Creating an Authorized User Object

The authorized user object is manipulated using the authuser subcommand of ssadm edit. The authuser subcommand takes one of the following verbs:

• add "name" item... - Creates or overwrites an object; takes a complete description of the object, beginning with its name, followed by desired items and subitems as defined above.

• delete "name" - Deletes a named object

• print[,sortopt] ["name"] - Display one or more objects. If an object's name is given, then only that object's definition is displayed; otherwise all authorized user objects are displayed

• names [,sortopt] - Displays the names of all objects. sortopt can be:

  • asc - ascending order by name (case-sensitive)

  • desc - descending order by name (case-sensitive)

  • iasc - ascending order by name (case-insensitive)

  • idesc - descending order by name (case-insensitive)

  • raw - order stored in database

    The default is asc.

Example: Displaying An Authorized User

The following is an example of what you type to display an existing authorized user object while logged into the primary Screen:

admin% ssadm -r primary edit Initial
edit> authuser print jeff.hogg
"jeff.hogg" ENABLED PASSWORD={ "" CRYPT_PASSWORD="s8Q2DZRw4tmGk" ENABLED } 
DESCRIPTION="large and in charge" REAL_NAME="Jeff Hogg"

print surrounds the value of each item in double quotes. These are only necessary on input to protect embedded spaces within the values of items or to preserve null items.

print produces all tag names in capital letters (for example, REAL_NAME=). On input, the case for these tags is not important (for example, real_name= and REAL_NAME= are equivalent).

Because of the way in which passwords are encrypted, the add operation is unlikely to yield a particular crypt_password= encoding of any given plaintext password. There are 4096 different encryptions of any given plaintext password.

Examples: Creating Authorized User Objects

Following are examples of creating authorized user objects.

The following is an example of what you type to create the above authorized user object while logged into the primary Screen:

admin% ssadm -r primary edit Initial
edit> authuser add jeff.hogg password={ "4flash" } 
description="large and in charge" real_name="Jeff Hogg"
edit> quit

This shows creation of the object by supplying the simple-text password in the plaintext form.

To create the above authorized user object, while logged into the primary Screen:

admin% ssadm -r primary edit Initial
edit> authuser add jeff.hogg password={ "" crypt_password="s8Q2DZRw4tmGk" } 
description="large and in charge" real_name="Jeff Hogg"
edit> quit

This shows creation of the object by supplying the simple-text password in its already encrypted form

In each of the above add operations, the items have been allowed to default to enabled.

To re-create the above authorized user object so that it is disabled while logged into the primary Screen:

admin% ssadm -r primary edit Initial
edit> authuser add jeff.hogg  disabled password={ "" crypt_password="s8Q2DZRw4tmGk" } 
description="large and in charge" real_name="Jeff Hogg"

To create an authorized user object defining a SecurID authentication method, while logged into the primary Screen:

admin% ssadm -r primary edit Initial
edit> authuser add jeff.hogg securid={ "jeffh" } 
description="large and in charge" real_name="Jeff Hogg"

To create an authorized user object defining both simple-text password and SecurID authentication methods, while logged into the primary Screen:

admin% ssadm -r primary edit Initial
edit> authuser add jeff.hogg password={ "" crypt_password="s8Q2DZRw4tmGk" } 
securid={ "jeffh" }  description="large and in charge" real_name="Jeff Hogg"

To display all authorized user objects, while logged into the primary Screen:

admin% ssadm -r primary edit Initial
edit> authuser print 
"admin" ENABLED PASSWORD={ "" CRYPT_PASSWORD="1hp1R.xm.w63Q" ENABLED } 
DESCRIPTION="(created by install) REAL_NAME="SunScreen Administrator" 
"jeff.hogg" ENABLED SECURID={ "jeffh" ENABLED } 
DESCRIPTION="large and in charge" REAL_NAME="Jeff Hogg"

To display the names of all authorized user objects, while logged into the primary Screen:

admin% ssadm -r primary edit Initial
edit> authuser names,raw
"admin"
"jeff.hogg"