Policy Server Guides › Policy Server Configuration Guide › Rules › Configure a Rule for Authorization Event Actions

Configure a Rule for Authorization Event Actions

Authorization events occur after a user is authenticated. You configure a rule for authorization to let SiteMinder call responses based on whether a user is or is not authorized for the requested resource. When the user has been granted or denied access based on their privileges, the appropriate event is triggered.

The realm in which the rule is to be created must be able to process authorization events. Ensure that the Process Authorization Events option is selected in the Advanced group box of the Realm pane.

To create a rule

1. Click Policies, Domains.
2. Click Rule, Create Rule.

   The Create Rule: Select Domain pane opens.

3. Select a domain from the Domain list, and click Next.

   The Create Rule: Select Realm pane opens.

4. Select the realm that includes the resources that you want the rule to protect, and click Next.

   The Create Rule: Define Rule pane opens.

   Note: If a realm does not exist for the resources that you want to protect, a rule cannot be created to protect those resources.

5. Type the name and a description of the rule in the fields on the General group box.

   Note: Click Help for descriptions of settings and controls, including their respective requirements and limits.

6. Type the resource the rule is to protect in the Resource field.

   The Effective Resource updates to include the resource.

7. Select the Authorization events radio button in the Action group box.

   The Action List populates with authorization events.

   Note: The Allow Access and Deny Access options are disabled. These options do not apply to authorization events.

8. Select one or more authorization events from the Action List.
9. (Optional) Set time restrictions and/or an active rule in the Advanced group box.
10. Click Submit.

    The rule is saved and applied to the specified realm and resource.

More information:

Authorization Events

Configure a Realm

Regular Expressions for Resource Matching

Advanced Rule Options

Policy Considerations for OnAccessReject Rules

Consider how the Policy Server processes global policies and the special circumstances created by OnAccessReject rules when creating global rules that include OnAccessReject events.

An OnAccessReject rule will not fire if it is in the same policy as a GET / POST rule. When a user is authenticated, SiteMinder resolves the identity of the user. Therefore, if the OnAccessReject rule and the GET / POST rule are in the same policy, then a user who is allowed access to a resource is the same user who should be redirected on an OnAccessReject event. Since the user is allowed access, the reject event never applies.

To resolve this discrepancy, create a separate policy for the OnAccessReject rule, which may include other event rules, and specify the users for which it should apply.

For example, in an LDAP user directory, User1 should have access to a resource and everyone else in the group, ou=People, o=company.com, should be redirected to an OnAccessReject page. Two policies are required:

Policy1

Includes a GET / POST rule that allows access for User1.

Policy2

Includes the OnAccessReject rule and a Redirect response, and specifies the group ou=People, o=company.com.

Since User1 is authorized, the OnAccessReject rule will not fire when User1 access the resource. However, the OnAccessReject rule will fire for all other users in the group, ou=People, o=company.com, because they are not authorized to access the resource.