Add access control rules

In Enterprise Center for Enterprise Application Access you can create an access control rule to block or deny access to an application based on the criteria listed in the below table.

Access control typeDescription
URLThe web address or path requested by the user.

Note: This access control type is available with HTTP/HTTPS applications only.

GroupThe group that a user belongs to.
UserThe username assigned to the user
MethodAn HTTP method such as GET, POST, PUT, DELETE, HEAD, OPTIONS, TRACE, CONNECT, or an Other method for any custom method that is used for the application.
Client IPThe IP address of the client that you want to restrict
CountryThe country where you want to prevent the user from accessing the application.
TimeThe days of the week and the exact times (based on time zone) that you want to restrict access.

Note: This access control type is available with HTTP/HTTPS applications only.

App HostThe hostname of the application server. Applies to tunnel-type client-access applications only.
App PortThe port number of the application server. Applies to tunnel-type client-access applications only.
App ProtocolSelect TCP or UDP protocol. Applies to tunnel-type client-access applications only.
Device Risk TierSet the risk tier to Medium or High, High, or Unmanaged levels.

Note: Available only if you have access to Device Posture.

Device Risk TagSet the risk tag to iOS Device, Windows PC, Browser, OS, or CS Status Check.

Note: Available only if you have access to Device Posture.

For every rule you create, you select the access control type, an operator, and then define the values for the selected type. You can choose whether an operator is or is not is restricted as a control type.

These conditions also apply to rules:

  • By default, access control rules are disabled for an application. You must enable the feature and then configure the rules and the criteria you require.
  • A rule can contain one criterion or multiple criteria. The criteria you provide in a rule are combined with an AND operator. For example, with the following criteria, the conditions are combined to block User A from accessing the application from 1am to 2 am on a Saturday.

ACL Rule 1

  • If multiple rules are created for an application, these rules are combined with the OR operator. This allows you to use the same control types in multiple expressions and ensure there is no conflict.

For example, as shown in the Figure, if User A attempts to access the application between 1 am and 2 am or 11 pm and 12 am EST on a Saturday, they are denied access.

ACL Rule 1

ACL Rule 2

After you save the rules, the combined rule appears as:

ACL Rules combined

  • The criteria you create in a rule are combined with an AND operator. This means that all conditions are applied to deny access. If you configure multiple rules, the rules are applied with an OR operator to ensure that if any of the conditions in a rule apply, access to an application is denied.
  • Access control rules are not applied to an application until you deploy the application. If you make changes to the access control rules, after an application is deployed, you must re-deploy the application for the new rules to apply.

When a user is denied access as a result of an access control rule, by default, an HTTP 403 Forbidden error message appears. See Application response codes, login events, and errors.

ūüďė

Note

Using ACL with custom URL or custom access denied page, is not supported if you use Device Posture Risk Tier or Risk Tag in your ACL.

  1. Log in to Enterprise Center.

  2. In the Enterprise Center navigation menu, select Application Access > Applications > Applications.

  3. Locate the application you want to configure ACL for.

  4. Click Access tab, enable Access option.

a. To create a new rule, click Add Rule (+).

b. To edit an existing rule, click Edit Rule.
A modal window appears.

  1. Enter a name for the rule and click Add.

  2. Select a Type for the ACL. See Access Control Type table above.

  3. In Operator select either isor is not.

  4. In Value enter the value if applicable or select the value for the access control type.

    a. Click Time to configure the time-based settings.

    b. In Start Time and End Time enter a time in hh:mm, AM-PM format.

    c. In time zone select a timezone.

    d. Select the days of the week that you want to deny access.

    e. Click Save Rule (‚úď).
    The rule appears as Access Control in the Services column.

  5. To add another criterion to the rule click Add Criteria (+), and repeat the above steps.

  6. To delete the rule, click the Delete Rule (trash icon), and click Delete.

  7. To edit the rule, click the Edit Rule (pencil icon), and make the edits, and click Save Rule.

  8. Click Back to Configuration Services, and save these changes.

  9. Click Save and Deploy, to make these changes to go into effect.