Conditional AccessEstimated reading time: 4 minutes
Conditional access is a feature to control and validate user provisioning via policies that act on the claims issued by your identity server. These are known as Conditional Access policies. Interject's identity server exposes an interface for allowing the provisioning of users in Interject via claims provided by third party identity providers.
Conditional Access policies at their simplest are if-then statements. That is, if a user wants access to Interject, then they must satisfy a condition.
- If a user wants access, then the user role should be within a list of available roles
- If a user wants access, then the user-name should end with @gointerject.com
- If a user wants access, then the user-name should be available in the list of valid users
- If a user wants access, then the user department should be within a list of available departments
Here are the various conditional checks available in the system:
- Not Equals
- Not Contains
- Ends With
- Starts With
- Regular Expression
All the conditional checks are against the user claims. Claims are key value pairs. We get these claims from external providers.
Note: Claim keys are not case sensitive.
Here are a few examples of user claims:
|Claim||Claim Key||Claim Value|
Here is an example of how the conditional rules mapping is applied:
Rule1: The user is allowed access only when the Claim value for http://schemas.microsoft.com/ws/2008/06/identity/claims/role (Role) is equal to 'Admin'
Rule2: The user is allowed access only when the Claim value for http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress (Email) is either firstname.lastname@example.org, email@example.com or firstname.lastname@example.org
Rule3: The user is allowed access only when the Claim value for http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress (Email) satisfies the regular expression. Regular expression will satisfy only when the user name ends with @gointerject.com
We can define any number of conditional access rules. If any of the rules fail, user access is restricted.
Configuring Conditional Access
To configure conditional access, provide us with the following for each rule you would like configured:
- Claim Key
- Claim Value
- Regular Expression (only required for Regular Expression condition)