Policy Server Guides › Policy Server Configuration Guide › Global Policies, Rules, and Responses › Global Policies

Global Policies

Standard CA SiteMinder® policies are created in the context of a single policy domain. However, large production environments may contain thousands of domains. In this type of environment it can be useful to define types of behavior (represented by policies) that are common for many domains. Using standard policies, the same policy must be recreated for each domain that requires the same behavior. Global policies allow you to configure policies (and their associated rules and responses) as system level objects, that are applied across all domains.

The following terms are used for discussing global policies:

Access Rule

An access rule allows or denies access to a resource. Global policies do not include access rules. Only event rules may be added to global policies.

Event Rule

An event rule is invoked when an authentication or authorization event occurs. Behaviors that are commonly implemented across all domains are associated with event rules, and may be included in global policies.

Global Policy

A policy which is defined as a system object.

Global Rule

A rule which is defined as a system object.

Global Response

A response which is defined as a system object.

Policy Link

A logical entity used for policy definition. It consists of a rule- response pair. A policy may contain one or more policy links.

More information:

Policies

Authentication Events

Authorization Events

Global Policy Object Characteristics

The following sections discuss the characteristics of global policy objects, outlining the basic similarities and differences when compared to their standard (nonglobal) counterparts.

Global response compared to standard response

Differences:

• Defined at the system level. Only system level administrators can define a global response.
• Cannot use variables-based attributes.
• Used in any global or domain-specific policies.
• Associated with the specific agent type.
• Cannot be added to response groups. There are no global response groups.

Similarities:

• Can use active expressions.
• Is only returned if it is specified in a particular policy.

Global rule compared to standard rule

Differences:

• Defined at the system level. Only system level administrators can define a global rule.
• The filter for the global rule is not bound to a specific realm. The filter for the global rule is an absolute filter, which may or may not use a regular expression.
• Bound to a specific agent or agent group. The agent is explicitly specified when the rule is created.
• Available only for CA SiteMinder® agents. You cannot associate a global rule with a RADIUS Agent because RADIUS Agents do not support authentication and authorization events.
• Only defined for an authentication or authorization event.
• Only used in global policies.
• Cannot be added to rule groups. There are no global rule groups.
• Can fire for resources on any domain for which global policy processing is enabled.

Global policy compared to standard policy

Differences:

• Defined at the system level. Only system level administrators can define a global policy.
• Bound to all users. Specific users cannot be included or excluded from a global policy.

  Note: Individual domains can be explicitly enabled or disabled for global policy processing.

• Defined using only global rules, global responses, and groups of these global objects.
• Cannot use variable-based attributes or variable expressions.
• Cannot contain allow/deny access rules. Only event rules may be included in a global policy.
• Cannot include or exclude a particular resource/realm from the global policy. The global policy is applicable to all resources that match at least one of the rule filters defined for the policy, on the domain for which global policy processing is enabled.
• Are not supported through the Java Policy Management API.

Similarities:

• Can use active expressions.
• Associated with the specific Agent. However, it is possible to create a group containing all the Agents of the same type and bind a global rule to such group.

When the global policy is processing, the responses that are defined for the fired global rules are added to the list of other responses. A global rule fires when the following conditions are true:

• The resource being accessed matches the absolute resource filter that is defined for the global rule.
• The event that occurs is as defined for the global rule.
• The resource being requested is protected by the same agent/agent group, which was specified for the rule.
• The resource/realm being accessed belongs to a domain for which global policies processing is enabled.

Important! The standard policy takes precedence over the global policy if Global policies processing is enabled for the domain and both standard rule and global rule are bound to the same agent or agent group.

More information:

Disable Global Policy Processing for a Domain

SiteMinder Global Policy Concept

CA SiteMinder® uses a policy-based access control model. A CA SiteMinder® policy defines the type of access a user has to a particular resource and what happens when the user accesses the resource. Each standard CA SiteMinder® policy is a linkage between a set of users and a set of resources, and is designed to protect resources by binding together users, rules and responses. Every policy must specify the users or groups of users to which the policy applies. Users can be either included or excluded from the policy.

In addition, a standard policy must contain at least one rule or rule group. Rules are the parts of a policy that determine precisely which resources are protected and what type of action should cause a rule to fire. A rule identifies a resource or resources that are included in the policy using a combination of a string-based resource filter and action. The filter in turn consists of realm filter and rule filter. For information about realms, rules, and responses in standard CA SiteMinder® policies, see the following:

• Configure a Realm
• Rule Groups
• Rules
• Responses and Response Groups
• Policies

CA SiteMinder® objects can be of two types: system level and domain level. In a standard (non-global) CA SiteMinder® policy, all policy objects must be created in the context of a specific domain. However, global policies are system level policies that may be applied across all domains in a CA SiteMinder® deployment. An administrator with system level privileges can define global policies, that include global rules and global responses. These global policies may be applied to any resource in any domain.

Global objects are similar to their standard, domain-specific counterparts. The roles of global objects in a global policy definition are different from domain-specific policy objects in the way they are created and linked to form policies. However, there are no global domain or global realm objects.

More information:

Policies Explanation

Global Policy Processing

Policies are evaluated as described in Policy Processing. In addition, any global rules contained in global policies will fire if the following conditions are met:

• The requested resource belongs to a domain on which global policy processing was not disabled
• The requested resource matches the absolute resource filter defined for the global rule. It is important, that in the case of global rule the filter will be obtained from the rule (not from the realm).
• The event that occurs is the same as that defined for the global rule.
• The requested resource is protected by the same agent or agent group, which was specified for the rule.

Whenever an authentication or an authorization event happens the responses defined for the fired global rules are added to the list of other responses.