<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN"
       	"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" [
<!ENTITY authors  SYSTEM "authors.sgml">
<!ENTITY bugzilla SYSTEM "bugzilla.sgml">
<!ENTITY license  SYSTEM "license.sgml">
<!ENTITY links    SYSTEM "links.sgml">
]>

<refentry id='vomsproxyinit1'>
<refmeta>
<refentrytitle>voms-proxy-init</refentrytitle>
<manvolnum>1</manvolnum>
<refmiscinfo class='source'>VOMS Client</refmiscinfo>
</refmeta>

<refnamediv id='name'>
<refname>voms-proxy-init</refname>
<refpurpose>create a proxy with VOMS extensions</refpurpose>
</refnamediv>

<refsynopsisdiv id='synopsis'>
<cmdsynopsis>
<command>voms-proxy-init</command>
<arg choice='opt'><arg choice='plain'>options</arg></arg>
</cmdsynopsis>
</refsynopsisdiv>

<refsect1 id='description'><title>Description</title>

<para>The voms-proxy-init generates a proxy with the VOMS information 
included in a non critical extension.</para>

</refsect1>

<refsect1 id='options'><title>Options</title>

<para>Options may be specified indifferently with either a "-" or "--" prefix. The 
options from -help to -out are present for compatibility with
grid-proxy-init, and have the exact same meaning. The meaning of the other
ones is the following.</para>

<para><option>-help</option></para>
<para><option>-usage</option>
Displays usage</para>

<para><option>-version</option></para>
<para>Displays version</para>

<para><option>-debug</option>
Enables extra debug output</para>

<para><option>-quiet</option></para>
<para><option>-q</option>
Quiet mode, minimal output</para>

<para><option>-verify</option>
Verifies proxy</para>

<para><option>-pwstdin</option>
Allows passphrase from stdin</para>

<para><option>-limited</option>
Creates a limited proxy</para>

<para><option>-hours</option> <replaceable>H</replaceable>
Proxy is valid for <emphasis remap='I'>H</emphasis> hours (default:12) This option is deprecated and is only present for compatibility with grid-proxy-init, since this option does not set the validity of the credentials returned by VOMS.  Use -valid instead.</para>

<para><option>-vomslife</option> <replaceable>H</replaceable>
Tries to get a pseudo cert with information valid for <emphasis remap='I'>H</emphasis> hours. The
default is "as long as the proxy certificate". The special value <literal>0</literal> means
as long as the server will allow.

This option is deprecated, since it does not set the validity of the generated proxy.  Use -valid instead.</para>

<para><option>-valid</option> <replaceable>HH:MM</replaceable>
This option attempts to set the validity for both the proxy and the credentials returned by the VOMS server.  The latter validity may however be shortened due to server policy.

This option obsoletes both -hours and -vomslife, and should be used in preference to both</para>

<para><option>-bits</option> <replaceable>B</replaceable>
Number of bits in key {0|512|1024|2048|4096}.  0 is a special value
which means: same number of bits as in the issuing certificate.</para>

<para><option>-cert</option> <replaceable>certfile</replaceable>
Non-standard location of user certificate</para>

<para><option>-key</option> <replaceable>keyfile</replaceable>
Non-standard location of user key</para>

<para><option>-certdir</option> <replaceable>certdir</replaceable>
Non standard location where the trusted CAs certificates are kept.</para>

<para><option>-out</option> <replaceable>proxyfile</replaceable>
Location of new proxy cert</para>

<para><option>-voms</option> <replaceable>voms[:command]</replaceable>
Specifies the VOMS server to contact using the nickname <emphasis
remap='I'>voms</emphasis>.  It also allows one to send a specific command
to the server.  The default command is <emphasis
remap='B'>:all</emphasis>, and it gets all group membership information.

