--- title: Policy enforcement description: The following procedure gives an example of how to request and enforce policy decisions from Identity Cloud. component: pinggateway version: 2023.11 page_id: pinggateway:identity-cloud-guide:pep canonical_url: https://docs.pingidentity.com/pinggateway/2026/aic/pep.html llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2024-09-18T11:50:37Z keywords: ["Single sign-on (SSO)", "Security", "Authorization", "Policy"] superseded_by: https://docs.pingidentity.com/pinggateway/2026/aic/pep.html section_ids: pep-cdsso: Enforce a simple policy stepup-session: Step up authorization for a transaction --- # Policy enforcement The following procedure gives an example of how to request and enforce policy decisions from Identity Cloud. ## Enforce a simple policy Before you start, set up and test the example in [Cross-domain single sign-on](cdsso.html). 1. Set up Identity Cloud: 1. In the Identity Cloud admin UI, select [icon: open_in_new, set=material, size=inline] Native Consoles > Access Management. The AM admin UI is displayed. 2. Select [icon: key, set=fa]Authorization > Policy Sets > New Policy Set, and add a policy set with the following values: * Id : `PEP-CDSSO` * Resource Types : `URL` 3. In the new policy set, add a policy with the following values: * Name : `CDSSO` * Resource Type : `URL` * Resource pattern : `*://*:*/*` * Resource value : `http://app.example.com:8081/home/cdsso` This policy protects the home page of the sample application. 4. On the Actions tab, add an action to allow HTTP `GET`. 5. On the Subjects tab, remove any default subject conditions, add a subject condition for all `Authenticated Users`. 2. Set up IG: 1. Replace `cdsso-idc.json` with the following route, and correct the value for the property amInstanceUrl: * Linux * Windows ``` $HOME/.openig/config/routes/pep-cdsso-idc.json ``` ``` %appdata%\OpenIG\config\routes\pep-cdsso-idc.json ``` ```json { "name": "pep-cdsso-idc", "baseURI": "http://app.example.com:8081", "condition": "${find(request.uri.path, '^/home/cdsso')}", "properties": { "amInstanceUrl": "https://myTenant.forgeblocks.com/am" }, "heap": [ { "name": "SystemAndEnvSecretStore-1", "type": "SystemAndEnvSecretStore" }, { "name": "AmService-1", "type": "AmService", "config": { "url": "&{amInstanceUrl}", "realm": "/alpha", "agent": { "username": "ig_agent", "passwordSecretId": "agent.secret.id" }, "secretsProvider": "SystemAndEnvSecretStore-1", "sessionCache": { "enabled": false } } } ], "handler": { "type": "Chain", "config": { "filters": [ { "name": "CrossDomainSingleSignOnFilter-1", "type": "CrossDomainSingleSignOnFilter", "config": { "redirectEndpoint": "/home/cdsso/redirect", "authCookie": { "path": "/home", "name": "ig-token-cookie" }, "amService": "AmService-1" } }, { "name": "PolicyEnforcementFilter-1", "type": "PolicyEnforcementFilter", "config": { "application": "PEP-CDSSO", "ssoTokenSubject": "${contexts.cdsso.token}", "amService": "AmService-1" } } ], "handler": "ReverseProxyHandler" } } } ``` Note the following feature of the route compared to `cdsso-idc.json`: * The CrossDomainSingleSignOnFilter is followed by a PolicyEnforcementFilter to enforce the policy `PEP-CDSSO`. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | When `verificationSecretId` is not configured, IG discovers and uses the AM JWK set to verify the signature of AM session tokens. If the JWK set isn't available, IG does not verify the tokens. | 1. Test the setup: 1. Go to . If you have warnings that the site is not secure respond to the warnings to access the site. IG redirects you to Identity Cloud for authentication. 2. Log in to Identity Cloud as user `demo`, password `Ch4ng3!t`. Identity Cloud redirects you back to the request URL, and IG requests a policy decision. Identity Cloud returns a policy decision that grants access to the sample application. ## Step up authorization for a transaction Before you start, set up and test the example in [Enforce a simple policy](#pep-cdsso). 1. In the Identity Cloud admin UI, select [icon: code, set=material, size=inline] Scripts > Auth Scripts > New Script > Journey Decision Node > Next, and add a default Journey Decision Node Script script called `TxTestPassword`: ```javascript /* - Data made available by nodes that have already executed are available in the sharedState variable. - The script should set outcome to either "true" or "false". */ var givenPassword = nodeState.get("password").asString() if (givenPassword.equals("7890")) { outcome = "true" } else { outcome = "false" } ``` 2. Configure a journey: 1. Click [icon: account_tree, set=material, size=inline] Journeys and add a journey with the following configuration: * Name: `Tx01_Tree` * Identity Object: `Alpha realm users` The journey canvas is displayed. 2. In Nodes > Basic Authentication, drag a Password Collector node onto the canvas. 3. In Nodes > Utilities, drag a Scripted decision node onto the canvas. 4. Configure the scripted decision node as follows: * Script: select `TxTestPassword` * Outcomes: enter `true` and `false` 5. Connect the nodes as shown: ![Authentication journey](_images/auth.jpg) For information about configuring trees, refer to [ForgeRock Identity Cloud Docs](https://docs.pingidentity.com/pingoneaic/latest/home.html) 3. Edit the authorization policy: 1. In the Identity Cloud admin UI, select [icon: open_in_new, set=material, size=inline] Native Consoles > Access Management. The AM admin UI is displayed. 2. Select [icon: key, set=fa]Authorization > Policy Sets > PEP-CDSSO, and add the following environment condition to the `CDSSO` policy: * `All of` * Type: `Transaction` * Script name: `Authenticate to tree` * Strategy Specifier: `Tx01_Tree` 4. Test the setup: 1. In a browser, go to . If you have not previously authenticated to Identity Cloud, the CrossDomainSingleSignOnFilter redirects the request to Identity Cloud for authentication. 2. Log in to Identity Cloud as user `demo`, password `Ch4ng3!t`. 3. Enter the password `7890` required by the script `TxTestPassword`. Identity Cloud redirects you back to the request URL, and IG requests a policy decision. Identity Cloud returns a policy decision based on the authentication journey.