This article consists of instructions on how to properly configure and customise the settings in Access Control Admin Console in order to best suit the environment of your organisation.

There are three parts of settings in Access Control Admin Console: System settings, User settings, and Secure Browser Settings. As for this particular article, only the User settings will be explained. The System settings and Secure Browser Settings can be found in separate documents.

This Admin Console guide is consists of two components:

1) Users
2) Access Policy Groups

1) Users 

☆ 1 - Log in to your Access Control Admin Console, 

https://ap.ssso.hdems.com/admin/yourdomain

☆ 2 - Click on the "Users" and you will be able to see the interface for all user settings. 

☆ 3 - To add a New User, click on the "New User" button as shown as below:

☆ 4 - In the "Add New User" interface, there is a number of information that is required as shown as below:

☆ 5 - To edit an existing User, click on the "Edit" button as shown as below:

☆ 6 - In the "Edit User" interface, there is a number of information that is required as shown as below:

☆ 7 - To register/update a number of users at once, please click "Batch registration / update" button as shown as below.

☆ 8 - In the "Batch registration / update" interface, you are required to upload a TSV file that contains the user information :

☆ 9 - The following is the sample spreadsheet you can create accordingly to create, update or delete multiple users at once.

The followings are the columns from A to H:

The followings are the columns from I to M:

After inputting the information in a correct manner, you shall upload the .tsv file using the interface below.

☆ 10 - To download the user list from Access Control, click on the "Download(TSV)" button as shown as below:

☆ 11 - To delete user, simply click on the "Delete" icon.

☆ 12 - Additional Info For Microsoft 365.

- All operations related to users shall be done using Access Control Admin Console NOT on Microsoft 365.

- The operations such as Creating, Updating and Deleting users on Access Control will be synchronised with Microsoft 365 periodically (1 hour). 

- For new user creation on Access Control and synchronised to Microsoft 365, the system admin may need to fill in additional information such as:

(i) Assigning Microsoft 365 License:

(ii) Fill in "Job title", "Department" and etc.:

2) Access Policy Groups 

☆ 1 - Log in to your Access Control Admin Console, 

https://ap.ssso.hdems.com/admin/yourdomain

☆ 2 - Click on the "Access Policy Groups" and you will be able to see the interface for all Access Policy Groups settings. To add a New Access Policy Group, click on the "New Access Policy Group" button or to configure an existing Access Policy Group, click on the edit button button as shown as below:

☆ 3 - The Access Policy Group configuration interface is as shown as below:

☆ 4 - Here are the breakdowns of each component in the Access Policy Group and its options for configuration.

(a) Display Name : The Display Name of the Access Policy Group. 

(b) Cookie Expires : The timespan (hour) to keep login state and allow user to log in without password when user checks "Remember this login" while logging on. Default is 168 which means 1 week. When set to 0, keeps login state until the browser window is closed.

(c) Condition to allow access : When enabled, the users are allowed to access ONLY IF they meet the specified condition inputted. 

(d) Condition not to require OTP : When enabled, the users are allowed to access without being required to input One-Time Password ONLY IF they meet the specified condition inputted. In other words, the users who do not meet the specified condition will be required to input One-Time Password during the login process.

*This rule is recommended to improve security for the users that are accessing the service from an untrusted network or device.

(e) Condition to change OTP secret : When enabled, the users are allowed to setup/change the OTP for smartphone using the Access Control User Console ONLY IF they meet the specified condition inputted.

(f) Condition to change OTP notification email: When enabled, the users are allowed to setup/change OTP via email using the Access Control User Console ONLY IF they meet the specified condition inputted.

(g) Condition to access to secure browser control panel : When enabled, the users are allowed to access to HENNGE Secure Browser Settings using the Access Control User Console ONLY IF they meet the specified condition inputted.

(h) Condition to change unread email check target : When enabled, the users are allowed to change unread email check target ONLY IF they meet the specified condition inputted.

(i) Condition to allow Desktop/Mobile application access : When enabled, the users are allowed to access via specific applications for Desktop and Mobile ONLY IF they meet the specified condition inputted.

The following list is consists of the available types of condition: 

(a) To allow or deny : true / false

To authorise or restrict the users from the Access Policy Group to perform certain action, simply insert true or false into the condition field.

For the example below, "false" is inputted to restrict any user to "change OTP notification email" in the Access Control User Console.

(b) To specify And/Or condition : and / or

To add two or more conditions into the condition field, simply insert and / or in between the two conditions. "and" requires both conditions to be met and "or" requires only one condition to be met. 

For the example below, there are two conditions and are put together with "or" which is representing that "the user is allowed to access if one met either of the conditions".

(c) To exclude certain conditions : not 

"not" can be used to exclude certain conditions such as the example below, which Saturday and Sunday is excluded from the day of the week for the user to be allowed to access and the time range during weekdays that the users are allowed to access is from 10 a.m. to 8 p.m..

(d) To specify allowed network : ip4:xxx.xxx.xxx.xxx

To authorise or restrict the users from a specific network to gain access. Please note that this address has to be the public IP address of your targeted network.

(e) To allow specific user : login_name:Username

To authorise a particular user to gain access a specific control, please specify the username in the condition field as shown as below where the user with the username "billgates" is the only user that is allowed to access. "or false" defines that any other user will be restricted to access.

(f) To allow user with Pass-cookie : has_pass:true

To authorise a user with "Pass-cookie" to gain access, please input the line "has_pass:true" into the condition field such as below:

This condition specified that the users of this Access Policy Group have to either be connected to the network 123.123.123.123 or obtained the Pass-cookie from previous success logged in session.

(g) To allow user with Pass-cookie that was issued within a specific time period : has_pass_within:hours

To authorise a user with "Pass-cookie" that was issued within a specific time period to gain access, please input the line "has_pass_within:hours" with "hours" being the number of hours you desired to specify. 

This condition specified that the users of this Access Policy Group have to either be connected to the network 123.123.123.123 or obtained the Pass-cookie that was issued by the system within the past 30 hours.