Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Руководство администратора

Страница: 473 / 840

Configuring Policy Rules for a Subsystem
Chapter 12 Policies 473
• The status of the rule, enabled or disabled, depends on whether you check or deselect
the
enable
parameter. A subsystem subjects certificate requests only to rules that are
enabled.
• The server does not automatically reorder rules. Be sure to change the order of the rule,
if required.
To add a new policy rule to the CS configuration:
1.
In the Policy Rules Management tab, click Add.
The Select Policy Plugin Implementation window appears. It lists registered policy
plug-in modules. If you have registered any custom policy modules (see “Registering a
Policy Module” on page 541), they too will be listed here.
2.
Select a plug-in module.
3.
Click Next.
The Policy Rule Editor window appears, listing the configuration information.
4.
Enter the appropriate information.
5.
Click OK.
You are returned to the Policy Rules Management tab.
6.
Repeat steps 1 through 5 and create additional rules, if required.
Reordering Policy Rules
For maintaining priority levels, CS supports a linear list of policy rules in increasing order
of priority. This means that for a given policy category in the configuration file, a policy
configuration with a lower priority precedes one with a higher priority. This simple linear
listing avoids the need to have explicit locking on request attributes to prevent conflicting
changes. By ordering the rules, you introduce a concurrency control whereby a
higher-priority rule configuration overwrites any changes made by a lower-priority rule
configuration that precedes it.
You may want to specify policies at different priority levels for the same operation
depending on the end-entity information. For example, authentication policies, if any, need
to precede others in the list.
To reorder policy rules in the CS configuration: