.\" Copyright (c) 2003-2012
.\" Distributed Systems Software.  All rights reserved.
.\" See the file LICENSE for redistribution information.
.\" $Id: copyright-nr 2564 2012-03-02 00:17:08Z brachman $
'\" t
.\"     Title: dacs_managed_infocard
.\"    Author: [see the "AUTHOR" section]
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\"      Date: 02/19/2019
.\"    Manual: DACS Web Services Manual
.\"    Source: DACS 1.4.40
.\"  Language: English
.\"
.TH "DACS_MANAGED_INFOCAR" "8" "02/19/2019" "DACS 1.4.40" "DACS Web Services Manual"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
dacs_managed_infocard \- create a managed Information Card
.SH "SYNOPSIS"
.HP \w'\fBdacs_managed_infocard\fR\ 'u
\fBdacs_managed_infocard\fR [\fI\m[blue]\fBdacsoptions\fR\m[]\&\s-2\u[1]\d\s+2\fR]
.SH "DESCRIPTION"
.PP
This program is part of the
\fBDACS\fR
suite\&.
.PP
The
\fBdacs_managed_infocard\fR
web service is used to create and register a managed InfoCard so that it can be used for authentication or other purposes\&. InfoCard\-based authentication is performed by
\m[blue]\fBlocal_infocard_authenticate\fR\m[]\&\s-2\u[2]\d\s+2, a
\fBDACS\fR
authentication module\&.
.PP
A managed InfoCard must be registered by
\fBdacs_managed_infocard\fR
before it can be used by
\fBDACS\fR\&. After registration, use
\m[blue]\fBdacs_infocard(8)\fR\m[]\&\s-2\u[3]\d\s+2
or
\m[blue]\fBdacsinfocard(1)\fR\m[]\&\s-2\u[4]\d\s+2
to administer self\-issued or managed InfoCards\&.
.PP
There are several operational modes, determined by the
\fIMODE\fR
argument\&. In a self\-serve mode, an authenticated user requests a managed InfoCard (with various limitations imposed); the new InfoCard is either sent directly to the user\*(Aqs browser or written to a file that the user can access in a separate operation\&. In an administrative mode, a
\fBDACS\fR
administrator requests a managed InfoCard on behalf of a user and is responsible for directing it to the user in a separate, secure operation\&.
.PP
There are many
\m[blue]\fBconfiguration directives\fR\m[]\&\s-2\u[5]\d\s+2
associated with managed InfoCards\&. One of the most important is
\m[blue]\fBINFOCARD_STS_AUTH_TYPE\fR\m[]\&\s-2\u[6]\d\s+2, which determines the authentication method ("credential type") used between an Identity Selector, such as
\fBCardSpace\fR, and the managed InfoCard\*(Aqs Identity Provider/Secure Token Service (IP/STS), such as
\m[blue]\fBdacs_sts(8)\fR\m[]\&\s-2\u[7]\d\s+2\&. The following authentication methods are prescribed by the InfoCard specification:
.PP
UsernamePasswordCredential
.RS 4
This is a username/password type of authentication\&. See
\m[blue]\fBINFOCARD_STS_PASSWORD_METHOD\fR\m[]\&\s-2\u[8]\d\s+2\&. At present, only a global (but changeable) password is allowed, or no password at all\&. A future release might allow a per\-InfoCard account password, or tie an InfoCard account to some other password\-based account\&.
.RE
.PP
X509V3Credential
.RS 4
In this authentication type, an SSL client certificate must be used with the request to
\fBdacs_managed_infocard\fR
for a managed InfoCard, and the same certificate must be used when the managed InfoCard is submitted to a Relying Party\&. A self\-signed certificate may be used\&.
.RE
.PP
SelfIssuedCredential
.RS 4
In this authentication type, a self\-issued InfoCard must be submitted with the request to
\m[blue]\fBdacs_managed_infocard(8)\fR\m[]\&\s-2\u[9]\d\s+2
for a managed InfoCard (more precisely, a secure token obtained from a self\-issued InfoCard that is passed as the argument
\fIxmlToken\fR) and the same self\-issued InfoCard must be available to the user\*(Aqs Identity Selector when the managed InfoCard is submitted to a Relying Party\&.
