How to Write Access Condition in HENNGE Access Control (Modern view)

ip4:{{CIDR notation specification}} : If the user is accessing from the specified global IP address, it will be judged as "allowed".

@{{IP Sets ID}}@ : If the access is from an IP address within the specified IP Sets, it will be considered as "allowed".

※ CIDR Reference Information : Classless Inter-Domain Routing

※ IPv6 is currently not supported.

For information on how to create an IP Sets, please refer to the following help site.

Create an IP Sets

【Example 1】

ip4:1.1.1.1

If the user's source global IP address attempting to log in is 1.1.1.1, it will be judged as "allowed".

【Example 2】

ip4:1.1.1.1/25

If the user's source global IP address attempting to log in is within the range of 1.1.1.1/25, it will be judged as "allowed".

※ "/32" can be omitted.

【Example 3】

@office_tokyo@

If the global IP address of the user attempting to log in falls within the range of IP addresses registered under office_tokyo, it will be considered as "allowed".

※ Not available in the setting item [Conditions to allow legacy authentication] of Access Policy Group.

device_cert:none : If accessed without using HENNGE Device Certificate, it will be judged as "allowed".
device_cert:any : If accessed using any type of HENNGE Device Certificate (personal, shared, passwordless), it will be judged as "allowed".
device_cert:personal : If accessed using a personal type of HENNGE Device Certificate, it will be judged as "allowed".
device_cert:shared : If accessed using a shared type of HENNGE Device Certificate, it will be judged as "allowed".
device_cert:passwordless : If accessed using a passwordless type of HENNGE Device Certificate, it will be judged as "allowed".

※ Not available in the setting item [Conditions to allow legacy authentication] of Access Policy Group.

hsb:{{true / false}}

【Example】

hsb:true

If accessed using HENNGE Secure Browser, it will be judged as "allowed".

※ Not available in the setting item [Conditions to allow legacy authentication] of Access Policy Group.

has_pass:{{true / false}}

【Example】

has_pass:true

If the user's browser has been issued an admission pass, it will be judged as "allowed".

※ Not available in the setting item [Conditions to allow legacy authentication] of Access Policy Group.

has_pass_within:{{number of days}}

【Example】

has_pass_within:30

If the user's browser has an admission pass cookie issued within 30 days of login attempt, it will be judged as "allowed".

login_name:{{HENNGE Access Control username}} : If a specific username logs in, it will be judged as "allowed".

【Example】

login_name:hacadmin@example.com

If the username of the user attempting to log in is "hacadmin@example.com", it will be judged as "allowed".

time:HHmm-HHmm:TZ

※ Includes both ends of the specified time range.

※ If ":TZ" (time zone) is omitted, the time zone defaults to UTC.

【Example】

time:0900-1800:Asia/Tokyo

If the login time of the user attempting to log in is from 9:00 to 18:00 Japan time, it will be judged as "allowed".

date:YYYYMMDD-YYYYMMDD:TZ
date:MMDD-MMDD:TZ

※ Includes both ends of the specified time range.

※ If ":TZ" (time zone) is omitted, the time zone defaults to UTC.

【Example】

date:20200101-20200131:Asia/Tokyo

If the login time of the user attempting to log in is from January 1, 2020, to January 31, 2020, Japan time, it will be judged as "allowed".

day:{{English abbreviated day of the week}}:TZ

※ English abbreviated day of the week : sun, mon, tue, wed, thu, fri, sat

※ If ":TZ" (time zone) is omitted, the time zone defaults to UTC.

【Example】

day:wed:Asia/Tokyo

If the login time of the user attempting to log in is on Wednesday Japan time, it will be judged as "allowed".

attribute:(ATTRIBUTE_IDENTIFIER):"(Value)"

You can use custom attributes to control access.

You can add them to access condition expressions in the following format:

(ATTRIBUTE_IDENTIFIER) is set to the ID specified when creating the custom attribute.
For information on creating custom attributes, see the following help site:

Creating custom attributes

Editing custom attributes

Set the value of the custom attribute to be specified as an access condition in (Value).

【Example】

If "custom_user_attribute" is set as the ID of the custom attribute, and you want to allow access for users with the value [ allowed_user ] in that attribute

attribute:custom_user_attribute:"allowed_user"

and : If the access situation matches both left and right condition expressions, it will be judged as "allowed".

【Example】

ip4:1.1.1.1 and device_cert:any

If the access source global IP address is 1.1.1.1 and at the same time using HENNGE Device Certificate for access, it will be judged as "allowed".

or : If either of the left or right condition expressions matches the access situation, it will be judged as "allowed".

【Example】

ip4:1.1.1.1 or ip4:2.2.2.2

If the access source global IP address is either 1.1.1.1 or 2.2.2.2, it will be judged as "allowed".

【Example】

ip4:1.1.1.1 or device_cert:any

If the access source global IP address is 1.1.1.1 or using HENNGE Device Certificate, it will be judged as "allowed".

not : Negates the result of the condition expression following it. (not true is "denied", not false is "allowed".)

【Example】

not ip4:1.1.1.1

If the access source global IP address is not 1.1.1.1, it will be judged as "allowed".

() : Encloses the part in parentheses and performs the calculation of the condition expression listed preferentially.

【Example】

(ip4:1.1.1.1 or ip4:2.2.2.2) and device_cert:any

In HENNGE Access Control, first calculate (ip4:1.1.1.1 or ip4:2.2.2.2) , and use the result to perform the final result calculation of the remaining condition expression and device_cert:any. For example, if a user accesses with a global IP address of 1.1.1.1 and uses HENNGE Device Certificate, it will be ("true" or "false") and "true", resulting in "allowed".