DACS DACS - The Distributed Access Control System

DACS: The Distributed Access Control System

DACS is a light-weight single sign-on and role-based access control system for web servers and server-based software. It is also an authentication and authorization toolkit for programmers. DACS makes secure resource sharing and remote access via the web easier, safer, and more efficient.

DACS is particularly well suited to providing single sign-on across organizational or departmental web servers, and to limiting access to their web-based resources.

Released under an open source license, DACS gives you:

Get information: Get DACS: Get started: Get help:
Executive Overview; What is DACS?; About DACS; Features; Versions; FAQ; Documentation for the latest release Download DACS Tutorial; Tips and Examples Technical Support

DACS = Authentication + Authorization

DACS works with virtually any authentication method and unifies an assortment of accounts into a single identity. You can leverage the user accounts and authentication methods that you already use, or introduce new ones easily. Out of the box, DACS lets users authenticate using: DACS username/password, X.509 client certificate, self-issued or managed Information Card, one-time password, Unix account, Apache password files, Windows NTLM, ADS/LDAP, CAS, HTTP, PAM, Basic or Digest Auth, special URLs, two-factor authentication, expressions, and more.

DACS extends the security capabilities of your Apache server for controlling access to your web resources, whether you have just one web server, several real or virtual web servers at one site, or many web servers spread across the Internet. It does not matter what the web resources are: web pages, files, or applications. DACS ensures that only authorized requests are carried out by a web server.

For applications, it does not matter what they do, who wrote them, or what language they are written in - DACS is invisible to them and they do not need to be modified in any way. Audit trails help you to track accesses to your web site. By operating in a proxying mode, an Apache web server can supply single sign-on and access control functionality for other web servers, Apache or non-Apache.

Apart from single sign-on and other federated capabilities, DACS can be used to quickly solve a variety of common problems, freeing you to focus on other things. You can easily create your own short links, permalinks, and smart links using DACS. Its Rlink feature lets administrators create special access controlled links that can simplify DACS administration and foster sharing and collaboration.

Our priority is for DACS to remain a secure, stable, and well-documented system.

Light-weight single sign-on

Once a user has signed on through DACS, he will be recognized throughout a federation of web servers.

While it shares many of the advantages of other single sign-on systems, DACS offers some unique features and is more efficient, and simpler to understand, customize, and administer compared to the heavy-weight, enterprise-level alternatives. If your single sign-on needs are modest, or if you are not even certain what they are, you should look at DACS. DACS does the hardest parts for you - all that you need to do is configuration and "look & feel" customizations.

Authentication and Authorization Toolkit

Why reinvent the wheel? Creating security software demands specialized expertise. It is challenging to develop and keep current. Besides offering a complete single sign-on solution, DACS includes a toolbox of components from which other single sign-on systems and web site features can be built. It supplies authorization checking capabilities and user authentication functionality that developers need to get their applications working quickly, whether web-based or not. Many kinds of server-based applications can benefit from DACS tools. Its rule processing engine can be employed in a wide variety of applications, not only to provide fine-grained authorization testing. Configuration is flexible and programmable.

  For script and application developers:   For middleware and web services developers:
  Authorization testing can be performed from the command line, allowing scripts (Perl, PHP, shell, etc.) to make data-driven access control decisions rather than code-driven ones. Authentication functionality is also available from the command line; programs can easily reuse existing user accounts, authentication methods, and user management tools.   Authentication and authorization testing can be done through simple, REST-based web service calls, the DACS Java library, or a C/C++ API.


While no incidents have been reported, DACS releases use versions of OpenSSL that may be affected by the recently announced TLS heartbeat read overrun bug. DACS installations should recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS, as instructed in the advisory, or upgrade to OpenSSL 1.0.1g.

Also see this.

DACS 1.4.30 is currently in beta test. It will use OpenSSL 1.0.1g, or newer.

DSS is pleased to announce the availability of DACS 1.4.29. Download links, errata, and additional information are here. Please be sure to review the Post-Release Notes before building DACS. Thanks to those who reported problems with the previous release; all problems that could be reproduced have been addressed in this release.

Several GNU/Linux-based distributions, such as Debian and Ubuntu, include DACS as a package. Although DSS helps to facilitate those packages, we do not prepare, maintain, or test them for those specific platforms. The Debian project uses DACS for its single sign-on system for web services.

Apache 2.0 is no longer officially supported by DACS, as that branch of Apache is now designated as a legacy version.

Information about older releases is available here.

Site Search

You can use Google to search this site, including the FAQ and technical documentation.

This page last modified 16-Apr-14 16:57 PDT
© Copyright 2001-2014 DSS Distributed Systems Software Inc. All rights reserved.
Richmond, British Columbia, Canada