CASA/doc/Readme.txt

Common Authentication Service Adapter (CASA)


1.0  Overview

2.0  Documentation

3.0  Known Issues

4.0  Legal Notices


1.0  Overview

     Common Authentication Service Adapter (CASA) provides
     a common infrastructure for client authentication
     across the Linux* and Microsoft* Windows* desktops.
     Novell products (such as GroupWise, GroupWise
     Messenger, iPrint, Novell iFolder, and the Novell
     clients for Windows and Linux) are integrated with the
     miCASA interface and can take advantage of the
     credential store that provides the cornerstone for
     CASA.

     The main components of CASA on Linux are:

     -  CASA Identity Development Kit (IDK): The IDK
        provides a set of APIs that application and service
        developers can use to write user/application
        credentials to the credential store. The IDK APIs
        internally store the credentials passed onto them
        by the applications in miCASAd. There are C, C++,
        C# and Java bindings available for the CASA IDK.

     -  miCASAd: An active component that starts during
        boot time. On Linux, miCASAd is available in the
        run-levels 1, 2, 3 and 5. It runs with root
        privileges and is active as long as the system is
        up. It stores and provides credentials or secrets
        based on the Linux user identifier (uid) of the
        process that makes the IDK API calls. The
        credentials, which are stored by applications in
        miCASAd, are maintained in memory and written to 
	disk for this release. Session-based secrets implies
        secrets that are stored in an in-memory cache, are
        available only as long as the user is in session on
        the desktop, and are destroyed when miCASA daemon
        is restarted or the user logs off. When the user
        logs back in, the secrets written to disk are read
        back into memory.
      
     -  Login Credential Capture Module: On Linux, the
        login credential capture module is implemented as a
        PAM module. This PAM module captures the user's
        desktop login credentials and stores them in
        miCASAd using the IDK APIs. This PAM module is
        placed as the last module in the auth and session
        stacks of xdm, gdm, kdm, login and sshd PAM
        configuration files. The functionality of this 
	module is to store the credentials in miCASAd. 

        Any PAM module that uses the IDK APIs must set its
        effective user id temporarily to that of the user
        logging in (the user returned by calling
        pam_get_user()), if the credentials need to be
        stored against that user. There might be cases
        where the user obtained through pam_get_user()
        might not be the one against whom the PAM module
        actually intends to store credentials.


2.0  Documentation

     To read or print the documentation, you need Adobe
     Acrobat Reader 4.0
     (http://www.adobe.com/prodindex/acrobat/readstep.html)
     . 

     The document in this download was created as a
     standalone file; therefore, links to files in other
     downloads will not resolve.

     The download includes a single file: 
     CASA_Reference_Guide.pdf in the [install directory]\doc 
     directory.


3.0  Known issues
     
     - Secrets with IDs using reserved characters may fail.
       These will be fixed in a future release. Reserved 
       characters are 
	:
	\

     - CASA Manager might report an error stating that 
       miCASA Services are not available when selecting
       the 'File' option on the main menu. This problem
       is resolved by upgrading mono to the latest version
       (1.1.9 or later) available for download at 
       http://www.mono-project.com/Downloads.

     - CASA install rpm that is intended for 32 bit architecture
       should not be installed on 64 bit architecture because
       it can cause runtime problems.

     - Since CASA is tied to the Linux login process via PAM,
       events that cause the system to become inconsistent or 
       unstable may cause a user to be unable to login to the
       workstation.  Some possible causes of inconsistency or
       instability are:
        
         - Installing 32 bit CASA RPMs on a 64 bit OS
	 - Performing a hard reset on the machine
	
       Following the steps below will restore the ability to 
       login.
         
