chapter-64

*********************************************************START*******************************************************

       

       

You are here: 7: Policy Assertion Reference > Working with Encapsulated Assertions > Encapsulated Assertion Configuration Properties

       

       

Encapsulated Assertion Configuration Properties

       

When creating, cloning, or viewing details about an encapsulated assertion, the Encapsulated Assertion Configuration Properties appear.  These properties allow you to configure the behavior and appearance of the assertion:

       

           

The palette from which the assertion is available.

           

The underlying policy fragment that forms the foundation of the assertion.

           

Configurable inputs and outputs.

       

       

             To access the Encapsulated Assertion Configuration Properties:

       

           

Run the Manage Encapsulated Assertions task. A list of the available encapsulated assertions is displayed.

           

Perform any of the following actions:

       

       

           

Create a new encapsulated assertion.

           

Clone an existing encapsulated assertion.

           

View or edit the properties of an encapsulated assertion.

       

       

The Encapsulated Assertion Configuration Properties appear.

       

           

       

       

Figure 182: Encapsulated Assertion Configuration Properties dialog

       

           

Choose an Icon and then enter a Name for the encapsulated assertion. These will appear in the assertion palette and the policy window. Tip: If you use your own icon, the recommended size is 16x16 pixels, with a maximum file size of 32KB.

           

Choose the Palette Folder  where the encapsulated assertion will be located. You can decide which folder best represents your assertion.

           

Click [Set Policy] to select the underlying Policy for the encapsulated assertion. The underlying policy can be any Included Policy Fragment. Also specify whether to Auto-populate inputs and outputs:

       

       

           

Select the check box to have the Policy Manager automatically populate the Input and Output sections based on the definition of the chosen policy fragment. The auto population will not update or remove any existing entries with the same name. You can still make changes to the fields after auto population.

           

Clear the check box to populate the inputs and outputs yourself.

       

       

Note: Although it is possible to create multiple encapsulated assertions using the same underlying policy fragment, CA recommends against doing this.

       

           

An Artifact Version identifier is displayed for all encapsulated assertions that have been exported or imported using the Manage Encapsulated Assertions task. This number uniquely identifies the encapsulate assertion plus its associated policy fragment. Identical encapsulated assertions will have the same Artifact Version identifier. Any differences, even to the underlying policy fragment, will trigger a different version number when the encapsulated assertion is exported (no change occurs prior to export). Tip: You can use this number to help determine whether an exported encapsulated assertion is the same as one that has already been imported.

       

       

The Artifact Version identifier is also visible in the Comment field of the policy revision created for the underlying policy fragment, to make it possible to roll the policy fragment back to its original state.

       

Notes: (1) The Artifact Version is not a version number and newer versions may not have an incremented number. It is simply a unique identifier, similar to a generated hash value. (2) The Artifact Version identifier does not change if you modify the encapsulated assertion. It will change only if another file (with a different artifact version) is used to import and overwrite the encapsulated assertion.

       

           

The Inputs section lists the context variables and GUI fields that will be used to configure this encapsulated assertion. See "Configuring Inputs" below for details.

           

The Outputs section lists the context variables that will be made available to the parent context after this encapsulated assertion has run. See "Configuring Outputs" below for details.

           

Optionally choose a security zone. To remove this entity from a security zone (security role permitting), choose "No security zone". For more information about security zones, see Understanding Security Zones. Note: This control is hidden if either: (a) no security zones have been defined, or (b) you do not have Read access to any security zone (regardless of whether you have Read access to entities inside the zones).

       

       

           

Select Allow debug tracing into backing policy if you want to include the underlying policy fragment during debug tracing; otherwise the backing policy is invisible to the trace (replicates Policy Manager behavior prior to v8.2.0).

       

       

To enable debug tracing, you must select the "Enable debug policy tracing" check box in the [General] tab of the published service's properties. For more information, see Policy Debug Tracing.

       

Note: This setting does not enable or disable debug tracing. It merely controls whether tracing should include the individual assertions within the backing policy when policy tracing is enabled.

       

           

Click [OK] 

 when done.

       

       

Configuring Inputs

       

Note: It is important to have a sound understanding of how the input definition can affect the flow of information between the encapsulated assertion and its parent policy. For more information, see "Understanding How Values are Passed to the Parent Policy" in Working with Encapsulated Assertions.

        The Inputs section is used to define the input arguments for the encapsulated assertionâ??in other words, the values that will be passed to the underlying policy fragment. The table contains the following columns:

       

           

GUI: Whether the input will appear in the encapsulated assertion's properties.

           

Name: The name of the input.

           

Type: The data type of the input.  

           

Label: The label that will appear on the interface, if different from the name.

       

        These column values are described in more detail in Table 136 below.

       

Tip: The Policy Manager will pre-configure inputs for you if the Auto-populate inputs and outputs check box was selected. You can change any auto-populated input as necessary.

