Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 482 / 874

Introduction to Policy
482 Netscape Certificate Management System Administrator’s Guide • June 2003
• Revocation policies
• Key-archival policies
• Key-recovery policies
To facilitate this classification, CMS supports a parent interface for a generic policy
rule and other operation-specific interfaces that extend the parent interface. Check
the CMS SDK.
Policy Processor
Each subsystem—the Certificate Manager, Registration Manager, or Data Recovery
Manager—has its own policy processor. Each processor subjects an incoming
request to the applicable policy rules for that subsystem.
When a subsystem starts up, its policy processor reads the current policy
configurations from the configuration file, initializes them, and classifies them
based on their type (see “Types of Policy Rules” on page 481). Then, when the
subsystem receives an authenticated request, its request processor invokes the
policy processor to apply policies on that request. The policy processor applies the
rules on the request based on the request type. The policy processor also filters the
rules based on predicates (see “Using Predicates in Policy Rules” on page 483).
Note that the policy processor applies only the enabled policy rules, in the order in
which they are configured, before determining the final outcome. Each rule the
processor executes returns a
PolicyResult
object. Three return values are
possible:
•
PolicyResult.REJECTED
(indicates that the request failed the rule)
•
PolicyResult.DEFERRED
(indicates that the request requires agent approval)
•
PolicyResult.ACCEPTED
(indicates that the request passed the rule)
After all the policy rules are applied, the processor determines the status of the
request (in this order):
1.
If the request failed any policy rule (that is, if any of the policy rules returned a
PolicyResult.REJECTED
value), the processor rejects the request. The rule
that rejected the request sets appropriate error messages on the request.
2.
If at least one of the policy rules requires agent approval for the request (that is,
if any of the policy rules returned a
PolicyResult.DEFERRED
value), the
processor stores the request in the request queue for agent approval.