Chapter 8 Configuring URL Access Control

This chapter describes how to allow or deny access to the end-user from the Sun™ ONE Identity Server administration console. under SRA Configuration, Access List,. through the gateway for specific URLs.



Note	Click Documentation at the top right corner of the Identity Server administration console, and click SRA Help for a quick reference on all the Secure Remote Access attributes.

Select the Service Configuration tab from the administration console.

Click the arrow next to Access List under SRA Configuration.

The Access List page displays.

Set up a URL Deny List

Set up a URL Allow List

Manage Single Sign-On

Customize the Access List Interface



Note	When you install Secure Remote Access, the Access List service is not available to all users by default. This service is enabled only to the amadmin user that is created by default during installation. Other users will not be able to access the desktop through the gateway without this service. Log in as amadmin, and assign this service to all the users.

Set up a URL Deny List

You can specify the list of URLs that end-users cannot access through the gateway using this field.

To Set up the URL Deny List

Select the Service Configuration tab.

Click the arrow next to Access List under SRA Configuration.

The Access List page displays.

Specify the URL for which you want to deny access through the gateway in the URL Deny List field. The format for entering the URL is:

http://abc.siroe.com

Click Add.

The URL is added to the URL Deny List.

You can also use regular expressions such as http://*.siroe.com. In this case, users are denied access to all hosts in the siroe.com domain.

Click Save to record the changes.

Set up a URL Allow List

You can specify all the URLs that can be accessed by the end-user through the gateway. By default, this list has a wild card entry (*), which means that all URLs can be accessed. If you want to allow access to all URLs, and restrict access only to specific URLs, add the restricted URLs to the URL Deny List. In the same way, if you want to allow access only to specific URLs, leave the URL Deny List blank, and specify the required URLs in the URL Allow List.

To Set up the URL Allow List

Select the Service Configuration tab.

Click the arrow next to Access List under SRA Configuration.

The Access List page displays.

Specify the URL for which you want to allow access through the gateway in the URL Allow List field. The format for entering the URL is:

http://abc.siroe.com

Click Add.

The URL is added to the URL Allow List.



Note	The URL Allow List has a * by default which means that all URLs can be accessed through the gateway.

Click Save to record the changes.

Manage Single Sign-On

The Access List service in Secure Remote Access allows you to control the single sign-on feature for various hosts. But for the single sign-on feature to be available, the Enable HTTP Basic Authentication option in the gateway service must be enabled. See "Enable HTTP and HTTPS Connections".

With the Access List service, you can disable single sign-on for certain hosts. This means that an end user needs to authenticate each time to connect to the hosts that require HTTP basic authentication, unless you enable single sign-on per session.

If you have disabled single sign-on for a certain host, the user can reconnect to that host within a single Portal Server session. For example, assume that you have disabled single sign-on to abc.sesta.com. The first time the user connects to this site, authentication is required. The user may browse other pages and return to this page later, and if the page is in the same Portal Server session, authentication is not required.

A user can also configure these attributes using the limited administration console.

To Disable SSO for Hosts

Select the Service Configuration tab.

Click the arrow next to Access List under SRA Configuration.

The Access List page displays.

Specify the hosts for which you want to disable SSO in the Hosts for which SSO is disabled field.

Specify the host name in the format abc.siroe.com.

Click Add.

The hostname is added to the list.

Click Save to record the changes.

To Enable SSO per Session

Select the Service Configuration tab.

Click the arrow next to Access List under SRA Configuration.

The Access List page displays.

Select the Enable SSO per session checkbox to enable a single-sign on session.

Click Save to record the changes.

To Specify Authorization Levels

Select the Service Configuration tab.

Click the arrow next to Access List under SRA Configuration.

The Access List page displays.

Scroll to the AllowedAuth levels field.

Enter the allowed authorizations. Use an asterisk to allow all levels.

Click Save to record the changes.

Customize the Access List Interface

Edit the access list properties file to change the labels on the access list user interface in the Identity Server administration console. Edit the file: