Adding Groovy script rules - PingAccess

Page created: 26 Jul 2021 |

Page updated: 14 Jan 2022

| 2 min read

7.0 PingAccess Product IT Administrator Administrator Audience Product documentation Content Type Administration User task Web Access Management Access security Capability API Access Management API Security

Add a Groovy script rule to provide advanced rule logic that extends PingAccess rule development beyond the capabilities of the packaged Policy Manager rules.

Note:

Through Groovy scripts, PingAccess administrators can perform sensitive operations that might affect system behavior and security. Since the regular Groovy rule and the OAuth Groovy rule differ in the scope of their functionality, the relevant rules are tagged for Web App or for API, respectively, in the rules list.

For more information about error handling, see Advanced Fields.

Click Access and then go to Rules > Rules.
Click + Add Rule.
In the Name field, enter a unique name, up to 64 characters long.

Special characters and spaces are allowed.
From the Type list, select Groovy Script (for Web App).
Enter the Groovy script to use for rule evaluation.

To create an OAuth scope rule that matches more than one scope, your Groovy script might contain: hasScopes("access","portfolio").
Optional: To configure rejection handling, click Show Advanced Settings, then select a rejection handling method:
- If you select Default, use the Rejection Handler list to select an existing rejection handler that defines whether to display an error template or redirect to a URL.
- If you select Basic,, you can customize an error message to display as part of the default error page rendered in the end user's browser if rule evaluation fails. This page is among the templates you can modify with your own branding or other information. If you select Basic, provide this information:
  1. In the Error Response Code field, enter the HTTP status response code to send if rule evaluation fails. The default is 403.
  2. In the Error Response Status Message field, enter the HTTP status response message to send if rule evaluation fails. The default is Forbidden.
  3. In the Error Response Template File field, enter the HTML template page for customizing the error message that displays if rule evaluation fails. This template file is located in the <PA_HOME>/conf/template/ directory.
  4. From the Error Response Content Type list, select the type of content for the error response. This lets the client properly display the response.
If you select Basic, you can customize an error message to display as part of the default error page rendered in the end-user's browser if rule evaluation fails. This page is among the templates you can modify with your own branding or other information. If you select Basic, provide this information:
Click Save.