The servername should match whatever name your client use in their URLs to access the application server.

The server_key is used to sign parameters in the redirects to the id servers as well as to control access to the XML-RPC interface provided by bluerpc.pl. In order to change your server key you must first change the key on the id server using the admin utilities provided there. The server key should be 64 characters long, 0-9 and a-f (hex encoded).

The cache_dir setting controls where users sessions are stored. When a user is redirected to a bluestem id server to log in, a session id must first be created and stored here. Each session has a separate file. The files in this directory should be cleaned out routinely. The utility bluestem-client-admin is provided for this purpose.

The logfile for bluestem.

How much to informaion to log. 1 = least information. 9 = most information.

The cgipath specifies the base location in URLs for all the CGI scripts called by bluestem. These include things like test.plcgi, bluerpc.plcgi, lb_login.plcgi, logout.plcgi, and this program admin.plcgi.

The imgpath specifies the base location in URLs for graphics used in bluestem pages such as this one. If the university logo does not appear correctly at the top of this page, then this is not set properly or the images are missing or unaccessible for some reason. These images are just window dressing, so don't sweat it if they don't work, but you'll probably want them to make your site look professional.

The idle_timeout specifies how long to wait for activity before a user is logged out. User activity is updated whenever authentication is checked. This flag also is used when bluestem-client-admin is used to clean up the cache.

If prior_timeout is set, and not 0, then if a user has logged into another application managed by the id servers within this number of seconds, then the user will be authenticated without asking the user for his or her password again. This is a convenience to users that must log in frequently to many applications and we reccomend its use, however, this will only work correctly for application servers that are in the same DNS domain as the id servers. For UIC this means that only application servers in the uic.edu domain can use this feature.

The client_cookiename is used as the name for the bluestem session cookie set for your users. The recommended naming convention is "Bluestem_" + your servername.

The client_cookiedomain is used to set the domain for bluestem cookies. This parameter should normally just be the whatever servername your users use to access this machine ().

Current ID Servers:

New ID Server:

The list of ID servers is dynamically updated. The id servers should not be changed unless the authentication domain is also changing, such as switching from UIC id servers to UIUC.

When your application server redirects a user to the id server to login, it needs to know where the login.cgi script is found. For UIC this should be "/htbin/bluestem".

A user's netid has a short form, "adabyron" for example, and a long form, "adabyron@uic.edu/tacacs". The long form includes the auth domain and auth method. If a user's domain is the default_domain, (and the auth method is the default_auth method - see below) then the short version of the netid can be used, "adabyron" in this example. For UIC this should be set to "uic.edu".

The default_auth parameter is used to help identify your users. When a user authenticates with the id server, they may specify an alternative auth mechanism by following their user name with a forward slash and then the name of the auth mechanism or auth database. This means that for practical purposes, the users "adabyron/tacacs" and "adabyron/ldap" may be different users with different passwords. To make life easier, when the auth method used matches this default_auth setting, the method specification is dropped. So for UIC, the default auth method is "tacacs", so "adabyron/tacacs" should simply be considered "adabyron" while "adabyron/ldap" must still be referred to as "adabyron/ldap", the method specification cannot be dropped if it does not match the default. For UIC this should be set to "tacacs".