.RE
.PP
KerberosV5Credential
.RS 4
This is the Kerberos V5 credential type\&. This authentication credential type is currently unsupported\&.
.RE
.if n \{\
.sp
.\}
.RS 4
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBNote\fR
.ps -1
.br
.PP
An Identity Selector will display all claim values returned to it by an Identity Provider\&. An Identity Provider must therefore employ cryptographic methods to obtain privacy or check authenticity with respect to claim values\&.
.sp .5v
.RE
.PP
Accounts are accessed through
\fBDACS\*(Aqs\fR
virtual filestore using item type
infocards\&. It is assumed that file permissions on the account database are such that all access is limited to the administrator,
\fBlocal_infocard_authenticate\fR,
\m[blue]\fBdacs_infocard(8)\fR\m[]\&\s-2\u[3]\d\s+2, and
\m[blue]\fBdacs_sts(8)\fR\m[]\&\s-2\u[7]\d\s+2\&.
.SS "Configuration"
.PP
The following configuration variables are available:
.PP
\fIinfocard_card_image_card\fR
.RS 4
If
\m[blue]\fBINFOCARD_STS_AUTH_TYPE\fR\m[]\&\s-2\u[6]\d\s+2
is "card", this is used as the filename of the image to include with a new managed card, relative to the
\m[blue]\fBINFOCARD_CARD_IMAGE_BASE_URL\fR\m[]\&\s-2\u[10]\d\s+2
URI\&. The default value is the string "dacs_selfissued_credential\&.png" (or similar)\&.
.RE
.PP
\fIinfocard_card_image_cert\fR
.RS 4
If
\m[blue]\fBINFOCARD_STS_AUTH_TYPE\fR\m[]\&\s-2\u[6]\d\s+2
is "cert", this is used as the filename of the image to include with a new managed card, relative to the
\m[blue]\fBINFOCARD_CARD_IMAGE_BASE_URL\fR\m[]\&\s-2\u[10]\d\s+2
URI\&. The default value is the string "dacs_x509certificate_credential\&.png" (or similar)\&.
.RE
.PP
\fIinfocard_card_image_passwd\fR
.RS 4
If
\m[blue]\fBINFOCARD_STS_AUTH_TYPE\fR\m[]\&\s-2\u[6]\d\s+2
is "passwd", this is used as the filename of the image to include with a new managed card, relative to the
\m[blue]\fBINFOCARD_CARD_IMAGE_BASE_URL\fR\m[]\&\s-2\u[10]\d\s+2
URI\&. The default value is the string "dacs_username_password_credential\&.png" (or similar)\&.
.RE
.PP
\fIinfocard_sts_title\fR
.RS 4
This string identifies the IP/STS and may be displayed on web pages and Identity Selector prompts, or in error messages\&. The default value is the string "DACS Managed InfoCard IP/STS" (or similar)\&.
.RE
.PP
\fIinfocard_sts_username_password_prompt_fmt\fR
.RS 4
This is a
\m[blue]\fBprintf(3)\fR\m[]\&\s-2\u[11]\d\s+2\-type format string\&. It may contain at most one conversion specification,
%s, which will interpolate the value of
\fIinfocard_sts_title\fR\&.
.RE
.SH "OPTIONS"
.SS "Web Service Arguments"
.PP
In addition to the
\m[blue]\fBstandard CGI arguments\fR\m[]\&\s-2\u[12]\d\s+2,
\fBdacs_managed_infocard\fR
understands the following CGI arguments:
.PP
.PP
\fIxmlToken\fR
.RS 4
This argument is required if
\m[blue]\fBINFOCARD_STS_AUTH_TYPE\fR\m[]\&\s-2\u[6]\d\s+2
is set to "card"\&. The self\-issued InfoCard is registered with the account associated with the new managed InfoCard and the user\*(Aqs Identity Selector must possess the self\-issued InfoCard in order to use the managed InfoCard\&.
.RE
.PP
\fICARD_IMAGE_SUBTYPE\fR
.RS 4
This optional argument specifies the MIME media subtype (e\&.g\&., the image format, such as "jpeg") of the image file attached to the new InfoCard\&. By default, the subtype is derived from the extension on the end of the last path component of the image\*(Aqs URI\&. For example, if
\fICARD_IMAGE_URL\fR
is
/card_images/bob\&.tn\&.gif, then the extension
\&.gif
is used to obtain a media subtype of
gif
and a MIME media type of
image/gif\&. It is sometimes necessary to give the image format explicitly, however\&. See
\m[blue]\fBINFOCARD_CARD_IMAGE_BASE_URL\fR\m[]\&\s-2\u[10]\d\s+2
for additional details\&. Only a
\fBDACS\fR
administrator may use this argument\&.
.RE
.PP
\fICARD_IMAGE_URL\fR
.RS 4
This optional argument specifies the location (as a
\fBDACS\fR
\m[blue]\fBVFS URI\fR\m[]\&\s-2\u[13]\d\s+2) of the image file to attach to the new InfoCard, overriding the default method that uses only
\m[blue]\fBINFOCARD_CARD_IMAGE_BASE_URL\fR\m[]\&\s-2\u[10]\d\s+2\&. If a file is specified (i\&.e\&., the value begins with a \*(Aq/\*(Aq or uses the
file
scheme), the path is relative to the
INFOCARD_CARD_IMAGE_BASE_URL, which must specify a directory\&. Only a
\fBDACS\fR
administrator may use this argument\&.
.RE
.PP
\fIFORMAT\fR
.RS 4
By default, or if the value of the
\m[blue]\fB\fIFORMAT\fR argument\fR\m[]\&\s-2\u[14]\d\s+2
is
FILE, the new card is sent directly to the user\*(Aqs browser (which should automatically invoke the user\*(Aqs Identity Selector); no copy is retained on the server\&. If
\fIFORMAT\fR
is
HTML, the new managed InfoCard is stored in a file, replacing any existing card of the same name (see
\m[blue]\fBINFOCARD_CARD_OUTPUTDIR\fR\m[]\&\s-2\u[15]\d\s+2)\&. Output is emitted in HTML and includes a link to the file (see
\m[blue]\fBINFOCARD_CARDID_BASE_URL\fR\m[]\&\s-2\u[16]\d\s+2)\&. Only the owner of new card should be able to access it\&.
.RE
.PP
\fIINFOCARD_IDENTITY\fR
.RS 4
Normally, this argument is omitted and the managed InfoCard is created on behalf of the identity that is invoking
\fBdacs_managed_infocard\fR\&. This argument allows a
\fBDACS\fR
administrator to create a card for a specific identity\&.
.RE
.PP
\fIMODE\fR
.RS 4
This optional argument is used to select how
\m[blue]\fBclaim information\fR\m[]\&\s-2\u[17]\d\s+2
is stored and retrieved\&. Four values are recognized:
.PP
DACS
.RS 4
In this usage mode, which is the default, claims are defined and filled depending on
\fBDACS\fR
configuration:
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
if both
\m[blue]\fBINFOCARD_CARD_DEFS_URL\fR\m[]\&\s-2\u[18]\d\s+2
and
\m[blue]\fBINFOCARD_CARD_FILL_URL\fR\m[]\&\s-2\u[19]\d\s+2
are configured, the former web service is called (once, by
\fBdacs_managed_infocard\fR) to define the claims that will be assigned to the new managed InfoCard and the latter web service is called (by
\m[blue]\fBdacs_sts(8)\fR\m[]\&\s-2\u[7]\d\s+2, each time the InfoCard is used) to obtain the values of those claims (or the requested and approved subset)\&. The claim definitions may not be modified, but claim values do not need to be static\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
if neither of those web services are configured, a minimal set of claims is automatically defined to facilitate authentication\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
any other configuration is invalid
.RE
.sp
An identity is always associated with these InfoCards using a claim named
dacs_identity
in the
\fBDACS\fR
namespace (http://dacs\&.dss\&.ca/claims)\&. By default, the identity used is that of the requestor\&. An administrator may instead specify the identity using the
\fIINFOCARD_IDENTITY\fR
argument, which need only be a syntactically valid
\fBDACS\fR
identity\&.
