Access Policies¶
The Access Policies module groups the rules that grant user groups the right to reach published applications. A contract answers four operational questions: who (which groups), what (which applications and under which restrictions), where (on which site) and under which conditions (access conditions, alerts, network filtering).
User groups, applications and access conditions must exist before being referenced in a contract.
Cumulative rights
A group can appear in several contracts and a user can belong to several groups. In both cases rights are cumulated. Conversely, when a contract targets several groups, belonging to any one of them is enough to benefit from its rights.
Contracts list¶
The main grid lists existing contracts. Each row can be expanded or collapsed to show details (domains/groups, conditions, sites, categories and applications, restricted applications, alerts, network filtering, revealable aliases).
| Column | Description |
|---|---|
| Name | Contract name, preceded by a padlock icon. |
| Groups | Number of associated user groups. |
| Access conditions | Number of associated access conditions. |
| Sites | Number of referenced sites. |
| Applications | Number of authorised applications. |
| Restricted applications | Number of applications placed behind a workflow. |
| Alerts | Number of access alerts attached to the contract. |
| Network connections | Number of network filter rules (column hidden by default). |
| Revealable aliases | Number of revealable aliases associated (shown only when the feature is enabled). |
The search field in the top-right corner filters the list by name.
Add a contract¶
Click the + button to open the creation wizard. The header fields are shared by all tabs:
| Field | Description |
|---|---|
| Name | Required. Identifies the contract. |
| Description | Free-form label. |
The form is split into several tabs to be filled in the logical order.
Select the authentication domain from the drop-down list, then drag and drop the desired user groups to the right-hand column. A single contract can combine groups from several domains. At least one group must be selected for the contract to be valid.
Drag and drop the access conditions to apply. A condition allows or denies access based on a criterion (IP, date, certificate, etc. — see Access conditions).
Several conditions combine with AND
When several access conditions are attached to the same contract, all of them must be valid for the contract to apply: a single invalid condition is enough to discard it, and the user does not get the rights it carries. To obtain an OR, use a meta-rule in the Access conditions module.
Tab visibility
The tab appears only when at least one access condition exists in the dedicated module.
Drag and drop the site(s) hosting the applications. A site is a set of Edge Gateways defining a secured entry point to a local network.
Several sites: the user chooses
When the contract references several sites, the user is offered the Select a site screen when launching the application, to pick the one to go through.
The tree lists applications grouped by category. Ticking a category selects all its applications and automatically includes any application later added to that category. Ticking individual boxes lets you pick a subset. At least one application must be ticked.
Workplace applications — exclusivity
When the Workplace association is enabled, two virtual applications appear: Access to Workplace applications by merged cloud and Access to Workplace applications by redirection. They are mutually exclusive within the same contract.
Places some of the previously selected applications behind an approval workflow. Users will have to request access and an administrator will accept or refuse requests from the Workflow module.
| Option | Description |
|---|---|
| Ask the user to complete a form when requesting access | If ticked, the user must complete a form each time they request access to a restricted application. |
| Applications to restrict | Two-column list (available / restricted) with search. |
Collapsed by default. When Allow personal aliases is ticked, you can designate, among the selected applications, those for which the user can save their own aliases (credentials stored in the portal).
Visible only when the Allow password display in alias option is checked in the general options. Two-column list to pick the aliases (linked to users) that can be revealed via this contract.
Meta-aliases
When the selection contains at least one meta-alias, a confirmation dialog is shown before saving.
Drag and drop the alert profiles to trigger when the accesses covered by this contract are used.
Tab active only when at least one RDS, HTML5 RDS, SSH or HTML5 SSH application is selected in the Applications tab.
An agent is required on the target server, whatever the protocol
Filtering only takes effect if the target server carries the matching agent: the CyberElements agent on RDS and HTML5 RDS servers, and the network filtering agent on SSH and HTML5 SSH servers. Without it, the rules entered here have no effect.
Tick Filter network connections to enable filtering, then provide for each rule:
| Field | Description |
|---|---|
| Target IP | Authorised IP address or host. IPv4 format validation. |
| Network mask | Optional. When empty, the rule applies to the target IP only. |
| Port | 0 by default: the rule applies to all ports. |
| Protocol | TCP, UDP or TCP and UDP. |
Click Add to insert the rule in the authorised networks list. Each rule can be removed individually.
Filtering semantics
If Filter network connections is ticked but no network is authorised, the user cannot connect to any network. Otherwise, only listed networks can be reached.
Click Validate to save the contract. The Groups, Sites and Applications tabs are all mandatory, otherwise the contract is rejected.
Edit a contract¶
Select the contract in the list then click the Properties icon, or double-click the row. The window is identical to the creation one, pre-filled with current values.
Delete a contract¶
Select one or more contracts then click the × button. Deletion requires confirmation.
Export contracts¶
The Export button downloads all displayed contracts in a CSV file. The exported data reflects current filters (search, etc.).
File structure¶
The file holds one header row, then one row per contract. Columns appear in the following order:
| # | Column | Content | Mandatory on import |
|---|---|---|---|
| 1 | Alerts | Labels of the alert profiles. | |
| 2 | Categories | Names of the application categories. | |
| 3 | Description | Free text. | |
| 4 | Groups | User groups, in the form group@domain. |
Yes |
| 5 | Name | Contract name. | Yes |
| 6 | Applications | Names of the allowed applications. | |
| 7 | Restricted applications | Names of the applications placed behind a workflow. | |
| 8 | Access conditions | Names of the access conditions. | |
| 9 | Sites | Names of the sites. | Yes |
| 10 | Request a form | True or False. |
|
| 11 | Filter network connections | True or False. |
|
| 12 | Network connections | Filtering rules, in the form ip/mask:port:protocol. |
|
| 13 | Revealable aliases | Alias names. | |
| 14 | Revealable password rotation aliases | Alias names. | |
| 15 | Revealable dynamic aliases | Alias names. | |
| 16 | Personal aliases | Names of the applications for which personal aliases are allowed. |
Syntax¶
| Element | Separator | Example |
|---|---|---|
| Columns | ; |
Name;Description;… |
| Multiple values inside one cell | + |
Accounting+Management+Support |
| User group | @ between the group and its domain |
Accounting@AD-Internal |
| Every group of a domain | all keyword |
all@AD-Internal |
| Network filtering rule | / then : |
10.0.0.5/255.255.255.0:3389:TCP — a port set to 0 means "every port" |
| Booleans | — | True or False; an empty cell counts as False |
Volume
The export is capped: beyond a maximum number of rows set on the platform, only the first contracts are written to the file.
Import contracts¶
The Import button opens a window where a CSV file can be uploaded. Its structure must be the one described in section Export contracts: the safest route is to start from an export and edit it.
| Field | Description |
|---|---|
| File | CSV file to import. |
| Record delimiter | The column separator, ; for a file produced by the export. |
| Value delimiter inside a field | The separator for multiple values, + for a file produced by the export. |
The Name, Groups and Sites columns are mandatory: a row missing one of them is rejected. Referenced values (applications, categories, access conditions, alerts, aliases, sites) must already exist and are matched by name.
After validation, a window summarises the import result for each contract in the file.