Chapter 16 Configuring Policies

Netscape Certificate Management System (CMS) provides a customizable policy framework for its main subsystems, the Certificate Manager, Registration Manager, and Data Recovery Manager. This chapter explains how to configure these subsystems to apply organizational and other policies on incoming certificate and key-related requests. The chapter also shows how policy plug-in implementations and rules (configured instances) appear in the configuration file.

• Policy Management
• Managing Policy Rules
• Managing Policy Plug-in Modules

• By making changes to the authentication-specific parameters from the CMS window, explained in "Policy Management from the CMS Window"
• By editing the parameters in the configuration file, explained in "Policy Parameters in the Configuration File"

The CMS window (as shown in Figure 16.1) provides the appropriate user interface to support policy management for each subsystem, the Certificate Manager, Registration Manager, and Data Recovery Manager.

• Configuration of currently registered policy plug-ins
• Registration of new (custom) policy plug-ins

The Policy Rules Management tab displays the current policy configuration for the selected subsystem. The tab lists the currently configured policy instances (or rules) for a subsystem, enabling you to manage them at a single place. From this tab you can add, modify, or delete rules, enable or disable individual rules, and change the order in which the rules get applied to an end-entity request.

Delete. The delete operation allows you to remove unwanted policy rules from the CMS configuration. For instructions on deleting policy rules, see "Deleting a Policy Rule".

Edit/View. The edit operation allows you to view and modify configuration parameter values associated with currently configured policy rules. You modify the parameter values with the help of the policy rule editor (see "Policy Rule Editor"). For instructions on modifying policy rules, see "Modifying a Policy Rule".

Reorder. The reorder operation allows you to change the order of the policy rules a subsystem applies to an end-entity request. Enabled rules are applied in the order in which they appear; disabled rules are ignored. For instructions on reordering policy rules, see "Reordering Policy Rules".

Policy Rule Editor

The policy rule editor is designed to be generic. Its simple graphical interface enables you to create new policy rules and modify the configuration of an individual rule. When you are adding a new rule, the editor shows the configuration parameters pertaining to the plug-in module you selected. When you are modifying a rule, the editor shows the configuration parameters pertaining to the rule you selected.

The Policy Plugin Registration tab lists the currently registered policy plug-in implementations for the selected subsystem and gives you access to the window from which you can register new plug-in modules. On this tab you will find the names of registered plug-in modules listed on the left and the path to the Java class that implements the plug-in module listed on the right.

When you save the changes, Certificate Management System loads the policy plug-in module and displays it in the list of currently registered plug- ins. For instructions on registering new authentication plug-in modules, see "Registering a Policy Plug-in Module".

Policy Plug-in Registration Editor

The policy plug-in registration editor allows you to register new plug-in implementations in a subsystem's policy framework. Registering a new policy plug-in implementation involves specifying the name of the plug-in module and the full name of the Java class that implements the policy interface (implementation must be on the class path).

The sample shown in Figure 16.2 illustrates how policy-specific information appears in the configuration file. Keep the following points in mind:

• All policy-specific information, such as registered policy plug-in implementations, configured rules, and ordering, appear in the Policy section of the configuration file. If you have installed more than one subsystem in a CMS instance, for example Certificate Manager and Data Recovery Manager together, the configuration file will include policy sections that are specific to each of the subsystems that share the configuration.

You can identify policy pertaining to a subsystem by these suffixes:

• Certificate Manager by ca
• Registration Manager by ra
• Data Recovery Manager by kra

• Each registered policy plug-in module is identified by its implementation name.
• Each configured rule of a policy plug-in implementation is identified by the name you specified when creating it.
• You can create multiple rules out of an implementation; each rule must have a unique name. For details, see "Policy Plug-in Implementation and Rule".

Figure 16.2 Policy-specific information for a Registration Manager in the configuration file

Policies are implemented as Java classes, which are then registered with the appropriate subsystem as plug-ins. You can use a given implementation of a policy plug-in module and configure multiple rules (instances) of it. Each rule must have a unique name (an alphanumeric string with no spaces) and can contain different input parameter values to apply to different requests. In other words, a given policy implementation can be shared by multiple configurations. You can also distinguish the applicability of configured instances by including appropriate names.

