Netscape MANAGEMENT SYSTEM 6.1 - ADMINISTRATOR Administrator's Manual page 486

Introduction to Policy
Policy expressions are formed with the following rules:
PrimitiveExpression | AndExpression | OrExpression
In an expression, the
example, the expression
HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering OR
HTTP_PARAMS.certType==ca
is interpreted as
(HTTP_PARAMS.certType==client AND HTTP_PARAMS.ou==Engineering) OR
HTTP_PARAMS.certType==ca
CMS evaluates an expression based on the attributes in the request. The attributes
are filled in by servlets from the HTTP input forms used for request submission.
Some attributes, such as passwords typed in the form are not stored in the request.
Other attributes regarding the end entity, such as the user ID, are set on the request
after successful authentication. The servlets also interpret the form content, for
example, retrieving the key material out of the
and setting the key in the certificate content. They can also set additional attributes
related to the certificate content on the request. In general, you can configure which
attributes—for example, sensitive attributes such as passwords—should or
shouldn't be stored in the request.
Note that all data related to an end entity is gathered at the servlet level and set on
the request before the request is passed to the policy subsystem. The policy
subsystem applies configured policy rules on the request, determines whether the
request needs agent approval, performs constraint- and extension-specific checks
on the request attributes, and then formulates the certificate content by adding the
appropriate information, such as the validity period and extensions.
The expression queries the request for the attributes, compares the value returned
with the value provided in the predicate, and returns a boolean result.
486 Netscape Certificate Management System Administrator's Guide • February 2003
PrimitiveExpression
Attribute can be a string
can be any of these operators:
op
Value can be a string
is equal to: Expression
AndExpression
is equal to: Expression
OrExpression
operator takes precedence over an
AND
is equal to: Attribute
or
== !=
AND
Expression
OR
KEYGEN
Value, where
op
Expression
operator. For
OR
or information
PKCS #10