::”h]”hŒNYou must be in the directory - $METACAT/WEB-INF/scripts/bash/ to run the file:”…””}”(hŒNYou must be in the directory - $METACAT/WEB-INF/scripts/bash/ to run the file:”hjT  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hK@hj&  hhubhÌ)”}”(hŒ!cd $METACAT/WEB-INF/scripts/bash/”h]”hŒ!cd $METACAT/WEB-INF/scripts/bash/”…””}”(hhhjc  ubah}”(h]”h!]”h#]”h%]”h']”hÛhÜuh)hËhKBhj&  hhhh*ubh,)”}”(hŒ=In order to run the file, you must make the file executable::”h]”hŒ<In order to run the file, you must make the file executable:”…””}”(hŒ<In order to run the file, you must make the file executable:”hjq  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKDhj&  hhubhÌ)”}”(hŒchmod u+x authFileManager.sh”h]”hŒchmod u+x authFileManager.sh”…””}”(hhhj€  ubah}”(h]”h!]”h#]”h%]”h']”hÛhÜuh)hËhKFhj&  hhhh*ubh,)”}”(hŒ.You run the command as the owner of the file::”h]”hŒ-You run the command as the owner of the file:”…””}”(hŒ-You run the command as the owner of the file:”hjŽ  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKHhj&  hhubhÌ)”}”(hŒ./authFileManager.sh  [options]”h]”hŒ./authFileManager.sh  [options]”…””}”(hhhj  ubah}”(h]”h!]”h#]”h%]”h']”hÛhÜuh)hËhKJhj&  hhhh*ubh,)”}”(hŒUsage of the utility:”h]”hŒUsage of the utility:”…””}”(hj­  hj«  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKLhj&  hhubh,)”}”(hŒ“./authFileManager.sh useradd -i -dn <user-distinguish-name> [-g <group-name> -e <email-address> -s <surname> -f <given-name> -o <organizationName>]”h]”hŒ“./authFileManager.sh useradd -i -dn <user-distinguish-name> [-g <group-name> -e <email-address> -s <surname> -f <given-name> -o <organizationName>]”…””}”(hj»  hj¹  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKNhj&  hhubh,)”}”(hŒ¥./authFileManager.sh useradd -h <hashed-password> -dn <user-distinguish-name> [-g <group-name> -e <email-address> -s <surname> -f <given-name> -o <organizationName>]”h]”hŒ¥./authFileManager.sh useradd -h <hashed-password> -dn <user-distinguish-name> [-g <group-name> -e <email-address> -s <surname> -f <given-name> -o <organizationName>]”…””}”(hjÉ  hjÇ  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKPhj&  hhubh,)”}”(hŒ@./authFileManager.sh groupadd -g <group-name> [-d <description>]”h]”hŒ@./authFileManager.sh groupadd -g <group-name> [-d <description>]”…””}”(hj×  hjÕ  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKRhj&  hhubh,)”}”(hŒE./authFileManager.sh usermod -password -dn <user-distinguish-name> -i”h]”hŒE./authFileManager.sh usermod -password -dn <user-distinguish-name> -i”…””}”(hjå  hjã  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKThj&  hhubh,)”}”(hŒ[./authFileManager.sh usermod -password -dn <user-distinguish-name> -h <new-hashed-password>”h]”hŒ[./authFileManager.sh usermod -password -dn <user-distinguish-name> -h <new-hashed-password>”…””}”(hjó  hjñ  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKVhj&  hhubh,)”}”(hŒX./authFileManager.sh usermod -group -a -dn <user-distinguish-name> -g <added-group-name>”h]”hŒX./authFileManager.sh usermod -group -a -dn <user-distinguish-name> -g <added-group-name>”…””}”(hj  hjÿ  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKXhj&  hhubh,)”}”(hŒZ./authFileManager.sh usermod -group -r -dn <user-distinguish-name> -g <removed-group-name>”h]”hŒZ./authFileManager.sh usermod -group -r -dn <user-distinguish-name> -g <removed-group-name>”…””}”(hj  hj  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKZhj&  hhubh Œnote”“”)”}”(hXn  Metacat currently uses Bcrypt algorithm to hash the password. The hashed password following the "-h" should be generated by a Bcrypt algorithm.
The hash string usually contains $ signs which can interfere with the command line arguments. You should use two SINGLE quotes to wrap the entire hashed string.

The <user-distinguish-name> must look like "uid=john,o=something,dc=something,dc=something" and the group-name must look like "cn=dev,o=something,dc=something,dc=something".

If an option value has spaces, the value should be enclosed in double quotes.
For example: ./authFileManager.sh groupadd -g cn=dev,o=something,dc=something,dc=something -d "Developers at NCEAS"

The "-d <description>" option in the "groupadd" command is optional;
"-g <groupname> -e <email-address> -s <surname> -f <given-name> -o <organizationName>" in the "useradd" command are optional as well.”h]”(h,)”}”(hX0  Metacat currently uses Bcrypt algorithm to hash the password. The hashed password following the "-h" should be generated by a Bcrypt algorithm.
The hash string usually contains $ signs which can interfere with the command line arguments. You should use two SINGLE quotes to wrap the entire hashed string.”h]”hX4  Metacat currently uses Bcrypt algorithm to hash the password. The hashed password following the â€œ-hâ€ should be generated by a Bcrypt algorithm.
The hash string usually contains $ signs which can interfere with the command line arguments. You should use two SINGLE quotes to wrap the entire hashed string.”…””}”(hj#  hj!  ubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hK_hj  ubh,)”}”(hŒ­The <user-distinguish-name> must look like "uid=john,o=something,dc=something,dc=something" and the group-name must look like "cn=dev,o=something,dc=something,dc=something".”h]”hŒµThe <user-distinguish-name> must look like â€œuid=john,o=something,dc=something,dc=somethingâ€ and the group-name must look like â€œcn=dev,o=something,dc=something,dc=somethingâ€.”…””}”(hj1  hj/  ubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKbhj  ubh,)”}”(hŒÁIf an option value has spaces, the value should be enclosed in double quotes.
For example: ./authFileManager.sh groupadd -g cn=dev,o=something,dc=something,dc=something -d "Developers at NCEAS"”h]”hŒÅIf an option value has spaces, the value should be enclosed in double quotes.
For example: ./authFileManager.sh groupadd -g cn=dev,o=something,dc=something,dc=something -d â€œDevelopers at NCEASâ€”…””}”(hj?  hj=  ubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKdhj  ubh,)”}”(hŒÊThe "-d <description>" option in the "groupadd" command is optional;
"-g <groupname> -e <email-address> -s <surname> -f <given-name> -o <organizationName>" in the "useradd" command are optional as well.”h]”hŒÚThe â€œ-d <description>â€ option in the â€œgroupaddâ€ command is optional;
â€œ-g <groupname> -e <email-address> -s <surname> -f <given-name> -o <organizationName>â€ in the â€œuseraddâ€ command are optional as well.”…””}”(hjM  hjK  ubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKghj  ubeh}”(h]”h!]”h#]”h%]”h']”uh)j  hj&  hhhh*hNubeh}”(h]”Œ.utility-for-password-file-based-authentication”ah!]”h#]”Œ.utility for password file based authentication”ah%]”h']”uh)h	hhhhhh*hK:ubh
)”}”(hhh]”(h)”}”(hŒLDAP-Based Authentication”h]”hŒLDAP-Based Authentication”…””}”(hjl  hjj  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)hhjg  hhhh*hKkubh,)”}”(hXà  Before the Metacat 2.4.0 release, LDAP was the default authentication mechanism and was configured to use
the NCEAS LDAP server. We are now restricting access to the server to only trusted partners who can
guarantee secure communication with their clients and the LDAP server.
If you are not on the list, you can contact us for more information or you may use the password file authentication
(for a small group of users) or set up your own LDAP server (for a big group of users).”h]”hXà  Before the Metacat 2.4.0 release, LDAP was the default authentication mechanism and was configured to use
the NCEAS LDAP server. We are now restricting access to the server to only trusted partners who can
guarantee secure communication with their clients and the LDAP server.
If you are not on the list, you can contact us for more information or you may use the password file authentication
(for a small group of users) or set up your own LDAP server (for a big group of users).”…””}”(hjz  hjx  hhhNhNubah}”(h]”h!]”h#]”h%]”h']”uh)h+hh*hKlhjg  hhubeh}”(h]”Œldap-based-authentication”ah!]”h#]”Œldap-based authentication”ah%]”h']”uh)h	hhhhhh*hKkubeh}”(h]”Œ metacat-authentication-mechanism”ah!]”h#]”Œ metacat authentication mechanism”ah%]”h']”uh)h	hhhhhh*hKubah}”(h]”h!]”h#]”h%]”h']”Œsource”h*uh)hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(hNŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”Œentry”Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”j¹  Œerror_encoding”ŒUTF-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h*Œ_destination”NŒ_config_files”]”Œpep_references”NŒpep_base_url”Œ https://www.python.org/dev/peps/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œhttps://tools.ietf.org/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œfile_insertion_enabled”ˆŒraw_enabled”KŒsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”NŒcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒenv”NŒgettext_compact”ˆubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”Œnameids”}”(j“  j  j#  j   jd  ja  j‹  jˆ  uŒ	nametypes”}”(j“  Nj#  Njd  Nj‹  Nuh}”(j  hj   h¬ja  j&  jˆ  jg  uŒfootnote_refs”}”Œcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”Œ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œid_start”KŒparse_messages”]”Œtransform_messages”]”Œtransformer”NŒ
decoration”Nhhub.