Policy Processor - Netscape MANAGEMENT SYSTEM 6.01 Installation And Setup Manual

Introduction to Policy
Now, for setting the validity period in certificates of users who are not in the
Sales organization—in this case, this would be Manufacturing—you would
create another instance of
different set values.
Assume you named the instance
period to 60 days, set the minimum validity period to 10 days, defined the
predicate expression as
HTTP_PARAMS.orgunit!=Sales
applied to only client certificate requests from users who are not in the
organizational unit named Sales.)
A sample of the resulting configuration entries in the CMS configuration file
would be as follows:
ca.Policy.rule.ValidityRule2.enable=true
ca.Policy.rule.ValidityRule2.implName=ValidityConstraints
ca.Policy.rule.ValidityRule2.maxValidity=60
ca.Policy.rule.ValidityRule2.minValidity=10
ca.Policy.rule.ValidityRule2.predicate=HTTP_PARAMS.certType==
The new configuration would result in certificates with a validity period of six
months for users in the Sales organizational unit and a validity period of three
months for users in the Manufacturing unit.

Policy Processor

Each subsystem—the Certificate Manager, Registration Manager, or Data Recovery
Manager—has its own policy processor. Each processor subjects an incoming
request to the applicable policy rules for that subsystem.
When a subsystem starts up, its policy processor reads the current policy
configurations from the configuration file, initializes them, and classifies them
based on their type (see "Types of Policy Rules" on page 561). Then, when the
subsystem receives an authenticated request, its request processor invokes the
policy processor to apply policies on that request. The policy processor applies the
rules on the request based on the request type. The policy processor also filters the
rules based on predicates (see "Using Predicates in Policy Rules" on page 562).
568 Netscape Certificate Management System Installation and Setup Guide • May 2002
HTTP_PARAMS.certType==client AND
client AND HTTP_PARAMS.orgunit!=Sales
ValidityConstraints
ValidityRule1
. (This expression specifies that the policy be
policy rule as before with a
, set the maximum validity