	 1) Reboot machine
	 2) When boot loader menu appears, type "init=/bin/bash"
	    (without quotes) on the options line and then Enter.
	    This will cause the machine to boot into a command 
	    shell with root privileges.
	 3) At the command prompt type "chkconfig micasad off"
	    (without quotes).  This will prevent the CASA daemon
	    from being loaded during bootup.
	 4) With a console based text editor (i.e. vi, emacs) 
	    remove all lines referencing the pam_micasa module in
	    the following pam configuration files (some files may 
	    not exist depending on what desktop managers have 
	    been installed:
	    
	    - /etc/pam.d/gdm
	    - /etc/pam.d/xdm
	    - /etc/pam.d/kdm
	    - /etc/pam.d/sshd
	    - /etc/pam.d/login
	         
	 5) At the command prompt type "init 5" (without quotes)
	    to boot into runlevel 5.  This will provide you with a
	    graphical login prompt.  You should be able to login
	    at this point.
	    
       After you have restored login capabilities, you will need
       to resolve the inconsistency that prevented login in the
       first place.  If you had installed a 32 bit CASA package
       on a 64 bit OS, you will need to uninstall the 32 bit
       package and install a CASA package built for 64 bit
       architectures.  If you are recovering from a hard reset
       no further action should be needed.
       
       To make it so CASA will run at boot time, open a shell and
       at the prompt type "chkconfig micasad 1235" (without 
       quotes).  This will cause micasad to be run at runlevels
       1, 2, 3, and 5.

     - When logged in to a KDE session, the gnome-keyring-daemon
       does not run by default.  Therefore, all apps that access
       the daemon, including our CASAManager will not be able to
       manage/access the gnome-keyring.
         
       You can manually start the daemon by running the following
       command from a shell prompt:
       
       gnome-keyring-daemon 
       
       When the gnome-keyring-daemon starts, it prints the
       GNOME_KEYRING_SOCKET environment variable and its value to
       the terminal. In Gnome, the daemon is started and the 
       environment variable is loaded into your X session 
       environment by default, but in KDE, you will
       have to manually load it.
        
       To load this environment variable, run a command similar to
       the following command from a shell prompt (replacing the 
       value of the environment variable with what the daemon
       output to the screen when you started it):
       
       export GNOME_KEYRING_SOCKET=/tmp/keyring-oaTsPs/socket
       
       Then you can run CASAManager GUI (from the same terminal
       you exported the variable from) and you will be able to
       manage and use the gnome-keyring in KDE just like you
       could if you were logged into Gnome.
       
4.0  Legal Notices

     Novell, Inc. makes no representations or warranties
     with respect to the contents or use of this
     documentation, and specifically disclaims any express
     or implied warranties of merchantability or fitness
     for any particular purpose. Further, Novell, Inc.
     reserves the right to revise this publication and to
     make changes to its content, at any time, without
     obligation to notify any person or entity of such
     revisions or changes.

     Further, Novell, Inc. makes no representations or
     warranties with respect to any software, and
     specifically disclaims any express or implied
     warranties of merchantability or fitness for any
     particular purpose. Further, Novell, Inc. reserves the
     right to make changes to any and all parts of Novell
     software, at any time, without any obligation to
     notify any person or entity of such changes.


     You may not use, export, or re-export this product in
     violation of any applicable laws or regulations
     including, without limitation, U.S. export regulations
     or the laws of the country in which you reside.


     Copyright  2005 Novell, Inc. All rights reserved.
     Permission is granted to copy, distribute, and/or
     modify this document under the terms of the GNU Free
     Documentation License (GFDL), Version 1.2 or any later
     version, published by the Free Software Foundation
     with no Invariant Sections, no Front-Cover Texts, and
     no Back-Cover Texts. A copy of the GFDL can be found
     at http://www.fsf.org/licenses/fdl.html.

