Skip to main content

Add Access Controls

Access Controls further streamline the users that can access the protected resource with this resource rule.

Access Filter connections in the graph​

Connect Access Filters to the Start node and then connect them to the Access Evaluation node as shown in the following figure.

Access Filter connections

Authentication Context Reference (ACR)​

This setting is available for resource rules that protect SAML, OIDC and OAuth, Authentication API, and Identity as a Service applications. It allows a user to authenticate using this resource rule if the authentication request from the client request contains specified Authentication Context Reference (ACR) values, any ACR value, or does not include an ACR value. This feature allows the client to influence how the user is authenticated based on ACR requests. For more information, see Add Authentication Context References.

ACR filters select whether the resource rule is eligible for a request before risk factors are evaluated.

ConfigurationResult
Do not add an ACR Access Filter nodeThe rule can apply whether or not the request includes ACR.
Add the node and select No ACRThe rule applies only to requests that do not include ACR.
Add the node, select ACR, and add valuesThe rule applies only when the request includes those values.
Add the node, select ACR, and add noneThe rule applies to requests that include any ACR value.
Example

Create ACR access filters when an application can request different assurance levels. For example, an application can send a Low Assurance ACR for ordinary access and a High Assurance ACR for sensitive access. The Low Assurance ACR can match one resource rule with a lower-friction authentication flow, while the High Assurance ACR can match another resource rule that requires stronger authentication.

Configure Authentication Context Reference​

  1. Click the ACR Access Filter node. The Authentication Context Reference settings appear.
  2. Click ACR or No ACR, as required.
    1. If you click ACR, the resource rule considers users with an authentication context specified in their requests.
    2. If you click No ACR, the resource rule considers users without an authentication context specified in their requests.
  3. Select the ACR to Add from the drop-down list.
note

If you add an ACR node and do not specify an ACR, then by default all requests with any ACR are evaluated by the resource rule.

Domain-based IDP​

This setting is available for resource rules configured for the User, User Edit, and Administrator portals, and SAML and OIDC and OAuth applications. It allows a user to authenticate using this resource rule if they belong to a specified Domain-based IDP. For more information, see Manage Identity Providers.

Domain-based IdP filters select whether the resource rule is eligible based on the user's domain-based Identity Provider status before risk factors are evaluated.

ConfigurationResult
Do not add a Domain-based IdP Access Filter nodeThe rule can apply whether or not the user has a domain-based IdP.
Add the node and select No Domain-based IdPThe rule applies only to users without a domain-based IdP.
Add the node, select Domain-based IdP, and add providersThe rule applies only when the user matches one of the selected domain-based IdPs.
Add the node, select Domain-based IdP, and add no providersThe rule applies to users with any domain-based IdP.
Example

Create a Domain-based IdP access filter when users from one domain must authenticate through a specific external Identity Provider. For example, employees with the example.com domain can match a rule that uses the corporate Identity Provider login flow. Contractors who do not have a domain-based Identity Provider can match a No Domain-based IdP rule that uses a User Login flow with IDaaS authenticators.

Configure a Domain-based IdP​

  1. Click the Domain-based IdP Access Filter node. The Domain-based IdP settings appear.
  2. Click Domain-based IdP or No Domain-based IdP, as required.
    1. If you click Domain-based IdP, the resource rule evaluates users associated with Domain-based IdPs.
    2. If you click No Domain-based IdP, the resource rule evaluates users not associated with any Domain-based IdPs.
  3. Select the Identity Provider to Add from the drop-down list. See Manage Identity Providers and webhooks.
note

If you do not add a Domain-based IdP, by default the resource rule evaluates users associated with any Domain-based IdP.

Group​

Use this setting to restrict access to users belonging to specific groups. If you want all users to be evaluated by the resource rule, do not add this feature to the graph.

Example

Create a group access filter when only specific users can access an application. For example, users in the Payroll group can match a rule that allows access to the payroll application. Users outside the Payroll group do not match that rule and would be blocked from accessing the application.

Add a group access filter​

  1. Click the Group Access Filter node. The Group settings appear.
  2. Select the Group to Add from the drop-down list.
  3. Repeat this step to add more groups.