kas setfields              AFS Commands           kas setfields


NAME

   kas  setfields -- set  various  flags,  expiration date and

                       ticket   lifetime   for   Authentication
                       Database entry.


   kas setfields  -name <name of user>
   [-flags <hex flag value or flag name expression>]
   [-expiration <date of account expiration>]
   [-lifetime <maximum ticket lifetime>]
   [-admin_username <admin principal to use for
   authentication>]
   [-password_for_admin <admin password>]  [-cell <cell name>]
            [-servers <explicit list of authentication
           +
   servers> ]
   [-noauth]  [-help]

ACCEPTABLE ABBREVIATIONS/ALIASES

   kas sf  -na <name of user>  [-f <hex flag value or flag name
   expression>]
   [-e <date of account expiration>]
   [-l <maximum ticket lifetime>]
   [-ad <admin principal to use for authentication>]
   [-p <admin password>]  [-c <cell name>]
                                                +
   [-s <explicit list of authentication servers> ]  [-no]  [-h]

DESCRIPTION

   Changes  the  Authentication Database entry for name of user
   in the manner specified by the various  optional  arguments,
   which may occur singly or in combination.  See the ARGUMENTS
   section for a description of the values that may be set.

   The results of this command are visible in the output of the
   kas examine command.

ARGUMENTS

   -name     specifies the entry to be affected.

   -flags    sets  any  one  of  four  toggling flags in name's
             entry.  The default is for none of the flags to be
             set.  A value of 0 returns all four flags to their
             defaults.    The  following  explains   the   four
             non-default  values to set, their meanings and the
             associated defaults:

           - ADMIN (Hex equivalent: 0x004).  The  name  of
             user  is  allowed  to  issue  privileged  kas
             commands (Default: NOADMIN).

           - NOTGS (Hex equivalent: 0x008).    The  Ticket
             Granting Service will refuse to issue tickets
             to name of user (Default: TGS).

           - NOSEAL (Hex equivalent: 0x020).   The  Ticket



             Granting  Service  cannot use the contents of
             this entry's key field as an  encryption  key
             (Default: SEAL).

           - NOCPW  (Hex  equivalent: 0x040).  The name of
             user cannot change his/her/its  own  password
             or key (Default: CPW).

             Both  upper  and lower-case letters are acceptable
             in specifying values for the flags.

             To restore the ADMIN flag to its default,  specify
             NOADMIN.    To  restore  the  other flags to their
             defaults, omit the NO (i.e.,  type  TGS,  SEAL  or
             CPW).

             To  set  more  than one flag at once, connect them
             with plus signs (example:  NOTGS+ADMIN+CPW).    To
             remove   all  the  current  flag  settings  before
             setting new ones, precede the whole list  with  an
             equal sign (example: =NOTGS+ADMIN+CPW).

   -expiration
             determines when the entry  itself  expires,  which
             will render an individual user unable to log in to
             the system, and a server unreachable.  The default
             is never.

             There are three types of legal values:

                - never, which allows the issuer to return
                  the expiration time to its default after
                  having set it to a date.

                - mm/dd/yy  specifies  12:00  a.m.  on the
                  indicated     date     (month/day/year).
                  Examples : 1/23/90, 10/7/89.

                - "mm/dd/yy   hh:mm"   specifies   a  time
                  "hh:mm" (hour:minutes) on the  indicated
                  date  (month/day/year).  The time should
                  be in 24-hour format (for example, 20:30
                  is  8:30  p.m.)  Date format is the same
                  as for  a  date  alone.    Surround  the
                  entire  instance  with quotes because it
                  contains a space.  Examples  :  "1/23/90
                  22:30", "10/7/89 3:45".

             Legal  values  for yy run from 00 to 37, which are
             interpreted as the years 2000-2037, and from 70 to
             99  which  are  interpreted  as  1970-1999.  (This
             restriction is because the  Authentication  Server
             converts  the  date  into  the  number  of seconds
             elapsed since 1 February 1970, to comply with  the
             standard  UNIX  date  representation;  dates later
             than  sometime  in  February   2038   exceed   the
             representation's capacity.)

   -lifetime specifies the upper limit on the validity lifetime
             that the TGS may stamp on a ticket  issued  to  an
             individual  or  for a server.  That is, if name of



             user is an individual, this value is  the  maximum
             lifetime  of a ticket issued to the user.  If name
             of user is a server such as "afs," this  value  is
             the  maximum  lifetime  of  a  ticket that the TGS
             issues to clients in order to contact the server.

             To specify a number of hours, include a  colon  in
             the  number  (example:    1:00  means  one  hour).
             Otherwise, the number is assumed to be in  seconds
             (so 3600 means one hour).  If this argument is not
             provided, the  default  setting  is  100:00  hours
             (360000 seconds).

   -admin_username
             specifies  the  user  name  under which the issuer
             wishes to perform the command.  If the issuer does
             not provide it, the current identity is used.  See
             section 4.3  in  the  Reference  Manual  for  more
             details.  -password_for_admin
             specifies  the  issuer's  password.    If provided
             here, the password is visible on the screen.    If
             the  issuer  does  not  provide  it,  it  will  be
             prompted for and not be  visible  on  the  screen.
             See  section  4.3 in the Reference Manual for more
             details.  -cell
             specifies the cell in which to run the command, if
             not the local  cell.    See  section  4.3  in  the
             Reference Manual for more details.  -servers
             specifies  the  database  server  machine(s)  with
             which  to establish a connection.  See section 4.3
             in the Reference Manual for more details.  -noauth
             establishes  an unauthenticated connection between
             the Authentication Servers and issuer,  whom  they
             assign  the unprivileged identity anonymous rather
             than  attempting  mutual  authentication.      See
             section  4.3  in  the  Reference  Manual  for more
             details.

   -help     prints the online help for this command.   Do  not
             provide  any  other  arguments  or flags with this
             one.  See section 4.3 in the Reference Manual  for
             more details.

EXAMPLE

   In  the  following, admin grants administrative privilege to
   smith, and makes smith's entry  expire  at  midnight  on  31
   December 1995.

   % kas sf smith ADMIN 12/31/95  Password for admin:

PRIVILEGE REQUIRED

   Issuer   must  have  the  ADMIN  flag  set  in  his  or  her
   Authentication Database entry.

MORE INFORMATION

   kas examine
