Skip to main content

Create resource rules

Resource rules protect access to your applications by requiring users to pass a predetermined risk assessment and authentication requirements. You can create a new resource rule for an application or clone an existing resource rule.

Resource rules use an authentication flow to determine how a user authenticates to a protected resource. You can create authentication flows as you build a resource rule or create them in advance. See Create authentication flows for more information.

Before you begin, review Create and manage resource rules to understand how resource rules apply access filters, risk factors, authentication flows, SSO behavior, and access denial. Also review the terminology and tips on this page before you build a resource rule graph.

Terminology and tips​

Before you begin building your resource rule, review the following terminology and tips.

Graphs​

When you build a resource rule, you create a graph. The following explains the terms used in the graph.

Resource Rule Terminology

  • Node. The rectangle components in a graph.
  • Edge. The line that connects two nodes.
  • Handle. The connection point on a node where edges can be attached (the grey circle on the top or the bottom on the node).
  • Canvas. The empty space in the graph building area.
  • Settings. The configuration options for a node added to a resource rule graph. They appear on the side of the graph area when a node is selected.

The Side bar includes the following icons:

IconDescription
AddOpens the Task menu to add nodes to your graph. Click again or click anywhere in the Canvas to close it.
TidyImproves the appearance of your graph.
UndoUndoes your last change.
RedoRedoes your last undone change.
No errors found.
Error detected.

Task menu nodes​

The following table describes each node available in the Task menu and its purpose.

NodeDescription
Access Filter
Authentication Context ReferencesConfigure to evaluate users with an ACR specified in their request. This resource rule can be considered only for matching ACR requirements. See Add Authentication Context References for more information. Available for SAML, OIDC and OAuth, Authentication API, and IDaaS applications.
Domain-based IdPConfigure to evaluate users that are associated or not associated with a domain. This resource rule can only be considered for matching domain requirements. Available for the User, User Edit, and Administrator portals, and SAML and OIDC and OAuth applications.
GroupConfigure the group of users that are evaluated based on the resource rule. This resource rule can only be considered for matching group requirements.
Risk Factors
Date/TimeConfigure allowed date ranges, time of day, and time zones. This risk factor applies to all applications, but it is the only applicable risk factor for Entrust Identity Enterprise Legacy applications.
Device VerificationRequire a user to perform device verification. No configuration required. Not available for RADIUS applications.
ExternalAdd External Risk Engines as a risk factor. See Manage external risk engines for more information. Available only for Authentication APIs and Identity as a Service and OIDC and OAuth applications.
GeolocationConfigure to allow or deny access from specific countries.
Source IP AddressConfigure allowed or denied IP addresses.
Location HistoryThe Risk-Based Authentication (RBA) settings of your Identity as a Service account define the location history. There is no additional configuration required. See Manage risk-based authentication settings for more information.
Machine AuthenticationConfigure risk points for device fingerprint mismatches. This risk factor is not applicable to RADIUS applications.
TransactionUsed to set Transaction Condition settings. See Manage transactions for more details about transactions. Available for Identity as a Service, Authentication API, and OIDC and OAuth applications using the JWT IDaaS grant type.
Travel VelocityThe Risk-Based Authentication (RBA) settings of your Identity as a Service account define the travel velocity conditions. There is no additional configuration required. See Manage risk-based authentication settings for more information.
Logic Task
Access EvaluationSet the access requirements users must meet to be able to access the resource.
Risk EvaluationSet the risk evaluation to determine a user's risk to allow or deny access to the protected resource.
Auth Task Result
Allow AccessAllow access to the protected resource.
Deny AccessDeny access to the protected resource.

Building tips​

Interacting with the graph​

  • Click in the Canvas to display the General Settings.
  • Click a node to display the settings for that node.
  • To hide the Task menu, click anywhere in the Canvas.

Adding and removing nodes​

  • To add multiple nodes to a flow element (for example, three different risk factors), click the Task menu and add them to the Canvas first, then arrange them and connect them with edges to the connecting node in the flow (either Start or Access Evaluation).
  • Hover over a node or an edge between two nodes to see the symbol, then click it to see the nodes you can add at that position. For example, if you added a Geolocation risk factor connected to the Start node and want to insert a Group Access Filter, click the add symbol on the edge between them to insert the node directly.
  • To delete a node, select it in the graph and press Delete, or click the node to display its settings and click the Delete icon in the settings panel.
  • To delete a risk factor, delete it from the graph or click the node to display its settings and click the Delete icon.

Saving and tidying​

  • Click Save to save your changes as you build the resource rule.
  • After adding nodes, click the Tidy button to clean up the graph layout and reduce the space it takes on the Canvas.

Topics in this section​