• Adding a Policy Rule
• Deleting a Policy Rule
• Modifying a Policy Rule
• Reordering Policy Rules

Adding a policy rule to the CMS configuration involves creating a new instance of an already registered policy plug-in module, assigning a unique name (an alphanumeric string with no spaces) for the instance, and entering appropriate values for the parameters that define the plug-in implementation you want to create an instance of.

• The status of the rule, enabled or disabled, depends on the value (true or false) you enter for the enable parameter. A subsystem subjects end-entity requests only to rules that are enabled.
• The server does not automatically reorder rules. Be sure to change the order of the rule, if required. For information on reordering rules, see "Reordering Policy Rules".

To add a new policy rule to the CMS configuration:

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, choose the subsystem to which you want to add the new policy rule.
4. Click Policies.

The Policy Rules Management tab appears. It lists any currently configured policy rules. For information about this tab, see "Policy Rules Management Tab".



5. Click Add.

The Select Policy Plugin Implementation window appears. It lists the currently registered policy plug-in modules.



6. Select a plug-in module.

The choices listed below are the ones provided out of the box with Certificate Management System. If you have registered any custom policy plug-ins, they too will be available for selection.

• AuthorityKeyIdentifierExt

Policy for setting the Authority Key Identifier extension in certificates; see "Authority Key Identifier Extension Policy"

• BasicConstraintsExt
• Policy for setting the Basic Constraints extension in certificates; see "Basic Constraints Extension Policy"CRLDistributionPointsExt

Policy for setting the CRL Distribution Point extension in certificates; see "CRL Distribution Point Extension Policy"

• DefaultRevocation

Policy for restricting certificate revocation; see "Default Revocation Policy"

• DSAKeyConstraints

Policy for restricting DSA key lengths; see "DSA Key Constraints Policy"

• KeyAlgorithmConstraints

Policy for restricting key algorithms; see "Key Algorithm Constraints Policy"

• KeyUsageExt
• Policy for setting the Key Usage extension in certificates; see "Key Usage Extension Policy"NSCertTypeExt
• Policy for setting the Netscape Certificate Type extension in certificates; see "Netscape Certificate Type Extension Policy"RenewalValidityConstraints
• Policy for restricting certificate renewals; see "Renewal Validity Constraints Policy"RSAKeyConstraints
• Policy for restricting RSA key lengths; see "RSA Key Constraints Policy"SubjectAltNameExt

Policy for setting the Subject Alternate Name extension; see "Subject Alternate Name Extension Policy"

• SubjectKeyIdentifierExt

Policy for setting the Subject Key Identifier extension; see "Subject Key Identifier Extension Policy"

• ValidityConstraints

Policy for restricting certificate validity period; see "Validity Constraints Policy"

For the purposes of this instruction, assume that you selected the ValidityConstraints module.

7. Click Next.

The Configure Policy Parameters window appears. It lists the configuration information required for this policy rule. For more information on how this window functions, see "Policy Rule Editor".



8. In the Policy Rule ID field, type a unique name for this rule; be sure to use a name that will help you identify the rule.

For the name, be sure to use an alphanumeric string with no spaces.

9. In the configuration area, specify the required information by filling in parameter values in the text fields in the right column.

If you do not want to set any restrictions on a particular parameter, leave its value field blank.

10. Click OK.

You are returned to the Policy Rules Management tab.

11. If required, click Reorder and order the rules as appropriate following the information provided in "Reordering Policy Rules".

You can delete any unwanted policy rules from the CMS configuration. If you think you might need a rule in the future, instead of deleting it from the configuration you should disable it by setting the enable parameter value to false. In this way, you can avoid re-creating the rule in the future. Because all three subsystems subject end-entity requests only to rules that are currently enabled (see "Policy Processor"), keeping unwanted rules in disabled state in the configuration does not affect policy decisions made by a subsystem.

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, choose the subsystem to which the policy rule you want to delete belongs.
4. Click Policies.

The Policy Rules Management tab appears. It lists the currently configured policy rules. For information about this tab, see "Policy Rules Management Tab".

