Frontmatter

©June 1997, The Open Group All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior permission of the copyright owners.

Any comments relating to the material contained in this document may be submitted to The Open Group at:

The Open Group
Apex Plaza
Forbury Road
Reading
Berkshire, RG1 1AX
United Kingdom

OGSpecs@opengroup.org

Preface

The Open Group

The Open Group is the leading vendor-neutral, international consortium for buyers and suppliers of technology. Its mission is to cause the development of a viable global information infrastructure that is ubiquitous, trusted, reliable, and as easy-to-use as the telephone. The essential functionality embedded in this infrastructure is what we term the IT DialTone. The Open Group creates an environment where all elements involved in technology development can cooperate to deliver less costly and more flexible IT solutions.

Formed in 1996 by the merger of the X/Open Company Ltd. (founded in 1984) and the Open Software Foundation (founded in 1988), The Open Group is supported by most of the world's largest user organizations, information systems vendors, and software suppliers. By combining the strengths of open systems specifications and a proven branding scheme with collaborative technology development and advanced research, The Open Group is well positioned to meet its new mission, as well as to assist user organizations, vendors, and suppliers in the development and implementation of products supporting the adoption and proliferation of systems which conform to standard specifications.

With more than 200 member companies, The Open Group helps the IT industry to advance technologically while managing the change caused by innovation. It does this by:

• consolidating, prioritizing, and communicating customer requirements to vendors

• conducting research and development with industry, academia, and government agencies to deliver innovation and economy through projects associated with its Research Institute

• managing cost-effective development efforts that accelerate consistent multi-vendor deployment of technology in response to customer requirements

• adopting, integrating, and publishing industry standard specifications that provide an essential set of blueprints for building open information systems and integrating new technology as it becomes available

• licensing and promoting the Open Brand, represented by the "X" mark, that designates vendor products which conform to Open Group Product Standards

• promoting the benefits of the IT DialTone to customers, vendors, and the public.

The Open Group operates in all phases of the open systems technology lifecycle including innovation, market adoption, product development, and proliferation. Presently, it focuses on seven strategic areas: open systems application platform development, architecture, distributed systems management, interoperability, distributed computing environment, security, and the information superhighway. The Open Group is also responsible for the management of the UNIX trademark on behalf of the industry.

The Development of Product Standards

This process includes the identification of requirements for open systems and, now, the IT DialTone, development of CAE and Preliminary Specifications through an industry consensus review and adoption procedure (in parallel with formal standards work), and the development of tests and conformance criteria.

This leads to the preparation of a Product Standard which is the name used for the documentation that records the conformance requirements (and other information) to which a vendor may register a product. There are currently two forms of Product Standard, namely the Profile Definition and the Component Definition, although these will eventually be merged into one.

The "X" mark is used by vendors to demonstrate that their products conform to the relevant Product Standard. By use of the Open Brand they guarantee, through the X/Open Trade Mark Licence Agreement (TMLA), to maintain their products in conformance with the Product Standard so that the product works, will continue to work, and that any problems will be fixed by the vendor.

Open Group Publications

The Open Group publishes a wide range of technical documentation, the main part of which is focused on specification development and product documentation, but which also includes Guides, Snapshots, Technical Studies, Branding and Testing documentation, industry surveys, and business titles.

There are several types of specification:

• CAE Specifications

  CAE (Common Applications Environment) Specifications are the stable specifications that form the basis for our Product Standards, which are used to develop X/Open branded systems. These specifications are intended to be used widely within the industry for product development and procurement purposes.

  Anyone developing products that implement a CAE Specification can enjoy the benefits of a single, widely supported industry standard. Where appropriate, they can demonstrate product compliance through the Open Brand. CAE Specifications are published as soon as they are developed, so enabling vendors to proceed with development of conformant products without delay.
  

• Preliminary Specifications

  Preliminary Specifications usually address an emerging area of technology and consequently are not yet supported by multiple sources of stable conformant implementations. They are published for the purpose of validation through implementation of products. A Preliminary Specification is not a draft specification; rather, it is as stable as can be achieved, through applying The Open Group's rigorous development and review procedures.

  Preliminary Specifications are analogous to the trial-use standards issued by formal standards organizations, and developers are encouraged to develop products on the basis of them. However, experience through implementation work may result in significant (possibly upwardly incompatible) changes before its progression to becoming a CAE Specification. While the intent is to progress Preliminary Specifications to corresponding CAE Specifications, the ability to do so depends on consensus among Open Group members.
  

• Consortium and Technology Specifications

  The Open Group publishes specifications on behalf of industry consortia. For example, it publishes the NMF SPIRIT procurement specifications on behalf of the Network Management Forum. It also publishes Technology Specifications relating to OSF/1, DCE, OSF/Motif, and CDE.

  Technology Specifications (formerly AES Specifications) are often candidates for consensus review, and may be adopted as CAE Specifications, in which case the relevant Technology Specification is superseded by a CAE Specification.

In addition, The Open Group publishes:

• Product Documentation

  This includes product documentation-programmer's guides, user manuals, and so on-relating to the Pre-structured Technology Projects (PSTs), such as DCE and CDE. It also includes the Single UNIX Documentation, designed for use as common product documentation for the whole industry.

