Netscape NETSCAPE MANAGEMENT SYSTEM 4.5, Installation And Setup Manual

Page: 584 / 866

Introduction to Policy
584 Netscape Certificate Management System Installation and Setup Guide • October 2001
Be aware that if the same name is in a HTTP form input and authentication token
(authentication result) the authentication result can override the HTTP form input.
For example, if
email
is in a HTTP input and an authentication module also puts
email
in the authentication result (that is, authtoken) the
email
value from the
authentication module will override the
email
value from the HTTP input in the
request. A predicate using
email
in an expression will be evaluated to the value of
the authentication instead of the HTTP input value.
The following are sample predicates:
HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering
HTTP_PARAMS.certType==server AND HTTP_PARAMS.o==Netscape OR
HTTP_PARAMS.certType==ca
Attributes for Predicates
Attributes for predicates can come from any of the following:
• Input form—that is, the HTML form that end entities use for submitting
certificate requests.
• Authentication token—what the authentication subsystem returns after
successfully authenticating an end entity.
• A service—for example, a Certificate Manager, Registration Manager, or Data
Recovery Manager service can add certain attributes to the end-entity request.
• Policy processor—what the policy subsystem returns after subjecting the
end-entity request to policy checking. For example, an extension-based policy
can set an appropriate extension in the certificate.
Table 18-2 lists default attributes that are supported by various request object
implementations.
Table 18-2 Attributes supported by request object implementations
Request type Variable name Description
Default attributes from an input form:
Enrollment
requestFormat
Specifies the certificate request format. Default values
include the following:
• keygen
• pkcs10
• clientAuth