Creating a policy to restrict the ability to delete based on resource type - PingAuthorize

Page created: 17 Feb 2022 |

Page updated: 29 Jul 2022

| 1 min read

Product PingAuthorize 9.1 Content Type Product documentation Administration

For a given resource type, restrict the ability to delete. In particular, the policy focuses on the delete action and then denies the action when the resource type is Devices.

In the Policy Editor, go to Policies in the left pane and then click Policies along the top.
From the + menu, select Add Policy.
For the name, replace Untitled with User cannot delete a Device resource.
Click the + next to Applies to.
Click Add definitions and targets, or drag from Components and add the delete action.
Set Combining Algorithm to Unless one decision is deny, the decision will be permit.
You should have a screen similar to the following one for the policy so far.
Add a rule to deny the deletion of Device resources.
1. Click + Add Rule.
2. For the name, replace Untitled with If the SCIM resource type is Device, then deny.
3. Set Effect to Deny.
4. Click + Comparison.
5. In the Select an Attribute list, select the SCIM2.resource.meta.resourceType attribute.
6. In the second field, select Equals.
7. In the third field, specify Devices as the constant.
8. Add advice to provide a custom message.
  1. Within the rule, click Show Advice and Obligations.
  2. Click + next to Advice and Obligations.
  3. Click + Add Advice > Denied Reason.
  4. For the name, specify denied-reason.
  5. Set Applies To to Deny.
  6. In the Payload field:
    - Remove
      
      Example:
    - Change
      
      Human-readable error message
      
      to
      
      System has restricted the ability to delete Device resources
9. Click Save changes.
  Your rule should be similar to the following one.
Send test requests to the SCIM service and verify data using the Policy Editor's Decision Visualiser.