Creating a policy based on user credentials - PingDataGovernance - 8.2

PingDataGovernance
bundle
pingdatagovernance-82
ft:publication_title
PingDataGovernance
Product_Version_ce
PingDataGovernance 8.2
category
Product
pdg-82
pingdatagovernance
ContentType_ce
  • PingDataGovernance
  • Release Notes
  • PingDataGovernance Server 8.2.0.8 release notes
  • PingDataGovernance Server 8.2.0.7 release notes
  • PingDataGovernance Server 8.2.0.6 release notes
  • PingDataGovernance Server 8.2.0.5 release notes
  • PingDataGovernance Server 8.2.0.3 - March 2021
  • PingDataGovernance Server 8.2.0.2 - February 2021
  • PingDataGovernance Server 8.2.0.1 - January 2021
  • PingDataGovernance Server 8.2.0.0 - December 2020
  • Critical fixes
  • Known issues and limitations
  • Previous releases
  • PingDataGovernance Server 8.1.0.5 release notes
  • PingDataGovernance Server 8.1.0.3 Release Notes
  • PingDataGovernance Server 8.1.0.2 Release Notes
  • PingDataGovernance Server 8.1.0.1 Release Notes
  • PingDataGovernance Server 8.1.0.0 Release Notes
  • PingDataGovernance Server 8.0.0.5 release notes
  • PingDataGovernance Server 8.0.0.3 Release Notes
  • PingDataGovernance Server 8.0.0.2 Release Notes
  • PingDataGovernance Server 8.0.0.1 Release Notes
  • PingDataGovernance Server 8.0.0.0 Release Notes
  • PingDataGovernance Server 7.3.0.10 release notes
  • PingDataGovernance Server 7.3.0.9 Release Notes
  • PingDataGovernance Server 7.3.0.8 Release Notes
  • PingDataGovernance Server 7.3.0.7 Release Notes
  • PingDataGovernance Server 7.3.0.6 Release Notes
  • PingDataGovernance Server 7.3.0.5 Release Notes
  • PingDataGovernance Server 7.3.0.4 Release Notes
  • PingDataGovernance Server 7.3.0.3 Release Notes
  • PingDataGovernance Server 7.3.0.2 Release Notes
  • PingDataGovernance Server 7.3.0.1 Release Notes
  • PingDataGovernance Server 7.3.0.0 Release Notes
  • Introduction to PingDataGovernance
  • Getting started with PingDataGovernance (tutorials)
  • Using the tutorials
  • Tutorial: Importing default policies
  • Introduction to the Trust Framework and default policies
  • Tutorial: Configuring fine-grained action access control for an API
  • Configuring a reverse proxy for the Meme Game API
  • Testing the reverse proxy
  • For further consideration: The PingDataGovernance API security gateway, part 1
  • Adding a policy for the Create Game endpoint
  • For further consideration: The PingDataGovernance API security gateway, part 2
  • Testing the policy from the Policy Administration GUI
  • Testing the policy by making an HTTP request
  • For further consideration: Decision Visualiser
  • Modifying the rule for the Create Game endpoint
  • For further consideration: Resolvers and value processors
  • Conclusion
  • Tutorial: Configuring attribute-based resource access control for an API
  • Configuring the API security gateway
  • Creating the gateway API endpoint
  • Testing the gateway
  • Creating a policy based on user credentials
  • Creating a service for the Shared Answers endpoint
  • Creating a policy for the Shared Answers endpoint
  • Testing the policy
  • Creating an attribute from user data
  • Adding logic to allow non-Youngstown users
  • Testing that the policy blocks Youngstown users
  • Creating a policy based on the API response
  • Creating an attribute from response data
  • Adding logic to allow family-friendly memes
  • Testing that the policy blocks Youngstown users from viewing age 13+ memes
  • Allowing unrated memes
  • Testing the default value
  • Creating an advice to provide a more useful error message
  • Testing the advice
  • Conclusion
  • Tutorial: Creating SCIM policies
  • Tutorial: Creating the policy tree
  • Tutorial: Creating SCIM access token policies
  • Creating a policy for permitted access token scopes
  • Testing the policy with cURL
  • Defining the email scope
  • Testing the email scope with cURL
  • Defining the profile scope
  • Testing the profile scope with cURL
  • Defining the scimAdmin scope
  • Adding the scimAdmin retrieve rule
  • Adding the scimAdmin create/modify rule
  • Adding the scimAdmin search rule
  • Adding the scimAdmin delete rule
  • Creating a policy for permitted OAuth2 clients
  • Testing the client policy with cURL
  • Creating a policy for permitted audiences
  • Testing the audience policy with cURL
  • Tutorial: Creating a policy for role-based access control
  • Testing the policy with cURL
  • Example files
  • Conclusion
  • Installing PingDataGovernance
  • Docker installation
  • Before you install using Docker
  • Docker
  • Browsers
  • Installing the server and the Policy Administration GUI using Docker
  • Installing the server using Docker
