Netscape MANAGEMENT SYSTEM 6.01 Installation And Setup Manual page 563

Policy expressions are formed with the following rules:
PrimitiveExpression | AndExpression | OrExpression
PrimitiveExpression
Attribute can be a string
can be any of these operators:
op
Value can be a string
AndExpression
OrExpression
In an expression, the
example, the expression
HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering OR
HTTP_PARAMS.certType==ca
is interpreted as
(HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering) OR
HTTP_PARAMS.certType==ca
Certificate Management System evaluates an expression based on the attributes in
the request. The attributes are filled in by servlets from the HTTP input forms used
for request submission. Some attributes, such as passwords typed in the form are
not stored in the request. Other attributes regarding the end entity, such as the user
ID, are set on the request after successful authentication. The servlets also interpret
the form content, for example, retrieving the key material out of the
information and setting the key in the certificate content. They can also set
#10
additional attributes related to the certificate content on the request. In general, you
can configure which attributes—for example, sensitive attributes such as
passwords—should or shouldn't be stored in the request.
Note that all data related to an end entity is gathered at the servlet level and set on
the request before the request is passed to the policy subsystem. The policy
subsystem applies configured policy rules on the request, determines whether the
request needs agent approval, performs constraint- and extension-specific checks
on the request attributes, and then formulates the certificate content by adding the
appropriate information, such as the validity period and extensions.
The expression queries the request for the attributes, compares the value returned
with the value provided in the predicate, and returns a boolean result.
is equal to: Attribute
==
is equal to: Expression
is equal to: Expression
operator takes precedence over an
AND
Value, where
op
or
!=
Expression
AND
Expression
OR
operator. For
OR
Chapter 18 Setting Up Policies
Introduction to Policy
or
KEYGEN PKCS
563