Netscape NETSCAPE MANAGEMENT SYSTEM 4.5, Installation And Setup Manual

Page: 588 / 866

Introduction to Policy
588 Netscape Certificate Management System Installation and Setup Guide • October 2001
Now, for setting the validity period in certificates of users who are not in the Sales
organization—in this case, this would be Manufacturing—you would create
another instance of
ValidityConstraints
policy rule as before with a different set
values.
Assume you
❍
named the instance
ValidityRule1
❍
set the maximum validity period to 60 days
❍
set the minimum validity period to 10 days
❍
defined the predicate expression as
HTTP_PARAMS.certType==client AND
HTTP_PARAMS.orgunit!=Sales
(This expression specifies that the policy be applied to only client
certificate requests from users who are not in the organizational unit
named Sales.)
A sample of the resulting configuration entries in the CMS configuration file
would be as follows:
ca.Policy.rule.ValidityRule2.enable=true
ca.Policy.rule.ValidityRule2.implName=ValidityConstraints
ca.Policy.rule.ValidityRule2.maxValidity=60
ca.Policy.rule.ValidityRule2.minValidity=10
ca.Policy.rule.ValidityRule2.predicate=HTTP_PARAMS.certType==
client AND HTTP_PARAMS.orgunit!=Sales
The new configuration would result in certificates with a validity period of six
months for users in the Sales organizational unit and a validity period of three
months for users in the Manufacturing unit.
Policy Processor
Each subsystem—the Certificate Manager, Registration Manager, or Data Recovery
Manager—has its own policy processor. Each processor subjects an incoming
request to the applicable policy rules for that subsystem.
When a subsystem starts up, its policy processor reads the current policy
configurations from the configuration file, initializes them, and classifies them
based on their type (see “Types of Policy Rules” on page 581). Then, when the
subsystem receives an authenticated request, its request processor invokes the
policy processor to apply policies on that request. The policy processor applies the
rules on the request based on the request type. The policy processor also filters the
rules based on predicates (see “Using Predicates in Policy Rules” on page 582).