• Guides

  These provide information that is useful in the evaluation, procurement, development, or management of open systems, particularly those that relate to the CAE Specifications. The Open Group Guides are advisory, not normative, and should not be referenced for purposes of specifying or claiming conformance to a Product Standard.

• Technical Studies

  Technical Studies present results of analyses performed on subjects of interest in areas relevant to The Open Group's Technical Program. They are intended to communicate the findings to the outside world so as to stimulate discussion and activity in other bodies and the industry in general.

Versions and Issues of Specifications

As with all live documents, CAE Specifications require revision to align with new developments and associated international standards. To distinguish between revised specifications which are fully backwards compatible and those which are not:

• A new Version indicates there is no change to the definitive information contained in the previous publication of that title, but additions/extensions are included. As such, it replaces the previous publication.

• A new Issue indicates there is substantive change to the definitive information contained in the previous publication of that title, and there may also be additions/extensions. As such, both previous and new documents are maintained as current publications.

Corrigenda

Readers should note that Corrigenda may apply to any publication. Corrigenda information is published on the World-Wide Web at http://www.opengroup.org/public/pubs.

Ordering Information

Full catalogue and ordering information on all Open Group publications is available on the World-Wide Web at http://www.opengroup.org/public/pubs.

This Document

• Introduction to Single Sign-on is an introduction to the XSSO.

• Conformance describes the conformance requirements.

• XSSO Architecture describes the basic XSSO architecture.

• XSSO Sign-on Services describes the XSSO Sign-on Services and the use of PAM and GSS-API to provide these.

• Parameter Passing Conventions in PAM describes the parameter passing conventions and constants used within the PAM specification.

• PAM - Application Program Interface (API) describes the application and system programming interfaces supported by PAM.

• Example Header Files contains example header files.

• PAM Configuration Administration discusses the topic of the administration of PAM Configuration.

• Internationalization discusses the issue of internationalization of the sign-on service.

• XSSO Account Management Services describes the XSSO Account Management services.

• A glossary and index are provided.

Typographical Conventions

• Bold font is used in text for filenames, and C-language keywords, type names, data structures and their members.

• Italic strings are used for emphasis or to identify the first instance of a word requiring definition. Italics in text also denote:

  • C-language variable names, for example, substitutable argument prototypes

  • C-language functions; these are shown as follows: name().

• Normal font is used for the names of constants and literals.

• The notation <file.h> indicates a header file.

• The notation [EABCD] is used to identify a C-language return code EABCD.
  

• Syntax, code examples and user input in interactive examples are shown in fixed width font.

• Variables within syntax statements are shown in italic fixed width font.

• Language-independent functions and arguments use bold italic font, for example, function() and argument.

Trademarks

Kerberos^TM; is a trademark of the Massachusetts Institute of Technology.

Motif®, OSF/1®, and UNIX® are registered trademarks and the IT DialTone^TM;, The Open Group^TM;, and the "X Device"^TM; are trademarks of The Open Group.

Acknowledgements

The Open Group acknowledges contributions to the development of this specification by many members of The Open Group Security Program Group in providing additional material and reviewing drafts.

Referenced Documents

CESG Memo

CESG Memorandum No.1, Issue 1.2, October 1992, Glossary of Security Terminology.

Federal Criteria

Federal Criteria Version 1.0, December 1992, Federal Criteria for Information Technology Security.

ISO/IEC 10181

ISO/IEC 10181, Information Technology - Open Systems Interconnection - Security Frameworks in Open Systems:

 

10181-1, Part 1: Security Frameworks Overview
10181-2, Part 2: Authentication Framework
10181-3, Part 3: Access Control
10181-4, Part 4: Non-repudiation Framework
10181-5, Part 5: Integrity Framework
10181-6, Part 6: Confidentiality Framework
10181-7, Part 7: Security Audit Framework

ISO/IEC 7498-2

ISO/IEC 7498-2:1989, Information Processing Systems - Open Systems Interconnection - Basic Reference Model - Part 2: Security Architecture.

ITSEC

Information Technology Security Evaluation Criteria, Provisional Harmonised Criteria, June 1991, Version 1.2, published by the Commission of the European Communities.

OSF RFC 86.0

OSF RFC 86.0. October 1995, Unified Login with Pluggable Authentication Modules (PAM).

PAM Manual

Sun Microsystems Inc., PAM Reference Manual Pages.

POSIX.0

IEEE Std 1003.0/D15, June 1992, Draft Standard for Information Technology - Portable Operating System Interface (POSIX) - Part 0.

RFC 1510

Internet Proposed Standard, The Kerberos Network Authentication System, John Kohl, B.Clifford Neuman, Issue 5.2, 21 April 1993.

The following Open Group documents are referenced in this specification:

Base GSS-API

CAE Specification, December 1995, Generic Security Service API (GSS-API) Base (ISBN: 1-85912-131-4, C441).

XDSF

Guide, December 1994, Distributed Security Framework (ISBN: 1-85912-071-7, G410).

The following document is useful background reading:

Lai and Samar

Charlie Lai and Vipin Samar, Making Login Services Independent of Authentication Technologies, 1996.