Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 488 / 874

Introduction to Policy
488 Netscape Certificate Management System Administrator’s Guide • June 2003
Assuming that the new attribute you define for the organizational unit is
orgunit
,
the line you would add to the enrollment form would be:
<input type="HIDDEN" name="orgunit" value="Sales">
To add this line to an enrollment form, you would:
1.
Open the corresponding HTML file in a text editor.
2.
Locate the section that lists the HTTP input variables.
3.
Add this line:
<input type="HIDDEN" name="orgunit" value="Sales">
4.
Save your changes and close the file.
For the server to use the attribute (to distinguish enrollment requests from users in
the Sales unit versus those in the Manufacturing unit) to issue certificates with the
appropriate validity periods, you must formulate your predicate expression with
the attribute you added. Here’s how you do this:
1.
Create a new instance of the
ValidityConstraints
policy plug-in
implementation.
2.
Enter the appropriate values for all the attributes.
Assume you named the instance
ValidityRule1
, set the minimum validity
period to 10 days, set the maximum validity period to 180 days, defined the
predicate expression as
HTTP_PARAMS.certType==client AND
HTTP_PARAMS.orgunit==Sales
. (This expression specifies that the policy be
applied to only client certificate requests from users in the organizational unit
named Sales.)
A sample of the resulting configuration entries in the CMS configuration file
would be as follows:
ca.Policy.rule.ValidityRule1.enable=true
ca.Policy.rule.ValidityRule1.implName=ValidityConstraints
ca.Policy.rule.ValidityRule1.maxValidity=180
ca.Policy.rule.ValidityRule1.minValidity=10
ca.Policy.rule.ValidityRule1.predicate=HTTP_PARAMS.certType==
client AND HTTP_PARAMS.orgunit==Sales
Now, for setting the validity period in certificates of users who are not in the
Sales organization—in this case, this would be Manufacturing—you would
create another instance of
ValidityConstraints
policy rule as before with a
different set of values.