Policy Server Guides › Policy Server Configuration Guide › Policies › Specify AND/OR Relationships between Users/Groups

Specify AND/OR Relationships between Users/Groups

The AND Users/Groups check box lets you restrict authorization to users who are members of more than one user group or to a particular user who is a member of one or more user groups. When adding individual users and user groups in a user directory to a policy, you can specify AND relationships between them by selecting the check box. Alternately, you can specify OR relationships by clearing the check box.

When you specify AND relationships and apply the resulting policy to a user, the user must meet the following requirements to be authorized:

• The user must be a member of each user group that is bound to the policy.
• If an individual user is bound to the policy, the user must be that individual.

Important! Do not add two or more individual users to a policy and specify AND relationships. Because no single user can be more than one individual, the policy always fails.

To specify AND relationships between a user and one or more user groups or between multiple user groups in one user directory

1. Click the Users tab on the Policy pane.

   The User Directories pane opens, and each user directory is displayed in a separate group box.

2. Select the AND Users/Groups check box corresponding to each user directory for which you want to specify AND relationships.
3. Click Submit.

   The task is submitted for processing.