.RE
.PP
STATIC
.RS 4
In this mode, the caller of
\fBdacs_managed_infocard\fR
defines the claims and their values when the card is created;
\fBDACS\fR
is responsible for storing this information and producing secure tokens from it\&. Unlike the
DACS
mode, the values of these claims cannot be changed; a future release may implement this capability\&.
.sp
The caller may specify from zero to a compile\-time maximum number of claims (MIC_MAX_STATIC_CLAIMS,
\fB10\fR)\&. A
privatepersonalidentifier
(PPID) is always created automatically, so any user request for that claim is ignored\&. Only a
\fBDACS\fR
administrator may define the
dacs_identity
claim in the
\fBDACS\fR
namespace; if present, it must be a syntactically valid
\fBDACS\fR
identity\&. Therefore, only a
\fBDACS\fR
administrator may use this mode to create an InfoCard that can be used for
\fBDACS\fR
authentication\&. Similiarly, only a
\fBDACS\fR
administrator may define the
dacs_roles
claim in the
\fBDACS\fR
namespace; if present, it must be a syntactically valid
\m[blue]\fBrole descriptor string\fR\m[]\&\s-2\u[20]\d\s+2\&.
.sp
The claims are specified by up to
MIC_MAX_STATIC_CLAIMS
arguments (not counting any
PPID
claims) of the form
CLAIM_\fInum\fR_\fItype\fR, where
\fInum\fR
starts at one and continues with consecutive integers and
\fItype\fR
is:
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
NAME
for the name of the claim, which must consist of between one and
MIC_MAX_STATIC_NAME_CLAIM_SIZE
(\fB32\fR) characters valid in a URI path segment\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
VALUE
is the value associated with the claim and consists of between one and
MIC_MAX_STATIC_VALUE_CLAIM_SIZE
(\fB64\fR) printable characters\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
URI
is the URI namespace with which
NAME
is associated; for convenience, "standard" signifies the self\-issued InfoCard namespace (http://schemas\&.xmlsoap\&.org/ws/2005/05/identity/claims), and "dacs" is short for the
\fBDACS\fR
namespace (http://dacs\&.dss\&.ca/claims); any other non\-empty string can be any syntactically valid URI of up to
MIC_MAX_STATIC_URI_CLAIM_SIZE
(\fB128\fR), and an empty string indicates that the default URI should be used\&.
.if n \{\
.sp
.\}
.RS 4
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBNote\fR
.ps -1
.br
The
\fBDACS\fR
namespace is reserved for use by
\fBDACS\fR
and identifies claim types with semantics that are defined by
\fBDACS\fR\&.
.sp .5v
.RE
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
LABEL
is a string that an Identity Selector should display with the claim and consists of between one and
MIC_MAX_STATIC_LABEL_CLAIM_SIZE
(\fB20\fR) printable characters\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
DESC
is a string that an Identity Selector should display with the claim and consists of between one and
MIC_MAX_STATIC_DESC_CLAIM_SIZE
(\fB40\fR) printable characters; if missing or the empty string, the value of the corresponding
LABEL
argument is used\&.
.RE
.sp
The optional argument
\fICLAIM_URI\fR
has the same syntax as a
CLAIM_\fInum\fR_URI
argument and establishes a default URI that will be used if any
CLAIM_\fInum\fR_URI
argument is missing or is the empty string\&.
.sp
The optional argument
\fICARD_NAME\fR
assigns a name to the InfoCard, which will be displayed by an Identity Selector\&.
