Document the DynamicLookupCommand option.

[libradsec.git] / radsecproxy.conf.5.xml

diff --git a/radsecproxy.conf.5.xml b/radsecproxy.conf.5.xml
index cc94224..2b6367c 100644 (file)
--- a/radsecproxy.conf.5.xml
+++ b/radsecproxy.conf.5.xml
@@ -2,14 +2,14 @@
 "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd">
 <refentry>
   <refentryinfo>
-    <date>2011-10-08</date>
+    <date>2012-04-11</date>
   </refentryinfo>
   <refmeta>
     <refentrytitle>
       <application>radsecproxy.conf</application>
     </refentrytitle>
     <manvolnum>5</manvolnum>
-    <refmiscinfo>radsecproxy 1.5</refmiscinfo>
+    <refmiscinfo>radsecproxy 1.6-dev</refmiscinfo>
   </refmeta>
   <refnamediv>
     <refname>
@@ -126,6 +126,17 @@ blocktype name {
     </para>
     <variablelist>
       <varlistentry>
+        <term><literal>PidFile</literal></term>
+        <listitem>
+         <para>
+            The PidFile option specifies the name of a file to which
+            the process id (PID) will be written.  This is overridden
+            by the <option>-i</option> command line option.  There is
+            no default value for the PidFile option.
+         </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
         <term><literal>LogLevel</literal></term>
         <listitem>
          <para>
@@ -246,15 +257,17 @@ blocktype name {
         <term><literal>FTicksSyslogFacility</literal></term>
         <listitem>
          <para>
-           The FTicksSyslogFacility option is used to specify 
-           a dedicated syslog facility for F-Ticks messages.
-           This allows easy filtering of F-Ticks messages.
-           By default, if FTicksSyslogFacility is not given,
-           F-Ticks messages are written to the LogDestination. 
+           The FTicksSyslogFacility option is used to specify a
+           dedicated syslog facility for F-Ticks messages.  This
+           allows for easier filtering of F-Ticks messages.  If no
+           FTicksSyslogFacility option is given, F-Ticks messages are
+           written to what the LogDestination option specifies.
          </para>
          <para>
-           Note that FTicksSyslogFacility value specifying a file 
-           (via file:/// prefix) is ignored.
+           F-Ticks messages are always logged using the log level
+           LOG_DEBUG.  Note that specifying a file in
+           FTicksSyslogFacility (using the file:/// prefix) is
+           not supported.
          </para>
        </listitem>
       </varlistentry>
@@ -478,9 +491,9 @@ blocktype name {
       <literal>certificateNameCheck</literal>,
       <literal>matchCertificateAttribute</literal>,
       <literal>duplicateInterval</literal>, <literal>AddTTL</literal>,
-      <literal>fticksVISCOUNTRY</literal>, <literal>rewrite</literal>,
-      <literal>rewriteIn</literal>, <literal>rewriteOut</literal>, and
-      <literal>rewriteAttribute</literal>.
+      <literal>fticksVISCOUNTRY</literal>, <literal>fticksVISINST</literal>,
+      <literal>rewrite</literal>, <literal>rewriteIn</literal>, 
+      <literal>rewriteOut</literal>, and <literal>rewriteAttribute</literal>.
 
       We already discussed the <literal>host</literal> option. The
       value of <literal>type</literal> must be one of
@@ -542,6 +555,11 @@ blocktype name {
       <literal>FTicksReporting</literal> basic option.
     </para>
     <para>
+      The <literal>fticksVISINST</literal> option overwrites
+      the default <literal>VISINST</literal> value taken from the client
+      block name.
+    </para>
+    <para>
       The <literal>rewrite</literal> option is deprecated. Use
       <literal>rewriteIn</literal> instead.
     </para>
@@ -626,8 +644,8 @@ blocktype name {
       <literal>AddTTL</literal>, <literal>rewrite</literal>,
       <literal>rewriteIn</literal>, <literal>rewriteOut</literal>,
       <literal>statusServer</literal>, <literal>retryCount</literal>,
-      <literal>retryInterval</literal>,
       <literal>dynamicLookupCommand</literal> and
+      <literal>retryInterval</literal> and
       <literal>LoopPrevention</literal>.
     </para>
     <para>
@@ -664,8 +682,17 @@ blocktype name {
     <para>
       The option <literal>dynamicLookupCommand</literal> can be used
       to specify a command that should be executed to dynamically
-      configure and use a server.  The use of this feature will be
-      documented separately/later.
+      configure a server.  The executable file should be given with
+      full path and will be invoked with the name of the realm as its
+      first and only argument.  It should either print a valid
+      <literal>server</literal> option on stdout and exit with a code
+      of 0 or print nothing and exit with a non-zero exit code.  An
+      example of a shell script resolving the DNS NAPTR records for
+      the realm and then the SRV records for each NAPTR matching
+      'x-eduroam:radius.tls' is provided in
+      <literal>tools/naptr-eduroam.sh</literal>.  This option was
+      added in radsecproxy-1.3 but tends to crash radsecproxy versions
+      earlier than 1.6.
     </para>
     <para>
       Using the <literal>LoopPrevention</literal> option here