Policy

When logging in to SingleID or logging in to an application registered with SingleID, various settings such as login method, authentication session, and password must be set according to the organization’s security policy.

SingleID provides a policy management feature that allows for detailed settings for login and authentication information.
If you have purchased the anomaly detection feature (ADM), you can set it to analyze the user’s login behavior when logging in and alert the user to potential security threats when an unusual authentication is detected.

The policy features provided by SingleID are as follows:

• Login policy
• Authentication policy
• Anomaly detection policy
  

Using SingleID’s policy feature, you can specify a detailed login method according to who, when, and under what environment logs in to which application, creating a secure authentication environment that meets the organization’s security requirements.

Login Policy

The administrator can set a detailed policy on which authentication means can be used to authenticate when a user logs in to SingleID, and can create a conditional authentication policy for users authenticating in a specific environment if necessary.

Login policy can be configured using the following conditions:

• Which application is logging in?
• Who logs in?
• In what environment do they log in?

To access the login policy menu, navigate as follows:

• Admin Portal > Policies > Login Policy

Basic Login Policy

The Admin Portal has two default policies created as follows.

• Admin Portal Policy: Policy to control Admin Portal access rights
• Default Policy: Basic access control policy for users

The Admin Portal Policy is a login policy applied when logging in to the Admin Portal, and the Default Policy is a login policy applied when logging in to the user portal.

After integrating an application with SingleID, if no separate login policy is assigned, the Default Policy is automatically assigned as the basic login policy.

Registering a Login Policy

The login policy sets the login policy for administrators and users. You can set login policies based on access environment, application, and situation.

The login policy can be registered through a 4-step screen as follows:

1. General
2. Assignment
3. Initial Redirection
4. Rules

General

In the general screen, enter the name and description of the login policy.

The fields to be entered are as follows.

Click the Next button to move to the assignment screen.

Assignment

In the assignment screen, specify the application to which the login policy will be applied.

1. Click the Assign button to display the application assignment popup on the screen.
2. Application Assignment popup, select one or more applications to assign to the login policy and click the Assign button.
3. If all applications have been assigned, click the Cancel button to close the Application Assignment popup.

Initial Redirection

The Initial Redirection screen specifies the user’s login screen entry method and login method

• Redirected to SingleID’s Sign-in page (login page)

• Redirected to the external IdP

  
  

The explanations for the two methods are as follows:

• If Redirected to SingleID’s Sign-in page is selected, the SingleID login page will be displayed to the user attempting to log in.
• If Redirected to the external IdP is selected, the login page of the selected Identity Provider will be displayed to the user attempting to log in.
• After selecting Redirected to the external IdP, you must select and specify the Identity Provider from the selection list.
• If Redirected to SingleID’s Sign-in page is selected, you can optionally display a button at the bottom of the SingleID login screen that allows the user to log in through an Identity Provider.
• AND see the following external IdP buttons on the Sign-In page, you can set up the login screen to display by selecting one or more Identity Providers registered with SingleID in the text input box below and clicking the mouse.

Rules

On the Rules screen, you can modify or add login rules and set the priority between login rules.

Default Rule Setting

The login rule list on the rule screen displays the Default Rule by default.

The Default Rule cannot be deleted and can only be modified. Additionally, when one or more login rules are added, the priority cannot be set. (It is always the lowest priority.)

To modify the Default Rule, follow these steps:

1. Click on the Default Rule in the rule list.
2. The WHEN condition of the Default Rule cannot be modified.
3. The THEN result of the Default Rule can be modified.

• Deny Access
• Allow Access

If you select Deny Access, all user logins will be denied.

If you select Allow Access in the access permission setting, you can set the user’s login method.

Add Rule

To add a login rule, follow these steps:

1. Click the Register button at the top right of the rule list.
2. Enter the name and description of the rule on the rule registration screen.
3. Refer to the following to enter the rule items:

Access Environment

THEN Settings

THEN result area sets the login method and procedure.

In the access permission setting (a), you can select one of the following two options:

• Deny Access
• Allow Access Deny Access is selected, all user logins will be denied. (The default value of access permission setting (a) is Deny Access)

To allow users to log in and set detailed login methods, select Allow Access.

1. In the selection list of the primary login setting, select the Authenticator to be used for login.
2. If you want to allow the user to log in with another Authenticator in addition to the selected primary login method, select the checkbox (V) of And allow another factors below: and select one or more Authenticators in the text input box.

Click the Save button to register the login rule and return to the rule list.

Rule Priority Management

If one or more login rules have been added, the administrator can set the priority of the login rules. If a user meets the conditions set for multiple rules, the login method will be applied according to the rule with the higher priority.

To set the priority of the login rules, follow the procedure below.

1. Drag the ≡ area to the left of the rule name in the rule list with the mouse.
2. The priority of the login rules will be determined based on the position where they are dragged and dropped.
3. The higher the position in the rule list, the higher the priority.

Policy Status Change

The status of the login policy managed by SingleID is as follows.

Policy Deactivation

To deactivate an active login policy, follow these steps:

1. Click the policy you want to deactivate in the policy list to move to the policy details screen.
2. Click the Deactivate button.
3. Confirm the login policy information (the number of assigned applications, the number of rules included in the login policy) displayed in the Confirm popup, and then click the Deactivate button.

Policy Activation

To change the login policy from inactive to active, follow these steps:

1. Click on the policy you want to activate in the policy list to move to the policy details screen.
2. Click the Activate button to change the status of the login policy to active.

Policy Deletion

The administrator can delete the login policy from SingleID.