Other commands are <emphasis remap='B'>:/Role=rolename</emphasis>
which grants the <emphasis remap='B'>rolename</emphasis> VO-wide role
if the server allows it, and <emphasis
remap='B'>:/group/Role=rolename</emphasis> which grants the role
<emphasis remap='B'>rolename</emphasis> only in the group <emphasis
remap='B'>/group</emphasis>, again only if the server allows
it.</para>
<para>
Example : voms-proxy-init --voms myVO:/myVO/Role=VO-Admin</para>

<para><option>-order</option> <replaceable>fqan</replaceable>
Specified fqans, if present, are put on top of the list of attributes
returned by the server in the order in which they are passed (using more
-order call). The order of the others is not specified. If some of the fqans are not
returned no warning is given. Capability selection is not supported.</para>

<para><option>-include</option> <replaceable>file</replaceable>
Includes <emphasis remap='I'>file</emphasis> in the certificate (in a non
critical extension)</para>

<para><option>-conf</option> <replaceable>file</replaceable>
Read options from <emphasis remap='I'>file</emphasis>.</para>

<para><option>-confile</option> <replaceable>file</replaceable></para>
<para><option>-userconf</option> <replaceable>file</replaceable></para>
<para><option>-vomses</option> <replaceable>file</replaceable>
Specifies the name of a configuration file from which a list of nicknames is read.
The format of the file is the following:
<emphasis remap='I'>nick</emphasis> <emphasis remap='I'>host</emphasis> <emphasis remap='I'>port</emphasis> <emphasis remap='I'>subject</emphasis> <emphasis remap='I'>vo</emphasis>
where nick is the nickname, host and port are the hostname and port of the server to contact, subject is the
subject of the server's certificate, while vo is the name of the VO that owns the server. The default
filenames are $PREFIX/etc/vomses and $HOME/.voms/vomses.</para>

<para>Moreover, permissions must be 644 if a file is specified,
and 755 if a directory is specified</para>

<para>The three options are synonyms. -confile and -userconf are deprecated. -vomses
should be used instead.</para>

<para><option>-policy</option>
The file containing the policy expression.</para>

<para><option>-policy-language</option><replaceable> pl</replaceable></para>
<para><option>-pl</option><replaceable> pl</replaceable>
The language in which the policy is expressed. Default is IMPERSONATION_PROXY.</para>

<para><option>-path-length</option>
Maximum depth of proxy certfificate that can be signed from this.</para>

<para><option>-globus</option> <replaceable>version</replaceable>
This option is obsolete and only present for backwards compatibility
  with old installations.  Currently, its value is ignored.</para>

<para><option>-proxyver</option>
Version of the proxy certificate to create. May be 2, 3 or 4.
Default value is decided upon underlying globus version.</para>

<para><option>-rfc</option>
This option is a synonym of <option>-proxyver 4</option> and it
  generates a RFC-compliant proxy.</para>

<para><option>-old</option>
This option is a synonym of <option>-proxyver 2</option> and it
  generates a legacy proxy.</para>

<para><option>-target</option> <replaceable>hostname</replaceable>
This option targets the generated AC to a specific host.  This
  option may be specified multiple times to allow for multiple
  hosts.</para>

<para><option>-timeout</option> <replaceable>seconds</replaceable>
This option allows one to specify the maximum number of seconds that
  voms-proxy-init will wait while trying to establish a connection
  with the server.  Its default value is -1 (unlimited).</para>

<para><option>-noregen</option>
Use existing proxy to contact the server and to sing the new proxy.</para>

<para><option>-separate</option> <replaceable>file</replaceable>
Saves the voms credential on file <emphasis remap='I'>file</emphasis>.</para>

<para><option>-ignorewarn</option>
Ignore all warnings. They are not shown to the user.</para>

<para><option>-failonwarn</option>
Warnings become failures. The program will translates all warnings into errors
and will react accordingly, by returning a failure itself.</para>

<para><option>-list</option>
Instead of producing an attribute certificate, this optin will print
on screen a list of all attributes available to the user.</para>

<para><option>-includeac</option> <replaceable>file</replaceable>
Adds the VOMS AC in <emphasis remap='I'>file</emphasis> to the proxy.</para>

</refsect1>

&bugzilla;

<refsect1 id='seealso'><title>See also</title>

<para>voms-proxy-info(1), voms-proxy-destroy(1)</para>

&links;

</refsect1>

&authors;

&license;

</refentry>
