Name

Specifies the name of the policy.

Enter the name.

Description

Describes the policy.

Enter the policy.

New Resources

Specifies the resources to which this policy applies.

Enter the resources.

Role application

Specifies the roles to which this policy applies.

Select one of the following options from the drop-down list:

• Policy applies to ALL roles—Applies this policy to all users.
• Policy applies to SELECTED roles—Applies this policy only to users who are mapped to roles in the selected roles list.
• Policy applies to all roles OTHER THAN those selected below—Applies this policy to all users except for those who map to the roles in the selected roles list.

Action

Allows or denies the Secure Access device to perform an access control check.

Select one of the following options from the drop-down list:

• Use SAML—Secure Access device performs an access control check to the specified URL.
• Do not use SAML—Secure Access device does not perform an access control check.
• Use Detailed Rules—Specifies one or more detailed rules for this policy.

SAML Web Service URL

Specifies the URL of the access management system’s SAML server.

Enter the URL, using the format:https://hostname/ws.

SAML Web Service Issuer

Specifies the hostname of the issuer, which in most cases is the hostname of the access management system.

Enter a unique string.

Authentication Type

Specifies the authentication method that the SAML Web service should use to authenticate the Secure Access device.

Select one of the following options from the drop-down list:

• None—Does not authenticate the Secure Access device.
• Username/Password—Authenticates the Secure Access device using a username and password.
• Certificate—Authenticates the Secure Access device using a certificate signed by a trusted certificate authority.

Username

Specifies the username that the Secure Access device must send the Web service.

Note: The username and password fields are displayed only when you select the Username/Password option from the Authentication Type drop-down list.

Enter the username.

Password

Specifies the password that the Secure Access device must send the Web service.

Enter the password

Certificate

Specifies the certificate installed on the Secure Access device to send to the Web service.

Note: This box is displayed only when you select Certificate option from the Authentication Type drop-down list.

Select the certificate installed on the Secure Access device from the drop-down list.

Subject Name Type

Specifies which method the Secure Access device and SAML Web service should use to identify the user.

Select one of the following options from the drop-down list:

• Other—Sends the username in another format agreed upon by the Secure Access device and the SAML Web service.
• DN—Sends the username in the format of a DN (distinguished name) attribute.
• Email Address—Sends the username in the format of an e-mail address.
• Windows—Sends the username in the format of a Windows domain qualified username.

Subject Name

Specifies the username that the Secure Access device should pass to the SAML Web service.

Enter the username.

Device Issuer

Specifies the hostname of the issuer, which in most cases is the hostname of the access management system.

Enter the hostname.

Maximum Cache Time (seconds)

Specifies the amount of time the Secure Access device should cache the responses (in seconds).

Enter the time.

Ignore Query data

Specifies that the Secure Access device should remove the query string from the URL before requesting authorization or caching the authorization response.

Select the Ignore Query data check box to enable this feature.

Role

Maps roles to access control policy resources.

Note: The Role tab is enabled only when you select Policy applies to SELECTED roles or Policy applies to all roles OTHER THAN those selected below from the Action drop-down list.

Select a role and click Add to add roles from the Non-members to the Members list.

Conditions

Specifies one or more expressions to evaluate to perform the action.

Specify one of the following options:

• Boolean expressions: Using system variables, write one or more Boolean expressions using the NOT, OR, or AND operators.
• Custom expressions: Using the custom expression syntax, write one or more custom expressions.