       

Choose an action to perform:

       

           

               

Table 136: Encapsulated assertions: Argument Properties

           

           

           

               

                   

                       

To...

                   

                   

                       

Do this...

                   

               

               

                   

                       

Add an input

                       

                   

                   

                       

                           

Click [Add].

                           

Complete the Argument Properties (see "Completing the Argument Properties" below for details).

                       

                   

               

               

                   

                       

Edit an input

                       

                   

                   

                       

                           

Select the input to change.

                           

Click [Edit].

                           

Modify the Argument Properties as required  (see "Completing the Argument Properties" below for details).

                       

                   

               

               

                   

                       

Delete an input

                       

                   

                   

                       

                           

Select the input to change.

                           

Click [Delete]. The input is deleted immediately.

                       

                   

               

               

                   

                       

Reposition an input in the assertion properties

                       

                   

                   

                       

                           

Select the input to reposition.

                           

Click [Move Up] or [Move Down].

                       

                       

Tip: Repositioning an input only applies to inputs that are shown in the assertion properties dialog. It has no effect on functionality and does not apply to inputs suppressed from the dialog.

                   

               

       

       

IMPORTANT: Be extremely careful when changing the inputs of an encapsulated assertion that is currently in use by policies.  In particular, pay careful attention when adding new inputs or renaming existing inputs: ensure that the underlying policy fragment will respond gracefully if the input is not provided.

       

Completing the Argument Properties

        When adding or editing an input, the Argument Properties dialog is displayed:

       

           

       

       

Complete the properties as follows:

       

           

               

Table 137: Encapsulated assertions: Argument Properties

           

           

           

               

                   

                       

Setting

                   

                   

                       

Properties

                   

               

               

                   

                       

Name

                       

                   

                   

                       

Enter a name for the input. This name should generally match the name of a context variable from the parent context and should be meaningful to the underlying policy fragment.

                       

The name must conform to the "Context Variable Naming Rules", described under Context Variables.

                   

               

               

                   

                       

Type

                       

                   

                   

                       

From the drop-down list, choose a data type for the input. This sets the GUI control that is visible if the input is set  to show in the assertion properties dialog.  

                       

Note: The data types "Message" or "Element" will always result in the child policy context containing a reference to the value from the parent context, while the other data types will vary depending on whether input is shown on the assertion properties. For more information, see Working with Encapsulated Assertions.

                   

               

               

                   

                       

Show in assertion properties dialog

                       

                   

                   

                       

Select this check box to display the input in the assertion properties. When visible, all inputs of type "Message" and "Element" are aliased in the child policy context. All other data types are copied into the child policy context.

                       

Clear this check box to hide the input from the assertion properties. When hidden, all values are aliased in the child policy context, and will appear in the Assertion Information dialog as variables used by the encapsulated assertion.

                       

Tip: For more information, see "Understanding How Values are Passed to the Parent Policy" under Working with Encapsulated Assertions. Examples #1 and #2 in that section illustrate "aliasing", while Example #3 demonstrates "copying".

                   

               

               

                   

                       

Label

                       

                   

                   

                       

Optionally enter a label that will appear in the assertion properties. If not specified, the Name is used as the label.

                   

               

       

       

Configuring Outputs

        The Outputs section is used to define the context variables that will be set by the encapsulated assertion. Only the context variables declared here will be visible to the parent context once the encapsulated assertion has finished running.            

       

Tip: The Policy Manager will pre-configure outputs for you if the Auto-populate inputs and outputs check box was selected.

       

Choose an action to perform:

       

           

               

Table 138: Encapsulated assertions: Result Properties

           

           

           

               

                   

                       

To...

                   

                   

                       

Do this...

                   

               

               

                   

                       

Add an output

                       

                   

                   

                       

                           

Click [Add].

                           

Complete the Result Properties (see "Completing the Result Properties" below for details).

                       

                   

               

               

                   

                       

Edit an output

                       

                   

                   

                       

                           

Select the output to change.

                           

Click [Edit].

                           

Modify the Result Properties as required  (see "Completing the Result Properties" below for details).

                       

                   

               

               

                   

                       

Delete an output

                       

                   

                   

                       

                           

Select the output to change.

                           

Click [Delete]. The output is deleted immediately.

                       

                   

               

       

       

IMPORTANT: Proceed with caution when changing the output of an encapsulated assertion currently in use. Ensure that any new output does not conflict or overwrite any context variables already in use by existing user policies. When modifying or removing an output, consider the behavior of any existing user policies that rely on that output.

       

Completing the Result Properties

        When adding or editing an output, the Result Properties dialog is displayed:

       

           

       

        Complete the fields:

       

           

Enter the Name of the context variable that will be set by the underlying policy fragment and made available to the parent policy context.

           

Choose the data Type of the result.

       

       

Tip: The output Type is currently useful for your own documentation purposes, but it is not enforced at runtime. The type selected here will be displayed in the Assertion Information dialog for the encapsulated assertion.

