HP-UX AAA Server A.08.02.10 Administrator's Guide HP-UX 11i v3 (T1428-90093, November 2013)

Notes:
• Customers can also write their own policy decision files and invoke them from the FSM or the
user profiles.
• This chapter discusses only the new (and easier to use) format for creating decision files. The
old format contains policy group entries that are still supported. However, the old format is
not documented in this chapter. For information about the old syntax, see Appendix E
(page 443).
• You cannot create a single decision file using syntax from both formats.
Defining a Policy in a Decision File
A decision file is evaluated from beginning to end against the request, by removing, modifying
and/or adding A-V pairs as specified until an Exit command is encountered. Any remaining lines
are not evaluated. The Exit command specifies the event to be returned to the FSM. The event is
used to control the flow through the FSM. If the end of the file is reached without executing an Exit
command then the ACK event is returned to the FSM. For more information on FSMs, see Chapter 26
(page 291).
Example 11 An example of a policy file that restricts Session-Timeout to one hour for guests, removes
unwanted attributes, and provides administrative privileges to administrators
# Guests have a session-timeout of one hour. Normal users
# have 5 hours.
if (substr (User-Name after "@") = "guest.example.com")
{
insert Session-Timeout = 3600
} else
{
insert Session-Timeout = 18000
}
if( NAS-IP-Address = "192.168.0.1")
{
# Delete Filter-Id for NASes that do not support it.
delete Filter-Id
}
if( User-Name = "admin")
{
# Modify Service-Type to provide administrative privileges.
modify Service-Type = "Administrative"
}
This section describes the syntax and usage of the various commands. It also explains how to
specify attributes and values. This section discusses the following topics:
• “Action Commands.”
• “Attribute Specifications” (page 309)
• “Value Types” (page 316)
• “Supported Boolean Operators” (page 318)
• “Type Compatibility” (page 320)
302 Customizing the HP-UX AAA Server Using Policies