HP 3PAR Policy Server Administrator's Guide (QR483-96003, December 2012)

HP 3PAR Policy Server 4-5
When creating filters, you must assign the filter a name that is unique in the Policy Server database and an
access right (Always Allow, Ask for Approval, or Never Allow). In addition, if you want to restrict a
permission to certain users at certain times, you can add expressions, which can consist of variables, values,
and operators:
• For operators, you can use the equals sign (=) and the AND operator.
• For variables, you can specify the userId and the domain name of the HP 3PAR Enterprise Server
(enterpriseId) from which the Agent received the action request. Values for variables can contain the
asterisk (*) wildcard character to represent zero or more characters.
Notes about expressions:
Grouping and other Boolean operators, such as OR and NOT, are not supported.
In general, expressions are case insensitive. For example, you can enter "and" or "AND" for this
Boolean operator; the results are the same. However, the variable names must be entered as follows:
userId and enterpriseId (capital "I", lowercase all other letters).
When they evaluate expressions, the Agent gateway and Policy Agents parse and check the syntax.
Policy Server does NOT check expression syntax.
For examples of expressions, refer to the online help for the Policy Server application.
To be able to restrict access to a certain period of time, whether once or every week, you define a Time
Window for the filter. You can choose a fixed time period or one of two recurring time periods. The Time
Window options follow:
• (Blank) – This option specifies NO time period. If you previously added a Time Window and need
to remove it, select this option.
• One Time – This option allows the action for a single time period. This time period can span days,
weeks, or months. When you select this option, you must select a Start Date and Start Time as well
as an End Date and End Time. For the date fields, click the calendar icon and select the date. To set
the times, type them, using the format HH:MM AM or PM. For example, between 10:00 AM on
03/04/2010 and 9:00 AM on 03/06/2010.
• Weekly Recurrence – This recurring option allows the action on specified days of the week, during
specified hours. For example, between 5:00 PM and 8:00 PM every Monday and Wednesday or
every Tuesday and Thursday from 4:00 AM to 8:00 AM.
• Weekly Range – This recurring option allows the action during a specified range of days of the
week. The period begins at the Start Time on the Start Day of the week. The time period ends at the
End Time on the End Day of the week. For example, between 5:00 PM on Friday and 9:00 AM on
Monday.
After you have defined your own filters and assigned them to one or more permissions, the Access Right
column for those permissions shows the default filter. You can view details for the assigned filters from the
Filters column. The filters appear in the order in which the Agent will evaluate them, from first to last, with
the default filter shown last. Keep in mind that, when other filters are assigned, they are evaluated in the
order in which they appear here and the default filter is always evaluated last. For details on how the Agents
evaluate filters, refer to the next section, Filter Evaluation.