  • Signing on to the Administrative Console (Docker installation)
  • Installing PingDataGovernance Policy Administration GUI using Docker
  • Post-setup steps (Docker installation)
  • Signing on to the PingDataGovernance Policy Administration GUI
  • Configuring an Authentication Server for OpenID Connect single sign-on
  • Next steps
  • Manual installation
  • Before you install manually
  • System requirements
  • Platforms
  • Java Runtime Environment
  • Browsers
  • About license keys
  • Installing a Java dedicated to PingDataGovernance
  • Preparing a Linux environment
  • Setting the file descriptor limit
  • Setting the maximum user processes
  • Disabling file system swapping
  • Managing system entropy
  • Enabling the server to listen on privileged ports
  • Obtaining the installation packages
  • Installing the server and the Policy Administration GUI manually
  • Installing the server manually
  • About the server installation modes
  • Installing the server interactively
  • Installing the server noninteractively
  • Signing on to the Administrative Console (manual installation)
  • Installing PingDataGovernance Policy Administration GUI manually
  • Installing the PingDataGovernance Policy Administration GUI interactively
  • Example: Installing and configuring the PingDataGovernance Policy Administration GUI
  • Installing the PingDataGovernance Policy Administration GUI noninteractively
  • Example: Set up the PingDataGovernance Policy Administration GUI in demo mode
  • Example: Set up the PingDataGovernance Policy Administration GUI in OIDC mode (PingFederate)
  • Example: Set up the PingDataGovernance Policy Administration GUI in OIDC mode (generic OpenID Connect provider)
  • Post-setup steps (manual installation)
  • Signing on to the PingDataGovernance Policy Administration GUI
  • Changing the Policy Administration GUI authentication mode
  • Configuring an Authentication Server for OpenID Connect single sign-on
  • (Optional) Configuring PingDataGovernance using server profiles
  • Variable substitution
  • Layout of a server profile
  • setup-arguments.txt
  • dsconfig/
  • server-root/
  • server-sdk-extensions/
  • variables-ignore.txt
  • server-root/permissions.properties
  • misc-files/
  • Workflows
  • Creating a server profile
  • Installing a new environment
  • Scaling up your environment
  • Rolling out an update
  • Clustering and scaling
  • Next steps
  • Upgrading PingDataGovernance
  • Upgrade considerations
  • Docker upgrades
  • Upgrading PingDataGovernance Server using Docker
  • Upgrading the PingDataGovernance Policy Administration GUI using Docker
  • Manual upgrades
  • Upgrading PingDataGovernance Server manually
  • Reverting an update
  • Upgrading the PingDataGovernance Policy Administration GUI manually
  • Backing up policies
  • Upgrading the Trust Framework and policies
  • Uninstalling PingDataGovernance
  • PingDataGovernance Server Administration Guide
  • Running PingDataGovernance
  • Starting PingDataGovernance Server
  • Running PingDataGovernance Server as a foreground process
  • Starting PingDataGovernance Server at boot time (Unix/Linux)
  • Starting PingDataGovernance Server at boot time (Windows)
  • Registering PingDataGovernance Server as a Windows service
  • Running multiple service instances
  • Deregistering and uninstalling services
  • Log files for services
  • Starting PingDataGovernance Policy Administration GUI
  • Stopping PingDataGovernance Server
  • Stopping PingDataGovernance Policy Administration GUI
  • Restarting PingDataGovernance Server
  • About the API security gateway
  • Request and response flow
  • Gateway configuration basics
  • API security gateway authentication
  • API security gateway policy requests
  • Policy request attributes
  • Gateway API Endpoint configuration properties that affect policy requests
  • Path parameters
  • Basic example
  • Advanced example
  • API security gateway HTTP 1.1 support
  • About error templates
  • Configuring error templates example
  • About the Sideband API
  • API gateway integration
  • Sideband API configuration basics
  • Authenticating to the Sideband API
  • Creating a shared secret
  • Deleting a shared secret
  • Rotating shared secrets
  • Customizing the shared secret header
  • Authenticating API server requests
  • Sideband API policy requests
  • Policy request attributes
  • Sideband API Endpoint configuration properties
  • Path parameters
  • Path parameters: Basic example
  • Path parameters: Advanced example
  • Request context configuration
  • Access token validation
  • Error templates
  • Example: Configure error templates
  • About the SCIM service
  • Request and response flow
