Chapter 9. Authorization for Enrolling Certificates (Access Evaluators)
This chapter describes the authorization mechanism using access evaluators.
Note
For instructions on how to edit certificate enrollment profiles, see Section 3.2, “Setting up Certificate Profiles”.
9.1. Authorization Mechanism
In addition to the authentication mechanism, each enrollment profile can be configured to have its own authorization mechanism. The authorization mechanism is executed only after a successful authentication.
The authorization mechanism is provided by the Access Evaluator plug-in framework. Access evaluators are pluggable classes that are used for evaluating access control instructions (ACI) entries. The mechanism provides an evaluate method that takes a predefined list of arguments (that is,
type, op, value), evaluates an expression such as group='Certificate Manager Agents' and returns a boolean depending on the result of evaluation.
