The DACS directory to use instead of the default is directory.

Set the debugging output level to log_level (see dacs(1)). The default level is warn.

The -v flag bumps the debugging output level to debug or (if repeated) trace.

Display the program's version information and then exit.

Try to authenticate as username by invoking dacs_authenticate at the URL auth-URL. username has the syntax [[federation]::]jurisdiction:username (the jurisdiction component of the name must be provided; see dacs(1)). An SSL/TLS connection is always used for this purpose.

If authentication is successful and the -s flag is not given, the (username, auth-URL) pair will be recorded; subsequent invocations of the command can omit the auth-URL argument if it is unchanged. If the -p flag is given, the user is prompted for a password to pass to dacs_authenticate; if -pf is given instead, a password is read from file (stdin is read if file is "-"). If aux is given, it is used as the value of the AUXILIARY argument to dacs_authenticate. The -caf (-ccf) flag identifies file as a file of CA certificates (client certificates) in PEM format, respectively; see sslclient(1).

New credentials replace old credentials in the cache. Credentials and authentication mappings in the cache are not automatically managed, so the cache may contain credentials that have expired.

The following example prompts the user for a password before trying to authenticate as DSS:smith:

% dacscred auth -p DSS:smith \
    https://dss.example.com/cgi-bin/dacs/dacs_authenticate

The following example might be used within a script to test if $passwd is the correct password for DSS:smith:

% echo $passwd | dacscred auth -s -pf - DSS:smith \
    https://dss.example.com/cgi-bin/dacs/dacs_authenticate

The exit status will be 0 only if the password is correct.

Delete all credentials with a name that matches a regular expression (see regex(3)).

Print all credentials to stdout that should be sent along with a service request to the given URL. If no URL is given, print all credentials in the cache. Note that these credentials represent DACS identities and should be kept secret.

List the names of all credentials in the cache, by default. This is equivalent to providing the cred argument. If the auth argument is given, a list of identities and the auth-URL arguments that were used to authenticate those identities is displayed. If a regex is given, the list is limited to those identities matched by it (cred behaviour) or those "username auth-URL" strings that match it (auth behaviour).

Change the password that protects the cache. The current password must first be provided.