AttributePresentConstraints Plug-in ModuleChapter 3 Constraints Policy Plug-in Modules 87If you enable the policy and configure it correctly, it first searches for the userunder the base specified in the ldap.ldapconn.basedn parameter with the filter(uid=HTTP_PARAMS.UID) for the user’s entry.• If the value parameter is empty, the policy checks the attribute parameter:m If the attribute named in the attribute parameter is present in therequest, the policy accepts the request.m If the attribute named in the attribute parameter is not present in therequest, the policy rejects the request.• If the value parameter is not empty, the policy checks its value with the valueof the attribute specified in the attribute parameter.m If the attribute named in the attribute parameter has the specified value,the policy accepts the request.m If the attribute named in the attribute parameter does not have thespecified value, the policy rejects the request.In the case of multi-valued attributes, the request will be accepted if any of thevalues matches the specified value; comparisons are case sensitive.Unlike some of the other policy modules, Certificate Management System does notcreate an instance of the attribute present constraints policy during installation. Ifyou want to create an instance of the AttributePresentConstraints module, seesection “Step 4. Add New Policy Rules” in Chapter 18, “Setting Up Policies” ofCMS Installation and Setup Guide.Configuration Parameters ofAttributePresentConstraintsIn the CMS configuration file, the AttributePresentConstraints module isidentified as .Policy.impl.AttributePresentConstraints.class=com.netscape.cms.policy.AttributePresentConstraints, where is ca or ra (prefix identifying the subsystem).In the CMS window, the module is identified as AttributePresentConstraints.Figure 3-2 shows how configurable parameters for the module are displayed in theCMS window.