5. In the Rule Name list, select the rule you want to delete and click Delete.
6. When prompted, confirm the delete action.

The CMS configuration is modified. If the changes you made require you to restart the server, you will be prompted accordingly. In that case, restart the server.

Modifying a policy rule involves changing its configuration parameter values; you cannot change the name of a rule. To change the name of a rule, create a new policy rule using the same policy plug-in module (that you used to create the rule you want to rename) with the same parameter values, and delete the old one.

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, choose the subsystem to which the policy rule you want to modify belongs.
4. Click Policies.

The Policy Rules Management tab appears. It lists the currently configured policy rules. For information about this tab, see "Policy Rules Management Tab".



5. In the Rule Name list, select the rule you want to modify and click Edit.

The Configure Policy Parameters window appears, showing how this rule is currently configured. An example is shown below. For more information on how this window functions, see "Policy Rule Editor".



6. Make the necessary changes by filling in parameter values in the text fields in the right column.

If you do not want to set any restrictions on a particular parameter, leave its value field blank.

7. Click OK.

You are returned to the Policy Rules Management tab.

8. If required, click Reorder and order the rules as appropriate following the information provided in "Reordering Policy Rules".

For maintaining priority levels, Certificate Management System supports a linear list of policy rules in increasing order of priority. This means that for a given policy category in the configuration file, a policy configuration with a lower priority precedes one with a higher priority. This simple linear listing avoids the need to have explicit locking on request attributes to prevent conflicting changes. By ordering the rules, you introduce a concurrency control whereby a higher-priority rule configuration overwrites any changes made by a lower-priority rule configuration that precedes it.

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, choose the subsystem.
4. Click Policies.

The Policy Rules Management tab appears. It lists the currently configured policy rules. For more information about this tab, see "Policy Rules Management Tab".



5. Click Reorder.

The Reorder Policy Rules window appears. It lists the currently registered policy plug-in modules in the order in which they are executed by the subsystem; the server executes the rules on a first-come-first-served basis, overwriting the configuration determined by the previous rule, if any.



6. To change the order of a rule, select it in the list and click the Up or Down button, as appropriate.
7. When you have the correct order, click OK.

You are returned to the Policy Rules Management tab.

8. To view the updated configuration, click Refresh.

• Registering a Policy Plug-in Module
• Deleting a Policy Plug-in Module

You can register custom policy plug-in modules from the CMS window. Before registering a plug-in module, be sure to put the Java class for the plug-in in the classes directory.

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, choose the subsystem that will use the plug-in module you want to register.
4. Click Policies.

The Policy Rules Management tab appears. It lists the currently configured policy rules.

5. Click the Policy Plugin Registration tab.

The Policy Plugin Registration tab appears. It lists the currently registered policy plug-in modules. For information about this tab, see "Policy Plugin Registration Tab".



6. Click Register.

The Register Policy Plugin Implementation window appears. For information on how this window works, see "Policy Plug-in Registration Editor".



7. Specify information as appropriate:

Plugin name. Type the name of the plug-in.

Class name. Type the full name of the class for this plug-in--that is, the path to the implementing Java class. If this class is part of a package, be sure to include the package name. For example, if you are registering a class named myPolicy and if this class is in a package named com.myCompany, type com.myCompany.myPolicy.

8. Click OK.

You are returned to the Policy Plugin Registration tab.

9. To view the updated configuration, click Refresh.

You can delete unwanted policy plug-in modules using the CMS window. Before deleting a plug-in module, be sure to delete all the policy rules that are based on this plug-in module; see "Deleting a Policy Rule".

1. Access the CMS window (see "Accessing the CMS Window").
2. Click the Configuration tab.
3. In the navigation tree, choose the subsystem that registers the plug-in module you want to delete.
4. Click Policies.

The Policy Rules Management tab appears. It lists the currently configured policy rules.

5. Click the Policy Plugin Registration tab.

The Policy Plugin Registration tab appears. It lists the currently registered policy plug-in modules. For information about this tab, see "Policy Plugin Registration Tab".

6. In the Plugin Name list, select the plug-in you want to delete and click Delete.
7. When prompted, confirm the delete action.