       

*********************************************************END*******************************************************

*********************************************************START*******************************************************

       

       

You are here: 3: Managing Certificates > Exporting a Certificate

       

       

Exporting a Certificate

       

            To export a certificate 

 from the federated gateway trust store:

       

           

In the Policy Manager, 

 select [Tasks] > Manage 

 The Manage Certificates dialog appears. 

 

           

Select the certificate 

 to export and then click [Properties]. 

 The Certificate Properties dialog 

 appears.

           

Click [Export] 

 and then specify a file name and location for the exported certificate. 

 

           

Click [Save]. 

 The certificate is exported.

           

Click [Cancel] 

 to close the Certificate Properties dialog, then click [Close] 

 to close the Manage Certificates dialog.

       

       

*********************************************************END*******************************************************

*********************************************************START*******************************************************

       

       

You are here: 6: Working with Policies > Exporting/Importing a Policy > Exporting a Policy

       

       

Exporting a Policy

       

The Policy Manager allows you to export a policy to a file. Use 

 this feature to share policies internally or externally, or to save copies 

 of policies for record-keeping purposes. Exported policies that are saved 

 locally can be renamed, deleted, or edited by replacement.

        It is recommended that you only export valid policies. Validation confirms 

 the proper configuration and organization of a policy. See Validating a Policy for more information. An exported policy may contain disabled assertions. If security zones have been defined, you must have Read permissions to the policy in order to export. 

 

        The portable policy XML file generated during export includes references 

 to:

       

           

The identity providers belonging 

 to the users and groups in the policy

           

The JMS 

 routing

endpoints, or destinations, if included in the policy, and

           

Any custom 

 assertions

, if present in the policy.

       

        When exporting a policy using the browser 

 client

version of the Policy Manager, the Java applet 

 must be running in the trusted mode. For more information, see Policy Manager Browser Client.

       

            To export a policy:

       

           

Open the policy to be exported using either of the 

 following methods:

           

               

Right-click the service 

 name in the Services and Policies list

 and then select Active Policy Assertions. 

 Or,

               

Double-click the service name 

 in the Services and Policies list.

           

           

Click [Export 

 The Export Policy dialog appears.

           

Do one of the following:

           

               

If 

 using the standard client:

Either use the default directory offered 

 or navigate to another location. If you use the default location (".l7tech\policy.templates"), the exported policy will appear 

           

       

       

Note: Only exported policies saved as a template in the default directory 

 will appear under the Policy Templates section of the [Assertions] tab. 

 Policies saved to any other location will not appear in the Policy Templates 

 section. Policies can be imported 

 regardless of their saved locations.

       

           

               

If 

 using the browser client:

Navigate to a folder of your choice to 

 save the template.

           

       

       

Note: 

 Be sure to note the location of the saved templates for later import. 

 This is because there is no Policy Templates section in the [Assertions] 

 tab for the browser client version.

       

 for the exported policy and then click [Save]. 

 The policy is exported as a portable XML file which encapsulates all of 

 the assertions and back-end settings. The policy appears under Policy 

 Templates

in the [Assertions] tab (standard client version only). 

 

       

       

Tip: You can open the exported XML file in a text editor to view policy details. 

 Be sure you have a backup before you make any modifications to the file. 

 

       

*********************************************************END*******************************************************

*********************************************************START*******************************************************

       

       

You are here: 3: Managing Certificates > Managing Private Keys > Exporting a Private Key

       

       

Exporting a Private Key

        You can export any private key that is stored in the software database, as either a *.p12 or a *.pfx file. The exported key is protected with a password.

       

Note: Private keys cannot be exported from a Hardware Security Module (HSM), due to the high-security mode of these type of keystores.

       

            To export a private key:  

       

           

In the Policy Manager, 

 select [Tasks] > Manage 

 The Manage Private Keys dialog appears.

           

Select the private key to be exported and then click [Properties]. The Private Keys Properties dialog appears.

           

Click [Export Key] in the Other Actions section. You are prompted to provide a password to protect the exported key.

           

Enter a password and then retype for confirmation.  

       

       

           

Click [OK]. You are prompted for a location to save the exported key.

           

Navigate to the destination and then click [Save].

       

       

*********************************************************END*******************************************************

*********************************************************START*******************************************************

       

       

You are here: 6: Working with Policies > Exporting/Importing a Policy

       

       

Exporting/Importing a Policy

        The following topics describe how to export or import a policy, as well as to resolve any conflicts that may arise during importing.

       

           

Exporting a Policy

           

           

Importing a Policy from a File

           

           

Importing a Policy via UDDI Registry

           

           

Import WS-Policy from URL in UDDI Registry Wizard

           

           

Searching the UDDI Registry

           

           

Resolve External Dependencies Wizard

           

       

*********************************************************END*******************************************************