To delete a login policy, follow these steps:

1. Click on the policy you want to delete in the policy list to move to the policy details screen.
2. If the login policy is activated, click the Deactivate button to deactivate the policy.
3. Click the Delete button displayed at the top right of the deactivated login policy.
4. A popup screen will appear to confirm the deletion of the login policy.
5. To delete the login policy, confirm the policy information, enter the name of the policy you want to delete, and click the Delete button.

Access Simulation

As the number of login policies and rules increases, it can be difficult to understand which user is subject to which policy for login methods. SingleID provides an access simulation feature that allows administrators to quickly check the login policies and rules applied to users.

Using the access simulation feature, you can select a user and an application to access, and define the user’s login environment (network, device, browser, OS) to predict in advance what kind of login method the user will experience in different cases.

Additionally, if there are users who are having trouble logging in and need to review their requests, you can use the access simulation feature to quickly check and modify the policies or rules that are causing the problem.

To use the access simulation feature, click the Access Simulation button at the top right of the login policy list screen.

To run the access simulation, follow these steps:

1. Enter the ID of the user to be simulated.
2. Specify the IP of the user to be simulated. You can select Specific IP Address and enter the IP directly. Enter the IP in the format 123.123.123.123.
3. Specify the device information of the user to be simulated. You can select Platform and choose a device from the selection list.
4. Specifies the browser information of the user to be simulated. After selecting Browser, you can select a browser from the selection list.
5. Specifies the OS information of the user to be simulated. After selecting OS, you can select an OS from the selection list.
6. Click the Application Selection button to select the target application to be simulated.
7. In the Application Selection popup, click the radio button to the left of the application name to select the application, and then click the Add button.

Authentication Policy

The administrator may need to change the detailed settings related to authentication according to the organization’s security policy.

SingleID manages the detailed settings related to authentication in the following four policies:

• Session policy
• Authenticator policy
• MFA Service Provider policy
• Password policy

To access the authentication policy menu, move as follows:

• Admin Portal > Policy > Authentication Policy

To modify the authentication policy, click the Modify button at the bottom right of the authentication policy screen, change the settings, and then click the Save button.

Session Policy

To change the session policy, follow the procedure below:

1. Click the Modify button at the bottom right of the authentication policy screen.
2. Set the maximum number of sessions that a user can create at the same time in the maximum session limit setting.
3. The minimum value that can be set is 1, and the maximum value is 100. If set to 1, the user can only log in from one browser at a time and cannot log in from multiple PCs or browsers simultaneously.
4. In the session priority setting, you can set the priority of the session created by the user. The priority can be one of the following two options:
   • Old session
   • New session

If the maximum session limit is set to 1 and Old session is selected in the maximum session limit setting, when a logged-in user attempts to log in from another PC or browser that is not logged in, the login will be blocked.

Additionally, if the maximum session limit is set to 1 and New session is selected in the maximum session limit setting, when a logged-in user attempts to log in from another PC or browser that is not logged in, the session of the previously logged-in browser will be forcibly expired, and the session of the new PC or browser will be maintained.

In the maximum session time setting, you can set the maximum time to maintain a session.

The maximum session time can be one of the following two options:

• No time limit
• Set time limit

If set to No time limit, once a session is created, it will not expire automatically until the user logs out. If set to Set time limit and a time is set, the session will expire when the set time passes, and the user will be automatically logged out. In the maximum idle session time setting, you can set the maximum idle session time.

If the maximum idle session time is set, the session will expire if the user does not make an authentication request within the set time, and the user will be automatically logged out.

To save the changed settings, click the Save button at the bottom right of the authentication policy screen.

To discard the changed settings without saving, click the Cancel button at the bottom right of the authentication policy screen.

Authenticator Policy

To change the Authenticator policy, follow the procedure below.

1. Click the Edit button at the bottom right of the authentication policy screen.
2. Set each item as follows.
3. When the settings are complete, click the Save button.

MFA Service Provider Policy

To change the MFA Service Provider policy, follow the procedure below.

1. Click the Edit button at the bottom right of the authentication policy screen.
2. Refer to the table below and set each item accordingly.
3. When the settings are complete, click the Save button.

Password Policy

To change the password policy, follow the procedure below.

1. Click the Edit button at the bottom right of the authentication policy screen.
2. Refer to the table below and set each item accordingly.
3. When the settings are complete, click the Save button.

Membership registration policy

To allow user membership registration, you must activate the membership registration policy, which allows registration of users other than those provisioned from the personnel system or IdP. It provides features to register, create, modify, and delete accounts through account synchronization, as well as invite users through the login screen or email.

To activate and use the membership registration policy, follow these steps:

1. Admin Portal > Policy > Membership registration policy.
2. Activate Allow user membership registration.
3. After activation, the Policy tab and User invitation tab will appear.
4. Refer to the explanations of the Policy tab and User invitation tab below and set the policy.
5. Once the settings are complete, click the Save button.

Policy

You can set general membership registration policies.

Approval Policy

The administrator can select the approval system and set the policy according to the type, such as sign-up policy and app access policy, with various approval lines. Various approval policies can be applied flexibly whenever the security policy changes.

Approval is possible by dividing it into self-approval system function and Knox Portal approval system. If you need to link with another approval system, please request it through 1:1 inquiry.

To check the approval policy, follow the path below.

• Admin Portal > Policy > Approval Policy

Approval Policy List

The administrator can select the approval system and set the policy according to the type, such as sign-up policy and app access policy, with various approval lines. Various approval policies can be applied flexibly whenever the security policy changes.

Approval Policy Registration

Register button, you can set the approval system, type, approver, notification method, and approval period.

Anomaly Detection Policy

SingleID collects and analyzes user behavior information in real-time before and after authentication, determining whether the authentication is abnormal. If it is identified as an abnormal authentication category, it immediately notifies the user of the risk.

To access the anomaly detection policy menu, follow these steps:

• Admin Portal > Policy > Anomaly Detection Policy