  • SCIM configuration basics
  • About the create-initial-config tool
  • Example: Mapped SCIM resource type for devices
  • SCIM endpoints
  • SCIM authentication
  • SCIM policy requests
  • Policy request attributes
  • About SCIM searches
  • SCIM search policy processing
  • Search request authorization
  • Search response authorization
  • Using paged SCIM searches
  • Lookthrough limit
  • Disabling the SCIM REST API
  • About the SCIM user store
  • Defining the LDAP user store
  • Defining the LDAP user store with create-initial-config
  • Defining the LDAP user store manually
  • Location management for load balancing
  • Automatic backend discovery
  • Joining a PingDataGovernance Server to an existing PingDirectory Server topology
  • Joining a topology at setup
  • Joining a topology with manage-topology
  • Configuring a load-balancing algorithm with an LDAP external template
  • Configuring automatic backend discovery
  • LDAP health checks
  • Configuring a health check using dsconfig
  • Connecting non-LDAP data stores
  • About the PDP API
  • Request and response flow
  • Requests
  • Authorization
  • Decision processing
  • Responses
  • Example
  • Policy Administration GUI configuration
  • Specifying custom configuration with an options file
  • Example: Configure policy configuration keys
  • Example: Configure a key store for a policy information provider
  • Example: Configure a trust store for a policy information provider
  • Example: Use environment variables
  • Manage policy database credentials
  • Setting database credentials at initial setup
  • Changing database credentials
  • Specifying database credentials when you start the GUI
  • Docker: Setting the initial database credentials
  • Docker: Changing database credentials
  • Configuring SpEL Java classes for value processing
  • Setting the request list length for Decision Visualizer
  • Policy administration
  • About the Trust Framework
  • Create policies in a development environment
  • Example: Configure external PDP mode
  • Example: Change the active policy branch
  • Default and example policies
  • Importing and exporting policies
  • Loading a policy snapshot
  • Exporting a policy snapshot
  • Exporting a deployment package
  • Use policies in a production environment
  • Example: Define policy configuration keys
  • Example: Define a policy information provider key store for MTLS
  • Example: Define a policy information provider trust store
  • Policy database backups
  • Restore a policy database from a backup
  • Use signed deployment packages
  • Example: Configure signed deployment packages for healthcare
  • Environment-specific Trust Framework attributes
  • Example
  • Define the policy information provider in the Trust Framework
  • Define policy configuration keys in a development environment
  • Define policy configuration keys in a preproduction environment
  • Make a user's profile available in policies
  • Advice types
  • Add Filter
  • Combine SCIM Search Authorizations
  • Denied Reason
  • Exclude Attributes
  • Filter Response
  • Include Attributes
  • Modify Attributes
  • Modify Headers
  • Modify Query
  • Modify SCIM Patch
  • Regex Replace Attributes
  • Access token validators
  • About access token validator processing
  • Access token validator types
  • PingFederate access token validator
  • JWT access token validator
  • Handling signed tokens
  • Example: Use a locally configured trusted certificate
  • Example: Use the issuer's JWKS endpoint
  • Handling encrypted tokens
  • Mock access token validator
  • Third-party access token validator
  • External API gateway access token validator
  • Token resource lookup methods
  • Server configuration
  • Administration accounts
  • About the dsconfig tool
  • PingDataGovernance Administrative Console
  • About the configuration audit log
  • About the config-diff tool
  • Certificates
  • Replacing the server certificate
  • Preparing a new keystore with the replacement key pair
  • Using an existing key pair
  • Replacing the certificate associated with the original key pair
  • Importing earlier trusted certificates into the new keystore
  • Updating the server configuration to use the new certificate
  • Replacing the key store and trust store files with the new ones
  • Retiring the previous certificate
  • Configure the Policy Decision Service
  • Configure a user store
  • Configure access token validation
  • Configure PingOne to use SSO for the PingData Administrative Console
  • Examples: Configuring PingDataGovernance Server
  • Configuring the PingDataGovernance user store
  • Configuring the PingDataGovernance OAuth subject search
