This section contains the following topics:
- Registering Policy Configuration Services
- Creating Policies
- Modifying Policies
- Creating Policies for Peer and Suborganizations
Registering Policy Configuration Services
Registering a policy configuration service is the same as registering any type of service; it is done within the Identity Management interface. By default, the Policy Configuration service is automatically registered to the top-level organization. Any policy service you create must be registered to all organizations. To register a policy configuration service:
- Navigate to the Identity Management interface.
When the console opens, the default interface is Identity Management.
- Choose the organization for which you would like to create policy.
If logged in as the Top Level Administrator, make sure that the location of the User Management interface is the top level organization where all configured organizations are visible. The default top level organization is defined during installation.
- Choose Services from the View menu.
If the organization already has registered services, they will be displayed in the navigation pane.
- Click Register in the navigation pane.
A listing of services not yet registered to this organization is displayed in the data pane.
- From the Register Services window, opened in the Data pane, choose Policy Configuration and click register.
The Policy Configuration Service is added to the list of services in the Navigation pane.
- Configure the policy service by clicking the Properties arrow. If the policy template has not yet been configured, you will need to create a service template for the newly registered policy service.
To configure the policy service, click Create. Modify the Policy Configuration attributes. See Policy Configuration Attributes for a description of these attributes. Click Save.
The policy configuration service is now registered to the chosen organization.
Creating Policies
Policies are created through the Identity Management interface. To create a policy:
- Navigate to the Identity Management interface.
- Choose the organization for which you would like to create a policy.
Ensure that the location of the Policy Management window is correct for your organization.
- Choose Policies from the View menu.
By default, Organizations is visible in the View menu. All sub-organizations configured, if any, will be visible below it. If creating policies for a sub-organization, choose the sub-organization and then choose Policies from the View menu.
- Click New in the navigation pane. The New Policy window opens.
- Select the type of policy, normal or referral, that you wish to create.
If a referral policy that refers to a suborganization does not exist, you will not be able to create any polices for suborganizations. For more information, see Creating Policies for Peer and Suborganizations.
It is not necessary to define all of the fields for normal or referral policies at this time. You may create the policy, then add rules, subjects, referrals, and so forth, later. For information on configuring normal and referral policies, see Modifying Policies.
- Type a name for the policy and click Next.
The new policy rule window opens under the policy name created.
- By default, the General view is displayed.
The General view displays the name of the policy and allows you to enter a description of the policy that is to be created.
- Click Create to complete the policy's configuration.
Modifying Policies
Once a normal or referral policy is created, you can modify the rules, subjects, conditions and referrals.
- From the Identity Management interface, select Policies from the View menu.
The policies that were created for that organization are displayed.
- Choose the policy you wish to modify and click the Properties arrow. The Edit Policy window is opened in the Data pane.
By default, the General view is displayed.
Modify a Normal Policy
Through the Identity Management interface, you can create a policy that defines access permissions. Such a policy is referred to as a normal policy. A normal policy can consist of multiple rules, subjects, and conditions. This section lists and defines the default fields that you can specify when creating a normal policy.
Adding Rules
Rules define the resource, actions and action values of the policy. To add rules to a normal policy:
- From the Identity Management interface, select Policies from the View.
The policies that were created for that organization are displayed.
- Choose the policy you wish to modify and click the Properties arrow. The Edit Policy window is opened in the Data pane.
By default, the General view is displayed.
- To define rules for the policy, select Rules from the View menu and click Add.
If more than one policy services exists, they will be listed in the Navigation pane. Choose the policy service for which you wish to create a policy and click Next. The Add Rule window is displayed.
- Define the resource, actions and action values in the Rules fields.
The fields are:
- Click Create to save the rule.
- Repeat steps 1 - 5 to create additional rules.
- All of the rules created for that policy are displayed in the table in the Rules view. Click Save to add the rules to the policy.
To remove a rule from a policy, select the rule and click Remove.
You can edit any rule definition by clicking on the Edit link next to the rule name.
Adding Subjects
Subjects define the subject to which the policy will apply. To add subjects to a policy:
- To define the subject for the policy, select Subject from the View menu and click Add.
- Select one of the default subject identities:
Click Next to continue.
- Enter a name for the subject. Click Add.
- Perform a search in order to display the identities to add to the subject.
The default (*) search pattern will display the qualified entries.
