servername |
The servername should match whatever name your client use in their URLs
to access the application server.
|
server_key |
The server_key is used to sign parameters in the redirects to the id
servers as well as to control access to the XML-RPC interface provided
by bluerpc.pl. In order to change your server key you must first change
the key on the id server using the admin utilities provided there.
The server key should be 64 characters long, 0-9 and a-f (hex encoded).
|
cache_dir |
The cache_dir setting controls where users sessions are stored. When a
user is redirected to a bluestem id server to log in, a session id must
first be created and stored here. Each session has a separate file.
The files in this directory should be cleaned out routinely. The utility
bluestem-client-admin is provided for this purpose.
|
logfile |
The logfile for bluestem.
|
loglvl |
How much to informaion to log. 1 = least information. 9 = most information.
|
cgipath |
The cgipath specifies the base location in URLs for all the CGI scripts
called by bluestem. These include things like test.plcgi, bluerpc.plcgi,
lb_login.plcgi, logout.plcgi, and this program admin.plcgi.
|
imgpath |
The imgpath specifies the base location in URLs for graphics used in
bluestem pages such as this one. If the university logo does not appear
correctly at the top of this page, then this is not set properly or the
images are missing or unaccessible for some reason. These images are just
window dressing, so don't sweat it if they don't work, but you'll probably
want them to make your site look professional.
|
idle_timeout |
The idle_timeout specifies how long to wait for activity before a user
is logged out. User activity is updated whenever authentication is checked.
This flag also is used when bluestem-client-admin is used to
clean up the cache.
|
|
prior_timeout |
If prior_timeout is set, and not 0, then if a user has logged into
another application managed by the id servers within this number of
seconds, then the user will be authenticated without asking the user
for his or her password again. This is a convenience to users that
must log in frequently to many applications and we reccomend its use,
however, this will only work correctly for application servers that
are in the same DNS domain as the id servers. For UIC this means that
only application servers in the uic.edu domain can use this feature.
|
|
client_cookiename |
The client_cookiename is used as the name for the bluestem session cookie
set for your users. The recommended naming convention is "Bluestem_" + your
servername.
|
client_cookiedomain |
The client_cookiedomain is used to set the domain for bluestem cookies.
This parameter should normally just be the whatever servername your users
use to access this machine ().
|
id_servers |
Current ID Servers:
New ID Server:
The list of ID servers is dynamically updated. The id servers should
not be changed unless the authentication domain is also changing, such
as switching from UIC id servers to UIUC.
|
id_server_bluestem_path |
When your application server redirects a user to the id server to login,
it needs to know where the login.cgi script is found. For UIC this should
be "/htbin/bluestem".
|
default_domain |
A user's netid has a short form, "adabyron" for example, and a long form,
"adabyron@uic.edu/tacacs". The long form includes the auth domain and auth
method. If a user's domain is the default_domain, (and the auth method is
the default_auth method - see below) then the short version of the netid
can be used, "adabyron" in this example. For UIC this should be set to
"uic.edu".
|
default_auth |
The default_auth parameter is used to help identify your users. When a
user authenticates with the id server, they may specify an alternative auth
mechanism by following their user name with a forward slash and then the
name of the auth mechanism or auth database. This means that for practical
purposes, the users "adabyron/tacacs" and "adabyron/ldap" may be different
users with different passwords. To make life easier, when the auth method
used matches this default_auth setting, the method specification is dropped.
So for UIC, the default auth method is "tacacs", so "adabyron/tacacs" should
simply be considered "adabyron" while "adabyron/ldap" must still be referred
to as "adabyron/ldap", the method specification cannot be dropped if it
does not match the default. For UIC this should be set to "tacacs".
|