.sp
The first missing or null\-string\-valued
CLAIM_\fInum\fR_NAME
or
CLAIM_\fInum\fR_VALUE
argument indicates the end of the list\&. For example, if two claims are defined, the following arguments might be passed:
\fICLAIM_1_NAME\fR,
\fICLAIM_1_VALUE\fR,
\fICLAIM_1_URI\fR,
\fICLAIM_1_LABEL\fR,
\fICLAIM_1_DESC\fR,
\fICLAIM_2_NAME\fR,
\fICLAIM_2_VALUE\fR,
\fICLAIM_2_URI\fR,
\fICLAIM_2_LABEL\fR, and
\fICLAIM_2_DESC\fR\&. Any syntactical or length violation causes a fatal error\&.
.RE
.PP
ISTATIC
.RS 4
This mode is identical to the
STATIC
mode except that if it is used by an identity other than a
\fBDACS\fR
administrator, a
dacs_identity
claim in the
dacs
namespace is automatically added with the value of the caller\*(Aqs identity\&. The InfoCard may be used for
\fBDACS\fR
authentication\&.
.RE
.PP
DYNAMIC
.RS 4
The caller of
\fBdacs_managed_infocard\fR
provides URLs for two web services: one to define claims and another to fill claims\&. The caller is responsible for managing claim definitions and values\&. These web services are expected to behave exactly the same as those that are specified by
\m[blue]\fBINFOCARD_CARD_DEFS_URL\fR\m[]\&\s-2\u[18]\d\s+2
and
\m[blue]\fBINFOCARD_CARD_FILL_URL\fR\m[]\&\s-2\u[19]\d\s+2\&. This mode is not implemented\&.
.RE
.sp
.RE
.SH "FILES"
.PP
\m[blue]\fBdacs_managed_infocard\&.css\fR\m[]\&\s-2\u[21]\d\s+2
.SH "DIAGNOSTICS"
.PP
The program exits
0
if everything was fine,
1
if an error occurred\&.
.SH "BUGS"
.PP
It is currently not possible to just register a managed InfoCard (you must create and register it), so you cannot import a card\&.
.PP
This functionality should probably be integrated with
\m[blue]\fBdacs_infocard(8)\fR\m[]\&\s-2\u[3]\d\s+2
(and
\m[blue]\fBdacsinfocard(1)\fR\m[]\&\s-2\u[4]\d\s+2)\&.
.PP
Once a managed InfoCard is created, most of its characteristics cannot be changed\&. There should be a way to "refresh" a managed InfoCard that has expired or otherwise become invalid\&.
.PP
The various constraints on claim types should probably be run\-time configurable, or possibly done away with altogether\&. The specification imposes no limits on them\&.
.PP
There should be a web service and utility to allow creation of a self\-issued InfoCard (which may then be imported into a user\*(Aqs Identity Selector)\&.
.PP
In 2011, Microsoft
\m[blue]\fBannounced\fR\m[]\&\s-2\u[22]\d\s+2
that Windows CardSpace 2\&.0 will not be shipped and they will offer a new technology called U\-Prove\&.
.SH "SEE ALSO"
.PP
\m[blue]\fBdacsinfocard(1)\fR\m[]\&\s-2\u[4]\d\s+2,
\m[blue]\fBdacs\&.conf(5)\fR\m[]\&\s-2\u[23]\d\s+2,
\m[blue]\fBdacs_authenticate(8)\fR\m[]\&\s-2\u[24]\d\s+2,
\m[blue]\fBdacs_infocard(8)\fR\m[]\&\s-2\u[3]\d\s+2,
\m[blue]\fBdacs_mex(8)\fR\m[]\&\s-2\u[25]\d\s+2,
\m[blue]\fBdacs_sts(8)\fR\m[]\&\s-2\u[7]\d\s+2,
\m[blue]\fBUsing InfoCards With DACS\fR\m[]\&\s-2\u[26]\d\s+2
.SH "AUTHOR"
.PP
Distributed Systems Software (\m[blue]\fBwww\&.dss\&.ca\fR\m[]\&\s-2\u[27]\d\s+2)
.SH "COPYING"
.PP
Copyright \(co 2003\-2018 Distributed Systems Software\&. See the
\m[blue]\fBLICENSE\fR\m[]\&\s-2\u[28]\d\s+2
file that accompanies the distribution for licensing information\&.
