Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 484 / 874

Introduction to Policy
484 Netscape Certificate Management System Administrator’s Guide • June 2003
Policy expressions are formed with the following rules:
PrimitiveExpression | AndExpression | OrExpression
❍
PrimitiveExpression
is equal to: Attribute
op
Value, where
Attribute can be a string
op
can be any of these operators:
==
or
!=
Value can be a string
❍
AndExpression
is equal to: Expression
AND
Expression
❍
OrExpression
is equal to: Expression
OR
Expression
In an expression, the
AND
operator takes precedence over an
OR
operator. For
example, the expression
HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering OR
HTTP_PARAMS.certType==ca
is interpreted as
(HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering) OR
HTTP_PARAMS.certType==ca
CMS evaluates an expression based on the attributes in the request. The attributes
are filled in by servlets from the HTTP input forms used for request submission.
Some attributes, such as passwords typed in the form are not stored in the request.
Other attributes regarding the end entity, such as the user ID, are set on the request
after successful authentication. The servlets also interpret the form content, for
example, retrieving the key material out of the
KEYGEN
or
PKCS #10
information
and setting the key in the certificate content. They can also set additional attributes
related to the certificate content on the request. In general, you can configure which
attributes—for example, sensitive attributes such as passwords—should or
shouldn’t be stored in the request.
Note that all data related to an end entity is gathered at the servlet level and set on
the request before the request is passed to the policy subsystem. The policy
subsystem applies configured policy rules on the request, determines whether the
request needs agent approval, performs constraint- and extension-specific checks
on the request attributes, and then formulates the certificate content by adding the
appropriate information, such as the validity period and extensions.
The expression queries the request for the attributes, compares the value returned
with the value provided in the predicate, and returns a boolean result.