topic Login access token security rule order in Management & Governance

Login access token security rule order

tmathijssen — Mon, 16 Apr 2018 08:41:49 GMT

Hi,

In what order will the allocation of a login access token be done by a security order?

Example:

- Two pools with each 10 tokens.

Security rule pool 1: Usergroup = Login access
Security rule pool 2: Usergroup = Login access and Dashboard = Employee

Do i need to specify anything to make sure that a user that has the Employee properties does not uses tokens from pool 1?

Re: Login access token security rule order

YoussefBelloum — Mon, 16 Apr 2018 09:17:10 GMT

Hi,

Maybe mto‌ or ltu‌ can take a look here ?

Re: Login access token security rule order

dwforest — Mon, 16 Apr 2018 17:16:13 GMT

I've not seen a way to prioritize rules. I'd guess they'd evaluate in the order defined or possibly to the most restrictive.

Personally, I define my rules to be explicit so there is no question of some getting (or not getting) what they are supposed to.

Re: Login access token security rule order

Levi_Turner — Tue, 17 Apr 2018 18:01:38 GMT

Hey Tom,

Yes, I'd expect so.

On my end, I have the following rules:

Pool 1: ((user.userId like "*"))

Pool 1: ((user.userId like "*" and user.name like "*"))

When simulating users, the users use tokens from Pool 1.

So something like Usergroup = Login access AND Dashboard != Employee seems like a valid strategy (may need to experiment with user.dashboard.Empty() potentially).

Hope that helps.

Re: Login access token security rule order

tmathijssen — Wed, 18 Apr 2018 07:32:12 GMT

Levi,

So i need to make sure that no overlap in the security rules exists.

Re: Login access token security rule order

Levi_Turner — Wed, 18 Apr 2018 15:25:29 GMT

Yes, in this scenario with License Rules. If you want to ensure that a rule will not be evaluated as true to ensure that that pool isn't touched then the schema is:

A AND NOT B
A AND B