  • Configuring PingDataGovernance logging
  • Server status
  • Server availability
  • User Store Availability gauge
  • Endpoint Average Response Time (Milliseconds) gauge
  • HTTP Processing (Percent) gauge
  • Example: auto-healing
  • Available gauges
  • Common alarms
  • Managing monitoring
  • Profiling server performance using the Stats Logger
  • Enabling the Stats Logger
  • Configuring multiple Periodic Stats Loggers
  • Logging HTTP performance statistics using a Periodic Stats Logger
  • StatsD monitoring endpoint
  • Sending metrics to Splunk
  • Managing HTTP correlation IDs
  • About HTTP correlation IDs
  • Enabling or disabling correlation ID support
  • Configuring the correlation ID response header
  • How the server manages correlation IDs
  • Server SDK support
  • Example: HTTP correlation ID
  • Command-line tools
  • Available command-line tools
  • Saving options in a file
  • Creating a tools properties file
  • Evaluation of command-line options and file options
  • Sample dsconfig batch files
  • Running task-based tools
  • Capture debugging data
  • Exporting policy data
  • Enable detailed logging
  • Policy Decision logger
  • Debug Trace logger
  • Debug logger
  • Visualizing a policy decision response
  • Capture debugging data with the collect-support-data tool
  • About the layout of the PingDataGovernance Server folders
  • About the layout of the PingDataGovernance Policy Administration GUI folders
  • PingDataGovernance Policy Administration Guide
  • Getting started
  • Version control (Branch Manager)
  • Creating a new top-level branch
  • Creating a subbranch from a commit
  • Importing a branch
  • Deleting a branch
  • Merging branches
  • Reverting changes
  • Committing changes
  • Generating snapshots
  • Partial snapshot export and merging
  • Creating a partial export
  • Merging a partial snapshot
  • Creating a deployment package
  • Deleting a deployment package
  • Trust Framework
  • Domains (PDP API only)
  • Services
  • Resources
  • Policy information providers
  • Common settings
  • HTTP services
  • LDAP services
  • Camel services
  • Attributes
  • Creating an attribute
  • Attribute name, description, and location
  • Resolvers
  • Resolver types
  • Conditional resolvers
  • Value processing for a resolver
  • Attribute caching
  • Value processing for an attribute
  • Value settings
  • Attribute interpolation
  • Actions
  • Identity classifications and IdP support
  • Identity properties
  • Identity providers
  • Identity classifications
  • Named conditions
  • Value processing
  • Chained processors
  • Testing
  • Policy management
  • Policy sets, policies, and rules
  • Policies and policy sets
  • Creating policies and policy sets
  • Adding targets to a policy
  • Conditional targets (applies when)
  • Advice
  • Provided advice
  • Custom advice
  • Properties
  • Rules and combining algorithms
  • Rule structure
  • Testing
  • Analysis of policies and policy sets
  • Repeating policies and attributes
  • Policy solutions
  • Use case: Using consent to determine access to a resource
  • Getting a path component from the request URL
  • Getting the requestor identifier from the access token
  • Searching for consent by resource owner to requestor
  • Getting consent status from the consent record
  • Creating a policy to check consent and then permit or deny access
  • Use case: Using consent to change a response
  • Creating a policy to check consent and then change the server response
  • Use case: Using a SCIM resource type or a policy request action to control behavior
  • Getting the SCIM resource type and the action being executed
  • Creating a policy to permit or deny the creation of resources
  • Creating a policy to control the set of actions for a specific resource
  • Creating a policy to restrict the ability to delete based on resource type
  • Creating a policy to modify a resource differently based on the SCIM resource type
  • Restricting the attributes that can be modified
  • Allowing attributes to be modified
  • Whitelisting attributes
  • Test Suite
  • Advice types
  • Add Filter
  • Combine SCIM Search Authorizations
  • Denied Reason
  • Exclude Attributes
  • Filter Response
  • Include Attributes
  • Modify Attributes
  • Modify Headers
  • Modify Query
  • Modify SCIM Patch
  • Regex Replace Attributes
  • REST API documentation
  • Legal Information
Page created: 6 Sep 2020 |
Page updated: 9 Feb 2021
| 1 min read

8.2 PingDataGovernance Product Administration User task Product documentation Content Type Data Governance Capability

This tutorial describes how to create a policy that acts on information about the user.

Back to home page