     THIS DOCUMENT AND MODIFIED VERSIONS OF THIS DOCUMENT
     ARE PROVIDED UNDER THE TERMS OF THE GNU FREE
     DOCUMENTATION LICENSE WITH THE FURTHER UNDERSTANDING
     THAT:

     1. THE DOCUMENT IS PROVIDED ON AN "AS IS" BASIS,
     WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR
     IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES
     THAT THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT
     IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A PARTICULAR
     PURPOSE, OR NON-INFRINGING. THE ENTIRE RISK AS TO THE
     QUALITY, ACCURACY, AND PERFORMANCE OF THE DOCUMENT OR
     MODIFIED VERSION OF THE DOCUMENT IS WITH YOU. SHOULD
     ANY DOCUMENT OR MODIFIED VERSION PROVE DEFECTIVE IN
     ANY RESPECT, YOU (NOT THE INITIAL WRITER, AUTHOR OR
     ANY CONTRIBUTOR) ASSUME THE COST OF ANY NECESSARY
     SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF
     WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS
     LICENSE. NO USE OF ANY DOCUMENT OR MODIFIED VERSION OF
     THE DOCUMENT IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS
     DISCLAIMER; AND

     2. UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY,
     WHETHER IN TORT (INCLUDING NEGLIGENCE), CONTRACT, OR
     OTHERWISE, SHALL THE AUTHOR, INITIAL WRITER, ANY
     CONTRIBUTOR, OR ANY DISTRIBUTOR OF THE DOCUMENT OR
     MODIFIED VERSION OF THE DOCUMENT, OR ANY SUPPLIER OF
     ANY OF SUCH PARTIES, BE LIABLE TO ANY PERSON FOR ANY
     DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR
     CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING,
     WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK
     STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND
     ALL OTHER DAMAGES OR LOSSES ARISING OUT OF OR RELATING
     TO USE OF THE DOCUMENT AND MODIFIED VERSIONS OF THE
     DOCUMENT, EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED
     OF THE POSSIBILITY OF SUCH DAMAGES.


     Novell, Inc. has intellectual property rights relating
     to technology embodied in the product that is
     described in this document. In particular, and without
     limitation, these intellectual property rights may
     include one or more of the U.S. patents listed at
     http://www.novell.com/company/legal/patents/ and one
     or more additional patents or pending patent
     applications in the U.S. and in other countries.


     AppNotes is a registered trademark of Novell, Inc.

     AppTester is a registered trademark of Novell, Inc. in
     the United States.

     ASM is a trademark of Novell, Inc.

     BorderManager is a registered trademark of Novell,
     Inc.

     BrainShare is a registered service mark of Novell,
     Inc. in the United States and other countries.

     C3PO is a trademark of Novell, Inc.

     Certified Novell Engineer is a service mark of Novell,
     Inc.

     Client32 is a trademark of Novell, Inc.

     CNE is a registered service mark of Novell, Inc.

     ConsoleOne is a registered trademark of Novell, Inc.

     Controlled Access Printer is a trademark of Novell,
     Inc.

     Custom 3rd-Party Object is a trademark of Novell, Inc.

     DeveloperNet is a registered trademark of Novell, Inc.
     in the United States and other countries.

     DirXML is a registered trademark of Novell, Inc.

     eDirectory is a trademark of Novell, Inc.

     Excelerator is a trademark of Novell, Inc.

     exteNd is a trademark of Novell, Inc.

     exteNd Director is a trademark of Novell, Inc.

     exteNd Workbench is a trademark of Novell, Inc.

     FAN-OUT FAILOVER is a trademark of Novell, Inc.

     GroupWise is a registered trademark of Novell, Inc. in
     the United States and other countries.

     Hardware Specific Module is a trademark of Novell,
     Inc.

     Hot Fix is a trademark of Novell, Inc.

     iChain is a registered trademark of Novell, Inc.

     Internetwork Packet Exchange is a trademark of Novell,
     Inc.

     IPX is a trademark of Novell, Inc.

     IPX/SPX is a trademark of Novell, Inc.

     jBroker is a trademark of Novell, Inc.

     Link Support Layer is a trademark of Novell, Inc.

     LSL is a trademark of Novell, Inc.

     ManageWise is a registered trademark of Novell, Inc.,
     in the United States and other countries.

     Mirrored Server Link is a trademark of Novell, Inc.

     Mono is a registered trademark of Novell, Inc.

