Netscape NETSCAPE MANAGEMENT SYSTEM 4.5, Инструкция по установке и настройке

Страница: 583 / 866

Introduction to Policy
Chapter 18 Setting Up Policies 583
Policy expressions are formed with the following rules:
PrimitiveExpression | AndExpression | OrExpression
❍
PrimitiveExpression
is equal to: Attribute
op
Value, where
Attribute can be a string
op
can be any of these operators:
==
or
!=
Value can be a string
❍
AndExpression
is equal to: Expression
AND
Expression
❍
OrExpression
is equal to: Expression
OR
Expression
In an expression, the
AND
operator takes precedence over an
OR
operator. For
example, the expression
HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering OR
HTTP_PARAMS.certType==ca
is interpreted as
(HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering) OR
HTTP_PARAMS.certType==ca
Certificate Management System evaluates an expression based on the attributes in
the request. The attributes are filled in by servlets from the HTTP input forms used
for request submission. Some attributes, such as passwords typed in the form are
not stored in the request. Other attributes regarding the end entity, such as the user
ID, are set on the request after successful authentication. The servlets also interpret
the form content, for example, retrieving the key material out of the
KEYGEN
or
PKCS
#10
information and setting the key in the certificate content. They can also set
additional attributes related to the certificate content on the request. In general, you
can configure which attributes—for example, sensitive attributes such as
passwords—should or shouldn’t be stored in the request.
Note that all data related to an end entity is gathered at the servlet level and set on
the request before the request is passed to the policy subsystem. The policy
subsystem applies configured policy rules on the request, determines whether the
request needs agent approval, performs constraint- and extension-specific checks
on the request attributes, and then formulates the certificate content by adding the
appropriate information, such as the validity period and extensions.
The expression queries the request for the attributes, compares the value returned
with the value provided in the predicate, and returns a boolean result.