Managing access policies through APIs

{
    "name": "policy_name",
    "description": "Description of the policy",
    "schemaVersion": "urn:access:policy:4.0:schema",
    "rules": [
        {
            "name": "allow_with_conditions",
            "id": "1",
            "conditions": {
                "contextAttributes": {
                    "attributes": [
                        {
                            "name": "attrName",
                            "values": [
                                "value1",
                                "value2"
                            ],
                            "opCode": "EQ"
                        }
                    ]
                },
                "subjectAttributes": {
                    "attributes": [
                        {
                            "name": "realmName",
                            "values": [
                                "cloudIdentityRealm",
                                "www.ibm.com"
                            ],
                            "opCode": "IN"
                        },
                        {
                            "name": "customAttr1",
                            "values": [
                                "val1"
                            ],
                            "opCode": "NEQ"
                        }
                    ]
                },
                "timeAttributes": {
                    "attributes": [
                        {
                            "name": "timezone",
                            "opCode": "EQ",
                            "values": [
                                "UTC Offset or GMT Offset"
                            ]
                        },
                        {
                            "name": "startDate",
                            "opCode": "EQ",
                            "values": [
                                "YYYY-MM-DD HH:mm:ss"
                            ]
                        },
                        {
                            "name": "endDate",
                            "opCode": "EQ",
                            "values": [
                                "YYYY-MM-DD HH:mm:ss"
                            ]
                        },
                        {
                            "name": "Monday",
                            "opCode": "EQ",
                            "values": [
                                "hh:mm-hh:mm"
                            ]
                        },
                        {
                            "name": "Tuesday",
                            "opCode": "EQ",
                            "values": [
                                "hh:mm-hh:mm"
                            ]
                        }
                    ]
                },
                "ipAddress": {
                    "opCode": "MATCH",
                    "values": [
                        "<ip_address>",
                        "<ip_address_range_start> - <ip_address_range_end>",
                        "<ip_address/subnet>"
                    ]
                },   
                "location": {
                    "attributes": [
                        {
                            "values": [
                                "3-Letter-ISO"
                            ],
                            "name": "country",
                            "opCode": "IN"
                        }
                    ]
                }
                  "location": {
                      "attributes": [
                          {
                              "values": [
                                  "<city>"
                              ],
                              "name": "city",
                              "opCode": "IN"
                        }
                    ]
                }
                "geoLocation": {
                    "enabled": "true"
                },
                "trusteer": {
                    "enabled": "true"
                }
            },
            "result": {
                "extendedAction": {
                    "action": "ACTION_ALLOW"
                },
                "authnMethods": []
            }
        },
        {
            "name": "Authentication factor validity",
            "id": "2",
            “alwaysRun”: true,
            "conditions": {
            "factorLifetimeAttributes": {
                "attributes": [
                {
                    "name": "anyFactor",
                    "opCode": "EQ",
                    "values": [
                       "120"
                     ]
                }, 
                {
                      "name": "reauthPerDevice",
                      "opCode": "EQ",
                      "values": [
                         "enabled"
                       ]
                  }

               ]
            }
       },
       "result": {
        "extendedAction": {
          "action": "ACTION_MFA_OVERRIDE"
        }
       }
        },
        {
            "name": "mfa_once_per_session_device_conditions",
            "id": "3",
            "contextAttributes": {
                "attributes": [
                    {
                        "name": "devicePlatform",
                        "values": [
                            "IOS",
                            "ANDROID",
                            "OTHER_MOBILE",
                            "MACOS",
                            "WINDOWS",
                            "OTHER_DESKTOP"
                        ],
                        "opCode": "IN"
                    },
                    {
                        "name": "deviceCompliance",
                        "values": [
                            "COMPLIANT",
                            "NONCOMPLIANT",
                            "UNKNOWN"
                        ],
                        "opCode": "IN"
                    }
                ]
            },
            "result": {
                "extendedAction": {
                    "action": "ACTION_MFA_PER_SESSION"
                },
                "authnMethods": [
                    "urn:ibm:security:authentication:asf:macotp"
                ]
            }
        },
        {
            "name": "deny_otherwise",
            "id": "100",
            "conditions": {},
            "result": {
                "extendedAction": {
                    "action": "ACTION_DENY"
                },
                "authnMethods": []
            }
        }
    ]
}

• Each rule consists of these properties:

  name

  A name for the rule.

  id

  The unique ID for the rule that is used in event data and reports.

  conditions

  More than one condition can be present per rule. All conditions in the rule must evaluate to true for the rule to match and the result to be applied. The default rule contains an empty condition.

• The conditions contain the following properties:

  contextAttributes

  The attributes that are contextual to the flow in which the access policy was run. These attributes include Device management, OpenID Connect, and HTTP request attributes.

  subjectAttributes

  The login session attributes that are associated with the authenticated user subject.

  factorLifetimeAttributes

  Associate validity with a specific authentication factor or method.

  timeAttributes

  The time of the day attributes that enable time-based access control.

  ipAddress

  The IP address condition that enables individual, range, or subnet-based allow and blocklists .

  location

  The Country or City that is resolved from the user's IP address. Country must contain a comma-separated list of the country name or three letter country codes based on the following ISO standard. A single country or three letter country code is allowable.

  City must contain a comma-separated list of the city name. A single city is allowable.

  geoLocation

  The locations where access decisions were verified. The default setting is for the previous five verified locations. The condition property is either enabled (true) or disabled (false).

  trusteer

  IBM Security Trusteer detects the first-time access of new devices for users.

• The attributes contain the following properties:

  name

  A name of the attribute.

  values

  The values of the attribute.

  opCode

  The operator.

• The operators for the evaluation of attribute values:

  EQ

  All of the values are present.

  NEQ

  None of the values are present.

  IN

  One or more of the values are present.

  MATCH

  The ipAddress condition opCode for matching IP addresses, ranges, or subnets.

  NOMATCH

  The ipAddress condition opCode for non-matching IP addresses, ranges, or subnets.

• The result contains the following properties:

  Action

  Specifies what action to trigger when the conditions are met. Valid values are:

  • ACTION_ALLOW
  • ACTION_MFA_ALWAYS - MFA every time the rule is matched during access policy evaluation.
  • ACTION_MFA_PER_SESSION - MFA once per authenticated session and allow if already completed.
  • ACTION_DENY.

  authnMethods

  Specifies the allowable authentication mechanisms when the action is a multi-factor authentication (MFA). urn:ibm:security:authentication:asf:macotp - allow the user to select any mechanism they can complete, or one or more of the following factors:

  • emailotp - email one-time password
  • smsotp - SMS one-time password
  • totp - Time-based one-time password (authenticator app)
  • signatures - IBM® Verify app push notification
  • passkey - passkey authenticator
  • voiceotp - Verbal one-time password sent to the user's registered phone number.
  • anyFactor – is an alias for urn:ibm:security:authentication:asf:macotp. This mechanism is used especially in the factorLifetime condition and represents any valid authentication mechanisms that are completed by the user.