This article presents example Authorization Policy configurations for some typical uses cases. For SSO Authorization Policy documentation, please refer to:

Manage authorization policies - SSO

Expression language API - SSO

These configuration examples have been tested with Ubisecure SSO 8.8.1.

Contents

User and method attributes

In a typical configuration, either user attributes (attributes from Ubisecure Directory, external LDAP directory or external SQL database) or method attributes (claims from external Identity Providers) are passed on to applications with the Authorization Policy configuration. Simple examples are shown below:

When external identities are mapped to Ubisecure identities (see Management UI Directory User Mappings - SSO and User driven federation - SSO), both user attributes and method attributes may be available. In this case, the method attributes can be accessed by using a local user group, typically eIDMUser, instead of a group configured for the Identity Provider. For example, name is taken form the local user directory and job title from an Azure AD claim as follows:

Single-value and multi-value attributes

By default, all attributes are processed as multi-value attributes. Attributes can be defined as single-value attributes on the main screen of the Authorization Policy configuration:

In JWT tokens, single-value attributes are passed as string values and multi-value attributes as string lists. Boolean and numeric values are converted to strings. Whenever an attribute is known to take only one value, it is recommended to define the attribute as a single-value attribute. Below, an example JWT is presented with a default configuration and with single-value attributes defined:

{
    "sub": "ubisecure.demo@example.com",
    "iss": "https://login.ubidemo.com:8443/uas",
    "amr": [
        "https://login.ubidemo.com:8443/uas/saml2/names/ac/password.2"
    ],
    "aud": [
        "0baaf7ce-8df8-4cb9-9ecc-de9a6e00a792"
    ],
    "azp": "0baaf7ce-8df8-4cb9-9ecc-de9a6e00a792",
    "auth_time": 1640871824,
    "iat": 1640871827,
    "exp": 1640875426,
    "session_index": "_208fb80205c891f3ec45cf4e5cd0379e403c211e",
    "email": [
        "ubisecure.demo@example.com"
    ],
    "family_name": [
        "Demo"
    ],
    "given_name": [
        "Ubisecure"
    ],
    "roles": [
        "services/RoleRequester",
        "eIDM/eIDMMainUser"
    ],
    "surname": "Demo"
}

{
    "sub": "ubisecure.demo@example.com",
    "iss": "https://login.ubidemo.com:8443/uas",
    "amr": [
        "https://login.ubidemo.com:8443/uas/saml2/names/ac/password.2"
    ],
    "aud": [
        "0baaf7ce-8df8-4cb9-9ecc-de9a6e00a792"
    ],
    "azp": "0baaf7ce-8df8-4cb9-9ecc-de9a6e00a792",
    "auth_time": 1640871518,
    "iat": 1640871524,
    "exp": 1640875124,
    "session_index": "_af24c0650721e4795ee796a2e567779ad846144a",
    "email": "ubisecure.demo@example.com",
    "given_name": "Ubisecure",
    "roles": [
        "services/RoleRequester",
        "eIDM/eIDMMainUser"
    ],
    "family_name": "Demo"
}

String value operations

String value attributes can be modified by using Java EL statements with Java String methods. Information on Java String methods can be found, for example, at https://www.w3schools.com/java/java_ref_string.asp. Some configuration examples are presented below:

String values can also be modified by using regular expressions with the re:replace function, for example as follows:

List value matching and filtering

Note: Ubisecure CustomerID SSO Adapter can also be used for filtering the roles, see Authorization configuration - CustomerID.

Typical claims presented as lists are users' role and group assignments. If there are a limited number of known groups or roles, and there is a need to filter out any other groups/roles, it is straightforward to use the contains function for filtering. This way the generic group/role names can also be mapped to application specific names when needed. Some examples are given below.

If the groups or roles are not known (for example, defined by an external Identity Provider) or there can be a big or unlimited number of them (for example, roles with organization name as prefix), a more generic way for filtering is required. In this case, Java EL streams can be used for matching and filtering the string lists. For more detailed information, please refer to Java EL documentation: https://download.oracle.com/otndocs/jcp/el-3_0-fr-eval-spec/index.html. Some example configurations are presented below.

List value modifications

For modifying string values within the lists, a new list can be created with the Java split function. In the examples below, we use split("&") for converting a string to a list with one element. Here we assume that the data does not contain any '&' characters.

Hashing and encoding examples

The following examples show hashing and encoding. Note data type requirements for hashing and encoding functions.

${base64:encode(utf8:bytes(user['uid'][0]))}

Role Based Access Control

The Ubisecure SSO Authorization Policies can be used for implementing Role Based Access Control (RBAC). With RBAC, only users having application specific role(s) assigned, are allowed to access the application. Other users see an error message which is configurable for each application.

Note: RBAC can be enforced either by Ubisecure SSO or by the application user is trying to access. When access is denied, it may be more straightforward to configure the application to give user-friendly instructions for requesting access rights. 

To enforce RBAC in Ubisecure SSO, define a required attribute on the main screen of the Authorization Policy configuration, for example "extranet-access":

Then use the "Attributes" tab to define the required attribute, for example as follows:

For instructions on defining application specific error messages and other user interface properties, please refer to:

Login user interface customization files - SSO
Show different help text depending on the application used