Citrix Systems CITRIX NETSCALER 9.3 manual Binding Command Policies to Users and Groups

Citrix NetScaler Administration Guide

To configure a command policy by using the configuration utility

1.In the navigation pane, expand System, and then click Command Policies.

2.In the details pane, do one of the following:

•To create a command policy, click Add.

•To modify an existing command policy, select the command policy, and then click Open.

3.In the Create Command Policy or Configure Command Policy dialog box, specify values for the parameters, which correspond to the parameters described in "Parameters for configuring a command policy" as shown:

•Policy Name*—policyname (Cannot be changed for an existing policy.)

•Action—action

•Command Spec*—cmdspec (You can type a complete expression directly into the text area, or you can click Add or Regex Tokens for assistance. The Add icon opens the Add Command dialog box, in which you can select a NetScaler entity and then select an operation to perform on the entity. The Regex Tokens icon displays regular expression tokens, which you can add to your expression by selecting them.)

* A required parameter

4.Click Create or OK, and then click Close.

A message appears in the status bar, stating that the command policy has been configured successfully.

Binding Command Policies to Users and Groups

Once you have defined your command policies, you must bind them to the appropriate user accounts and groups.

When you bind a policy, you must assign it a priority so that the NetScaler appliance can determine which command policy to follow when two or more applicable command policies are in conflict.

Command policies are evaluated in the following order:

wCommand policies bound directly to users and the corresponding groups are evaluated according to priority number. A command policy with a lower priority number is evaluated before one with a higher priority number. Therefore, any privileges the lower-numbered command policy explicitly grants or denies are not overridden by a higher-numbered command policy.

wWhen two command policies, one bound to a user account and other to a group, have the same priority number, the command policy bound directly to the user account is evaluated first.

31