Access conditions¶
The Access conditions module defines rules which, once attached to an access policy, allow or deny users to connect to the user portal based on a technical criterion (IP address, time window, browser, operating system, certificate, user profile attribute, etc.).
A condition is evaluated at connection time: if it is valid, the associated action (allow or deny) is applied.
Conditions list¶
The grid shows all existing conditions, paginated by 15, 25 or 50 entries.
| Column | Description |
|---|---|
| Name | Label of the condition, preceded by an icon showing the type and the decision (allow or deny). |
| Type | Type of the condition (see table below). |
| Condition | Textual summary of the configured parameters (IP ranges, dates, browsers, etc.). |
The search field at the top right filters the list by name.
Add a condition¶
Clicking the + button opens the creation form. Fields common to every type:
| Field | Description |
|---|---|
| Condition type | Mandatory. Defines the nature of the rule (see table below). Not modifiable after the first save. |
| Name | Mandatory. |
| Description | Free text. |
| Access | Two choices: Allow if valid (default) or Deny if valid. |
| Notify the user if invalid | If checked, the user sees a message when the condition denies access. |
| Log if invalid | If checked, an entry is written to the log on a denial. |
Available types¶
| Type | Check performed | Client required |
|---|---|---|
| Connection address | URL used by the user to reach the CyberElements tenant. | No |
| Antispyware | Presence of an active antispyware on the workstation. | Yes |
| Antivirus | Presence of an active antivirus on the workstation. | Yes |
| Windows Security Center | State of the Windows security settings (automatic update, Internet Explorer settings, UAC). | Yes |
| Certificate | Certificate presented by the browser to authenticate to the web interface. | No |
| Date | Date range, time window, months list, days of the week. | No |
| IP | IP / domain address, IP range or subnetwork. | No |
| MD5 | Presence of a file at a given path with an expected MD5 checksum. | Yes |
| Meta-rule | Logical combination (AND / OR) of at least two other existing conditions. | Depends on the combined conditions |
| Browser | Browser used by the client. | No |
| Operating system | OS detected on the workstation. | Yes, unless Use the User-Agent is checked |
| Firewall | Presence of an active firewall. | Yes |
| System | Local check (file, volume number, disk serial number, running process, registry key). | Yes |
| User | Presence / value of a user profile attribute. | No |
| FIDO2 | Authentication of the user through a FIDO2 / WebAuthn key. | No |
The « Client required » column
Some checks concern the state of the workstation: they are performed locally and therefore require the CyberElements client to be installed on the user's workstation. When the client is absent, a condition that needs it cannot be evaluated and is treated as invalid — which is notably the case for connections made from Cleanroom Desktop.
Parameters per type¶
| Field | Description |
|---|---|
| Domain | Host portion of the tenant URL (without https:// or path). Accepts letters, digits, hyphens, the dot and regular-expression characters. |
Two modes are offered:
| Mode | Description |
|---|---|
| User authenticated using a certificate (default) | Verifies that the user authenticated using a certificate. |
| Test certificate's contents | Additionally compares a certificate field with a user profile field. |
Additional fields for the second mode:
| Field | Description |
|---|---|
| Certificate field | Drop-down list: DN field of the user certificate, CN field of the user certificate (default), Email field of the user certificate, O field of the user certificate, OR field of the user certificate or PEM-encoded certificate for client X509. |
| User profile field | User profile field whose value is compared. |
At least one of the four options must be checked; the active options are combined with a logical AND.
| Option | Description |
|---|---|
| Date | Date range (start, end). The end date cannot be earlier than the start date. |
| Hour | Time window (HH:MM). The end time must be after the start time (unless the condition spans several days). |
| Month | Twelve check-boxes, all checked by default. |
| Day of the week | Seven check-boxes, all checked by default. |
Three mutually exclusive modes:
| Mode | Fields |
|---|---|
| IP or domain list | One or more IPv4 addresses separated by ;. |
| IP range | Starting and ending IP. |
| Subnetwork | IP and mask (CIDR 0 to 32). |
| Field | Description |
|---|---|
| File path | Full path (e.g. C:\Test.ext). |
| MD5 checksum | 32-character hexadecimal number. |
A link allows downloading the Windows MD5 checksum utility provided by cyberelements.
| Field | Description |
|---|---|
| Logical operator | AND (default) or OR. |
| Component rules | Drag-and-drop at least two conditions from the left-hand column to the right-hand column. A meta-rule cannot reference itself nor reference a meta-rule already used in its own hierarchy. |
Check-boxes matching the browsers to detect: Internet Explorer 7 to 11, Konqueror, Firefox, Safari, Chrome, Opera, Edge. The Other option activates a free text field for the exact name of another browser. By default, Internet Explorer is checked.
Singling out connections made from Cleanroom Desktop
The platform sees Cleanroom Desktop as a browser: it identifies itself with a user-agent of the form Cleanroom Desktop 1.2.3.4. Checking Other and entering Cleanroom Desktop therefore targets the accesses made from that client. Attached to an access policy, the condition lets you reserve some resources for the Desktop client and others for the user portal.
| Option | Description |
|---|---|
| Use the User-Agent | If checked, detection relies on the User-Agent header rather than on the local agent. |
| OS list | Check-boxes (Windows XP to 11, Windows Server 2003 to 2022, Linux, MacOS X, Vista, 9x, NT, CE, etc.). The Other option activates a free text field. At least one box must be checked. |
Local check, one of:
| Mode | Description | List validation |
|---|---|---|
| File | List of file paths to check. | All must be present (AND). |
| C:\ volume number | List of volume numbers (a downloadable utility helps retrieving them). | A single one must match (OR). |
| Hard disk serial number | List of serial numbers. | A single one must match (OR). |
| Running process | List of process names. | All must be running (AND). |
| Registry Key | List of keys / values in the form HKEY_LOCAL_MACHINE\path\name=value. |
All must exist, with the given value where applicable (AND). |
For each mode, enter the value and click Add to push it into the table. Each row can be deleted individually (with confirmation).
The logic differs from one mode to the next
The two hardware modes — C:\ volume number and Hard disk serial number — are satisfied as soon as a single value in the list matches: there, the list enumerates the authorised workstations. The other three modes require every value to be verified.
| Field | Description |
|---|---|
| Attribute name | User profile attribute to test (e.g. mail, employeeID, mobile). |
| Attribute value | Optional. Expression compared with the value returned. Left empty, the condition only verifies that the attribute holds a value. |
| Exclusive comparison | If checked, the expression must match from the start of the value; otherwise it may match anywhere within the value. |
Supported domain types
This condition is not restricted to directories: attributes are read from the directory for an LDAP domain and from the database for a local domain. For other domain types — SAML in particular — no attribute is returned, so the condition is never valid there, which matters depending on whether it is set to Allow or to Deny.
Edit a condition¶
Select the condition in the list and click the Properties icon, or double-click the row. The same fields as for creation are shown, except Type, which becomes read-only.
Delete a condition¶
Select one or more conditions and click the × button. Deletion prompts for confirmation. Multi-selection is supported.