Netscape Certificate Management System 6.01, Manual

Page: 87 / 377

AttributePresentConstraints Plug-in Module
Chapter 3 Constraints Policy Plug-in Modules 87
If you enable the policy and configure it correctly, it first searches for the user
under the base specified in the l
dap.ldapconn.basedn
parameter with the filter
(
uid=HTTP_PARAMS.UID
) for the user’s entry.
• If the
value
parameter is empty, the policy checks the
attribute
parameter:
❍
If the attribute named in the
attribute
parameter is present in the
request, the policy accepts the request.
❍
If the attribute named in the
attribute
parameter is not present in the
request, the policy rejects the request.
• If the
value
parameter is not empty, the policy checks its value with the value
of the attribute specified in the
attribute
parameter.
❍
If the attribute named in the
attribute
parameter has the specified value,
the policy accepts the request.
❍
If the attribute named in the
attribute
parameter does not have the
specified value, the policy rejects the request.
In the case of multi-valued attributes, the request will be accepted if any of the
values matches the specified value; comparisons are case sensitive.
Unlike some of the other policy modules, Certificate Management System does not
create an instance of the attribute present constraints policy during installation. If
you want to create an instance of the
AttributePresentConstraints
module, see
section “Step 4. Add New Policy Rules” in Chapter 18, “Setting Up Policies” of
CMS Installation and Setup Guide.
Configuration Parameters of
AttributePresentConstraints
In the CMS configuration file, the
AttributePresentConstraints
module is
identified as
<subsystem>.Policy.impl.AttributePresentConstraints.
class=com.netscape.cms.policy.AttributePresentConstraints
, where
<subsystem>
is
ca
or
ra
(prefix identifying the subsystem).
In the CMS window, the module is identified as
AttributePresentConstraints
.
Figure 3-2 shows how configurable parameters for the module are displayed in the
CMS window.