ecp-get-cert
Create an X.509 certificate using ECP authentication.
ecp-get-cert enables you to authenticate using SAML/ECP against any identity provider registered with CILogon, and create an X.509 credential for use in querying services under the same identity and access management domain.
Usage: ecp-get-cert [-i IDENTITY_PROVIDER] [-k] [-u USERNAME] [-h] [-l] [-V]
[-d] [-f FILE] [-H HOURS] [-p] [-r [HOURS]] [-v] [-X]
Authentication options
- -i, --identity-provider
name of institution providing the identity (e.g. ‘Cardiff University’), or domain name of IdP host (e.g. idp.cf.ac.uk), see –list-idps for a list of Identity Provider (IdPs) and their IdP URL. Shortened institution names (e.g. ‘Cardiff’) can be given as long as they uniquely match a full institution name known by CILogon
- -k, --kerberos
enable kerberos negotiation
Default: False
- -u, --username
authentication username, will be prompted for if not given and not using –kerberos
Other options
- -d, --debug
write debug output (uses both stderr and stdout, implies –verbose)
Default: False
- -f, --file
certificate file to create/reuse/destroy
Default: “/tmp/x509up_u1005”
- -H, --hours
lifetime of the certificate
Default: 277
- -p, --proxy
create RFC 3820 compliant impersonation proxy
Default: False
- -r, --reuse
reuse an existing certificate if valid for more than 1.0 hours, or pass a number of hours to specify
Default: False
- -v, --verbose
write verbose output to stdout
Default: False
- -X, --destroy
destroy existing certificate
Default: False
Helper arguments
- -l, --list-idps
show IdP names and URLs and exit
- -V, --version
show program’s version number and exit
Examples:
$ ecp-get-cert -i ‘My Institution’
to authenticate with a username and password prompt, or
$ ecp-get-cert -u user.name -i ‘My Institution’
to authenticate with only a password prompt, or
$ ecp-get-cert -i ‘My Institution’ -k
to reuse an existing kerberos (kinit
) credential.
The identitity provider name can be given in a number of ways, so long as the argument uniquely identifies a provider. For example, the following are all equivalent:
$ ecp-get-cert -i ‘Cardiff University’ $ ecp-get-cert -i Cardiff $ ecp-get-cert -i idp.cf.ac.uk $ ECP_IDP=”Cardiff” ecp-get-cert
Environment:
- X509_USER_PROXY:
the default path for the credential file
- ECP_IDP:
the name/url of the default Identity Provider (–institution)