Netscape MANAGEMENT SYSTEM 6.1 - ADMINISTRATOR Administrator's Manual page 490

Introduction to Policy
Assuming that the new attribute you define for the organizational unit is
the line you would add to the enrollment form would be:
<input type="HIDDEN" name="orgunit" value="Sales">
To add this line to an enrollment form, you would:
Open the corresponding HTML file in a text editor.
1.
Locate the section that lists the HTTP input variables.
2.
Add this line:
3.
Save your changes and close the file.
4.
For the server to use the attribute (to distinguish enrollment requests from users in
the Sales unit versus those in the Manufacturing unit) to issue certificates with the
appropriate validity periods, you must formulate your predicate expression with
the attribute you added. Here's how you do this:
Create a new instance of the
1.
implementation.
Enter the appropriate values for all the attributes.
2.
Assume you named the instance
period to 10 days, set the maximum validity period to 180 days, defined the
predicate expression as
HTTP_PARAMS.orgunit==Sales
applied to only client certificate requests from users in the organizational unit
named Sales.)
A sample of the resulting configuration entries in the CMS configuration file
would be as follows:
ca.Policy.rule.ValidityRule1.enable=true
ca.Policy.rule.ValidityRule1.implName=ValidityConstraints
ca.Policy.rule.ValidityRule1.maxValidity=180
ca.Policy.rule.ValidityRule1.minValidity=10
ca.Policy.rule.ValidityRule1.predicate=HTTP_PARAMS.certType==
Now, for setting the validity period in certificates of users who are not in the
Sales organization—in this case, this would be Manufacturing—you would
create another instance of
different set of values.
490 Netscape Certificate Management System Administrator's Guide • February 2003
<input type="HIDDEN" name="orgunit" value="Sales">
HTTP_PARAMS.certType==client AND
client AND HTTP_PARAMS.orgunit==Sales
ValidityConstraints
ValidityRule1
. (This expression specifies that the policy be
ValidityConstraints
orgunit
policy plug-in
, set the minimum validity
policy rule as before with a
,