Skip to main content
日本語 简体中文 繁體中文

Access Control Creating a New Access Policy Group

Target

  • Administrators who perform initial setup and operational management of HENNGE Access Control

Purpose

  • Explains the procedure for creating a new Access Policy Group in HENNGE Access Control.

Notes

  1. This article is based on product specifications as of November 2024 and is subject to change without notice.
  2. Administrator permissions for HENNGE Access Control are required for actual screen verification and configuration changes.
  3. For instructions on accessing the administration screen, please refer to the following article:
    Access Control Accessing the Administration Screen

Procedure

1. Access the [Access Control] - [Access Policy Group] in the left menu of the HENNGE Access Control administration screen.

2. Click [Add] in the upper right of the Access Policy Group screen.

3. Configure each item and click [Save].
※ Descriptions of each item are provided at the bottom of this article.

4. Assign the created Access Policy Group to users.
For assignment instructions, please refer to the following article:
Assigning Access Policy Groups to Users (Modern view)

Items (Base Configuration)

※ The displayed items may vary depending on the contract.
For information on Access Policy Templates, please refer to the following article:
Access Control Creating a New Access Policy Template

Name Description Notes
Display Name Name of the Access Policy Group Can be set up to 256 characters.
Authentication Cookie Expiration If [Keep me logged in] is checked on the login screen: Time to keep the login status using cookies in the browser

Except when manually logging out, the login status will be maintained within the set time even if the browser is restarted, etc.
※ Can be set up to a maximum of 9600 hours.
If left blank, logging out will occur when the browser is closed.
If [Keep me logged in] is not checked or displayed on the login screen: Maximum retention time for a user's login session If the set time is exceeded while continuously opening one page, logging in will be required again upon page transition.
※ If [Keep me logged in] is not checked or displayed, logging out will occur when the browser is closed.
Conditions for Allowing Access
  • Always allow: Allow all access
  • Allow when conditions are met: Allow access only from environments that meet the condition (select conditions from the Access Policy Template)
  • Never allow: Disallow all access

 
Conditions for Allowing Legacy Authentication
  • Always allow: Allow all access using legacy authentication
  • Allow when conditions are met: Allow only login requests using SAML ECP and Ws-Trust authentication that meet the specified conditions (select conditions from the Access Policy Template)
  • Never allow: Disallow all access
 Displayed only when integrated with Microsoft 365.

Items (One-Time Password Settings)

Name Description Notes
Conditions for not requiring OTP
  • Always allow OTP to be skipped: Does not require OTP
  • Allow OTP to be skipped when the following conditions are met: Does not require OTP when accessed from environments that meet the conditions
  • Always require OTP: Always requires OTP

 
Conditions for allowing OTP shared key changes
  • Always allow: Always allow OTP shared key changes
  • Allow when the following conditions are met: Allow OTP shared key changes only when accessed under specific conditions (select conditions from the Access Policy template)
  • Never allow: Never allow OTP shared key changes
 If you set the conditions for allowing OTP notification email address changes and these conditions are both set to "Never allow," the "OTP (One-Time Password) Settings" will not be displayed on the user screen.
Conditions for allowing OTP notification email address changes
  • Always allow: Always allow OTP notification email address changes
  • Allow when the following conditions are met: Allow OTP notification email address changes only when accessed under specific conditions (select conditions from the Access Policy template)
  • Never allow: Never allow OTP notification email address changes
 If you set the conditions for allowing OTP shared key changes to "Never allow," the "OTP (One-Time Password) Settings" will not be displayed on the user screen.

Item (Certificate Settings)

Name Description Notes
Conditions for displaying owned device certificates
  • Always allow: Always allow access to the client certificate screen
  • Allow when the following conditions are met: Allow access to the client certificate screen when accessed from environments that meet the conditions (select conditions from the Access Policy template)
  • Never allow: Access to the client certificate screen is never allowed

If access is not allowed, the "Client Certificate" menu will not be displayed in the upper right corner of the user portal.
Conditions for allowing device certificate revocation
  • Always allow: Always allow device certificate revocation
  • Allow when the following conditions are met: Allow device certificate revocation when accessed from environments that meet the conditions (select conditions from the Access Policy template)
  • Never allow: Device certificate revocation is never allowed
 To use this feature, "Conditions for displaying owned device certificates" must be allowed.

Item (HENNGE Secure Browser Settings)

Name Description Notes
Conditions for Allowing Access to Secure Browser Settings Screen
  • Always allow: Always allow access to the Secure Browser settings screen
  • Allow when the following conditions are met: Allow access to the Secure Browser settings screen when accessed from environments that meet the conditions (select conditions from the Access Policy template)
  • Never allow: Access to the Secure Browser settings screen is never allowed

 
Conditions for Allowing Display of Unread Email Check Settings Screen
  • Always allow: Always allow access to the Unread Check settings screen
  • Allow when the following conditions are met: Allow access to the Unread Check settings screen when accessed from environments that meet the conditions (select conditions from the Access Policy template)
  • Never allow: Access to the Unread Check settings screen is never allowed
  
Automatic Device Authentication Settings
  • Default: Use the settings in the Access Control Administration screen
  • Active: Automatically allow device authentication
  • Inactive: Manual device authentication by the administrator

You can check the default settings in [Domain Settings] - [Secure Browsers Related] - [General] - [Automatic Device Authentication].
For the procedure of manual device authentication when inactive, please refer to the following article.
Device Authentication for Secure Browsers

Items (Allowed Service Providers)

Set whether to allow access to services connected in the HENNGE Access Control Administration screen [System] - [Connected Services] or not.
※ Access to connected services with a checkmark will be allowed.