.SH "NOTES"
.IP " 1." 4
dacsoptions
.RS 4
\%http://dacs.dss.ca/man/dacs.1.html#dacsoptions
.RE
.IP " 2." 4
local_infocard_authenticate
.RS 4
\%http://dacs.dss.ca/man/dacs_authenticate.8.html#local_infocard_authenticate
.RE
.IP " 3." 4
dacs_infocard(8)
.RS 4
\%http://dacs.dss.ca/man/dacs_infocard.8.html
.RE
.IP " 4." 4
dacsinfocard(1)
.RS 4
\%http://dacs.dss.ca/man/dacsinfocard.1.html
.RE
.IP " 5." 4
configuration directives
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html#INFOCARD_prefixed
.RE
.IP " 6." 4
INFOCARD_STS_AUTH_TYPE
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html#INFOCARD_STS_AUTH_TYPE
.RE
.IP " 7." 4
dacs_sts(8)
.RS 4
\%http://dacs.dss.ca/man/dacs_sts.8.html
.RE
.IP " 8." 4
INFOCARD_STS_PASSWORD_METHOD
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html#INFOCARD_STS_PASSWORD_METHOD
.RE
.IP " 9." 4
dacs_managed_infocard(8)
.RS 4
\%http://dacs.dss.ca/man/dacs_managed_infocard.8.html
.RE
.IP "10." 4
INFOCARD_CARD_IMAGE_BASE_URL
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html#INFOCARD_CARD_IMAGE_BASE_URL
.RE
.IP "11." 4
printf(3)
.RS 4
\%https://www.freebsd.org/cgi/man.cgi?query=printf&apropos=0&sektion=3&manpath=FreeBSD+10.3-RELEASE&format=html
.RE
.IP "12." 4
standard CGI arguments
.RS 4
\%http://dacs.dss.ca/man/dacs.services.8.html#standard_cgi_args
.RE
.IP "13." 4
VFS URI
.RS 4
\%http://dacs.dss.ca/man/#VFS
.RE
.IP "14." 4
\fIFORMAT\fR argument
.RS 4
\%http://dacs.dss.ca/man/dacs.services.8.html#FORMAT
.RE
.IP "15." 4
INFOCARD_CARD_OUTPUTDIR
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html#INFOCARD_CARD_OUTPUTDIR
.RE
.IP "16." 4
INFOCARD_CARDID_BASE_URL
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html#INFOCARD_CARDID_BASE_URL
.RE
.IP "17." 4
claim information
.RS 4
\%http://dacs.dss.ca/man/dacs_infocard.8.html#about_claims
.RE
.IP "18." 4
INFOCARD_CARD_DEFS_URL
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html#INFOCARD_CARD_DEFS_URL
.RE
.IP "19." 4
INFOCARD_CARD_FILL_URL
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html#INFOCARD_CARD_FILL_URL
.RE
.IP "20." 4
role descriptor string
.RS 4
\%http://dacs.dss.ca/man/dacs.1.html#roles
.RE
.IP "21." 4
dacs_managed_infocard.css
.RS 4
\%http://dacs.dss.ca/man//css/dacs_managed_infocard.css
.RE
.IP "22." 4
announced
.RS 4
\%http://blogs.msdn.com/b/card/archive/2011/02/15/beyond-windows-cardspace.aspx
.RE
.IP "23." 4
dacs.conf(5)
.RS 4
\%http://dacs.dss.ca/man/dacs.conf.5.html
.RE
.IP "24." 4
dacs_authenticate(8)
.RS 4
\%http://dacs.dss.ca/man/dacs_authenticate.8.html
.RE
.IP "25." 4
dacs_mex(8)
.RS 4
\%http://dacs.dss.ca/man/dacs_mex.8.html
.RE
.IP "26." 4
Using InfoCards With DACS
.RS 4
\%http://dacs.dss.ca/man/using-infocards-with-dacs.html
.RE
.IP "27." 4
www.dss.ca
.RS 4
\%http://www.dss.ca
.RE
.IP "28." 4
LICENSE
.RS 4
\%http://dacs.dss.ca/man/../misc/LICENSE
.RE