Policy Server Guides › Policy Server Configuration Guide › Enterprise Policy Management › EPM Use Cases for Protecting Applications › Application Security Policies with User Mapping and Named Expressions

Application Security Policies with User Mapping and Named Expressions

In this use case, a retail clothing company wants to define a role preventing customers from making web-based credit purchases if they have exceeded their credit limit. The company policy dictates that customers have a $1,000 credit limit, while company employees may have a $2,000 credit limit.

You can create an application security policy using attribute mapping, named expressions (virtual user attributes and user classes) and roles to satisfy the company's credit policy.

Given:

• The SiteMinder environment contains two user directories.
• Directory A stores employees. Employees can also be customers. Therefore, Directory A identifies employees that are also customers that belong to:

  group:cn=Customers,ou=Groups,o=acme.com
  

• Directory B only stores customers. Directory B does not have a user attribute that identifies customers because to store a user in Directory B implies the user is a customer.

Solution:

1. Define an attribute mapping.
2. Establish a named expression.
3. Use the attribute mapping and expression to establish roles.
4. Create a response to further customize the application.
5. Create an application security policy.