Configuring Authorization Policy Conditions/Rules in OAM 11G R2PS2

Authorization Policy : Creating Condition/Rules

Basically if you are aware of the SSO thing, than you must know that once you are authenticated than you are checked for - WHETHER YOU ARE AUTHORIZED OR NOT.
And what does that means?

It means that if you are allowed to log in to the system than it needs to be checked that whether you are authorized to access the resource or not.

Generally we have Authorization Policy for Protected & Public Resources. But we can also specify our conditions & rules for these authorization policies.

So now the question arises what's the use of these condition & rules?

• Basically we can add our condition to allow or deny the user to access the resource.
• And thus we need to add these condition to the rules for allow or denial access.

Remember - You can create your condition & rules for each of the authorization policies created for the webgate profile. Their is no constraint of only single condition or so.

In this post we will be creating a condition for IP Range, for other condition soon i will be posting a new post.

Pre-Requisites:

• Webgate Profile is created.
• Working Webgate Instance is in place i.e. webgate is integrated with your server say OHS
• And You can properly access a protected resource.

Let's see how to configure Authorization policy:

1) Log in to oamconsole: http://host:port/oamconsole

2) Go to Application Domain -> Select Webgate Profile -> Go to Authorization policy

• Note: I will be adding condition with my Protected Authorization Policy
• By default there is just one condition added 'TRUE' which is also available in the Rules.
• This is allowable condition, & TRUE in all sense.

•  Now we will be adding a new condition, and this will be for IP Range testing.

• Apply the changes
• Now once it is added, than we need to add a condition in it. In the above step we have just created a condition entry, now we will be adding a condition to it.

• Here i will be adding a IP Range - i am blocking the IP Addresses starting from 10.0.0.0 to 10.255.255.255. Any IP Address coming for authorization having IP Range b/w this mentioned series. It will be not be able to access the resource.

 

• We need to add this condition in the rules table. You can see that we have 2 types of rule:
• Allow Rule
• Deny Rule

• Here we will be adding the condition in the 'deny rule' table.

• Apply the changes & we are good to go.
• Note: 
• We need not to restart the server instance, because the changes are done at the OAM Server side and as webgate talks to OAM via OAP/NAP connection. Thus OAM Server will tell the webgate about access or denial via this NAP only. That's why no restart required.
• But remember that in case we have done changes in the webgate profile, than server restart is a must.

• Lets test this by accessing the Protected Resource URL. And my ip address starts with 10.* series. Thus i will be getting a resource denial message.
• Access the resource. http://host:port/index.html
• Provide the credentials

•  Eureka....!!!! Did you see, we get the denial message for the resource index.html.

We are done with the Authorization IP Range Condition/Rules Testing....... Soon i will be adding the use cases for other condition tests as well....


Enjoy :-)