- Select the identities that you wish to add for the subject and click Create.
- All of the subjects created for that policy are displayed in the table in the Subjects view. Select the subjects that you wish to add to the policy and click Save.
To remove a subject from a policy, select the subject and click Remove.
You can edit any subject definition by clicking on the Edit link next to the rule name.
Adding Conditions
Conditions allows you to define constraints on the policy. For example, if you are defining policy for a paycheck application, you can define a condition on this action limiting access to the application only during specific hours. Additionally, you may wish to define a condition that only grants this action if the request originates from a given set of IP addresses or from a company intranet. To add conditions to a normal policy:
- To define conditions for the policy, select Conditions from the View menu. Click Add to add a new condition, or click the Edit link to edit an existing condition.
- Select one of the following default conditions:
Click Next.
- Define the values for a given condition in the Rules fields. The fields are:
Authentication Level
name
This field allows you to enter the name of the condition.
authentication level
The authentication level value indicates how much to trust authentications.
Authentication Scheme
name
This field allows you to enter the name of the condition.
authentication scheme
This field allows you to choose from the pull-down menu the authentication scheme for the condition.
IP Address
name
This field allows you to enter the name of the condition.
IP Address To/From
This field allows you to specify the range of the IP address
DNS Name
This field allows you to specify the DNS name.
Time
- Once you have defined the condition, click Create.
- All of the conditions created for that policy are displayed in the table in the Conditions view. Select the conditions that you wish to add to the policy and click Save.
To remove a condition from a policy, select the condition and click Remove.
You can edit any condition definition by clicking on the Edit link next to the rule name.
Modify a Referral Policy
Through the Identity Management interface you can delegate an organization's policy definitions and decisions to another organization. (Alternately, policy decisions for a resource can be delegated to other policy products.) A referral policy controls this policy delegation for both policy creation and evaluation. It consists of a rule and the referral itself. If the policy service contains actions that do not require resources, referral policies cannot be created for suborganizations.
Adding Rules
Rules define the resource of the policy. To add rules to a referral policy:
- To define rules for the policy, select Rules from the View menu. Click Add to add a new rule, or click the Edit link to edit an existing rule.
- Define the resource in the Rules fields. The fields are:
- Click Create to save the rule.
- Repeat steps 1 - 3 to create additional rules.
- All of the rules created for that policy are displayed in the table in the Rules view. Select the rules that you wish to add to the policy and click Save.
To remove a rule from a policy, select the rule and click Remove.
You can edit any rule definition by clicking on the Edit link next to the rule name.
Adding Referrals
The referral defines the organization to which the policy evaluation is being referred. By default, there are two types of referral: peer organization and sub-organization. They delegate to an organization on the same level and an organization on a sub-level, respectively.
To add a referral:
- To define referrals for the policy, select Referrals from the View menu. Click Add to add a new referral, or click the Edit link to edit an existing referral.
- Define the resource in the Rules fields. The fields are:
referral
Displays the current referral.
Name
This field allows you to enter the name of the referral.
- Click Create to save the referral.
To remove a referral from a policy, select the referral and click Remove.
You can edit any referral definition by clicking on the Edit link next to the rule name.
Creating Policies for Peer and Suborganizations
In order to create policies for peer or suborganizations, you must first create a referral policy in the parent (or another peer) organization. The referral policy must contain, in its rule definition, the resource prefix that is being managed by the suborganization. Once the referral policy is created in the parent organization (or another peer organization), normal policies can be created at the suborganization (or peer organization).
In this example, o=isp is the parent organization, o=sun.com is the sub-organization and manages resources and sub-resources of http://www.sun.com. To create a policy for this suborganization, follow these steps:
- Create a referral policy at o=isp. For information on referral policies, see the procedure Modify a Referral Policy.
The referral policy must define http://www.sun.com as the resource in the rule, and must contain a SubOrgReferral with sun.com as the value in the referral.
- Go to the Organization view and navigate to the suborganization sun.com.
- Ensure that the policy configuration service is registered at the suborganization level, sun.com. For information, see Registering Policy Configuration Services.
- Now that the resource is referred to sun.com by isp, normal policies can be created for the resource http://www.sun.com, or for any resource starting with http://www.sun.com.
See the procedure Modify a Normal Policy for information on creating normal policies.
To define policies for other resources managed by sun.com, additional referral policies must be created at isp.