     MSL is a trademark of Novell, Inc.

     My World is a registered trademark of Novell, Inc. in
     the United States.

     NCP is a trademark of Novell, Inc.

     NDPS is a registered trademark of Novell, Inc.

     NDS is a registered trademark of Novell, Inc. in the
     United States and other countries.

     NDS Manager is a trademark of Novell, Inc.

     NE2000 is a trademark of Novell, Inc.

     NetMail is a registered trademark of Novell, Inc.

     NetWare is a registered trademark of Novell, Inc. in
     the United States and other countries.

     NetWare/IP is a trademark of Novell, Inc.

     NetWare Core Protocol is a trademark of Novell, Inc.

     NetWare Loadable Module is a trademark of Novell, Inc.

     NetWare Management Portal is a trademark of Novell,
     Inc.

     NetWare Name Service is a trademark of Novell, Inc.

     NetWare Peripheral Architecture is a trademark of
     Novell, Inc.

     NetWare Requester is a trademark of Novell, Inc.

     NetWare SFT and NetWare SFT III are trademarks of
     Novell, Inc.

     NetWare SQL is a trademark of Novell, Inc.

     NetWire is a registered service mark of Novell, Inc.
     in the United States and other countries.

     NLM is a trademark of Novell, Inc.

     NMAS is a trademark of Novell, Inc.

     NMS is a trademark of Novell, Inc.

     Novell is a registered trademark of Novell, Inc. in
     the United States and other countries.

     Novell Application Launcher is a trademark of Novell,
     Inc.

     Novell Authorized Service Center is a service mark of
     Novell, Inc.

     Novell Certificate Server is a trademark of Novell,
     Inc.

     Novell Client is a trademark of Novell, Inc.

     Novell Cluster Services is a trademark of Novell, Inc.

     Novell Directory Services is a registered trademark of
     Novell, Inc.

     Novell Distributed Print Services is a trademark of
     Novell, Inc.

     Novell iFolder is a registered trademark of Novell,
     Inc.

     Novell Labs is a trademark of Novell, Inc.

     Novell SecretStore is a registered trademark of
     Novell, Inc.

     Novell Security Attributes is a trademark of Novell,
     Inc.

     Novell Storage Services is a trademark of Novell, Inc.

     Novell, Yes, Tested & Approved logo is a trademark of
     Novell, Inc.

     Nsure is a registered trademark of Novell, Inc.

     Nterprise is a trademark of Novell, Inc.

     Nterprise Branch Office is a trademark of Novell, Inc.

     ODI is a trademark of Novell, Inc.

     Open Data-Link Interface is a trademark of Novell,
     Inc.

     Packet Burst is a trademark of Novell, Inc.

     PartnerNet is a registered service mark of Novell,
     Inc. in the United States and other countries.

     Printer Agent is a trademark of Novell, Inc.

     QuickFinder is a trademark of Novell, Inc.

     Red Box is a trademark of Novell, Inc.

     Red Carpet is a registered trademark of Novell, Inc.
     in the United States and other countries.

     Sequenced Packet Exchange is a trademark of Novell,
     Inc.

     SFT and SFT III are trademarks of Novell, Inc.

     SPX is a trademark of Novell, Inc.

     Storage Management Services is a trademark of Novell,
     Inc.

     SUSE is a registered trademark of SUSE AG, a Novell
     business.

     System V is a trademark of Novell, Inc.

     Topology Specific Module is a trademark of Novell,
     Inc.

     Transaction Tracking System is a trademark of Novell,
     Inc.

     TSM is a trademark of Novell, Inc.

     TTS is a trademark of Novell, Inc.

     Universal Component System is a registered trademark
     of Novell, Inc.

     Virtual Loadable Module is a trademark of Novell, Inc.

     VLM is a trademark of Novell, Inc.

     Yes Certified is a trademark of Novell, Inc.

     ZENworks is a registered trademark of Novell, Inc. in
     the United States and other countries.


     All third-party trademarks are the property of their
     respective owners.