[pca] RFE: pca-proxy.cgi without stored credentials

[Martin Paul]

Hi,

> As we are a bunch of Sun contractors with individual Sun accounts, i
> would like to refrain from storing anyone's personal credentials in
> pca-proxy.conf. Would it be possible to have pca-proxy.cgi work with
> dynamically provided credentials (from the requesting pca via -a)?

Agreed, that would be nice to have. Unfortunately it's not easy to 
implement. There are two problems:

Currently --askauth/-a is implemented in a way that it only asks for the 
credentials when it's necessary - which means right before contacting 
sunsolve. The client has no way to know whether the proxy has 
credentials or not. Some extra option would be needed to make the client 
ask for credentials before contacting the proxy.

The other problem is how to deliver the credentials to the proxy. Right 
now, the only bit of information flowing from the client to the proxy is 
the file it requests. To include user/passwd, modifications are 
necessary; simply including the credentials in the URL would reveal them 
in the web servers logfile.

I'll put in on the ToDo list, but unless I can think of a simple and 
elegant solution to the described problems, chances are low that I will 
start to work on it ..

Martin.