Policy

Add Dormant User Policy #User Lifecycle Management #Conditional Authentication Policy –>

When logging into SingleID or logging into an application registered with SingleID, various settings such as login methods, authentication sessions, and passwords need to be configured according to the organization’s security policy.

SingleID provides a policy management feature that allows detailed configuration of login and authentication information.
If you have purchased the anomalous behavior detection feature (ADM), you can configure it to analyze a user’s login activity at sign‑in and, when it detects authentication anomalies that differ from the norm, notify the user of a potential security threat.

The policy features provided by SingleID are as follows.

• Login Policy
• Authentication Policy
• Anomaly detection policy
  

By using SingleID’s policy feature, you can configure a secure authentication environment that meets organizational security requirements by specifying detailed login methods based on who is logging in, when, from which environment, and to which application.

Login Policy

The administrator can set detailed policies specifying which authentication methods users can use when logging in with SingleID, and, if necessary, create condition-based authentication policies for users authenticating in specific environments.

Login policies can be configured using the following conditions.

• Which application are you logging into?
• Who is logging in?
• In what environment are you logging in?

To access the login policy menu, navigate as follows.

• Admin Portal > Policy > Login Policy

Default login policy

The Admin Portal automatically creates the following two policies by default.

• Admin Portal Policy: Admin Portal access permission control policy
• Default Policy: User’s default access control policy

The Admin Portal Policy is the login policy applied when attempting to log in to the Admin Portal, and the Default Policy is the login policy applied when attempting to log in to the user portal.

If you have linked an application to SingleID and have not assigned a separate login policy, the Default Policy will be automatically assigned as the default login policy.

Register Login Policy

Login policy sets the login policies for administrators and users. You can configure login policies based on the access environment, application, and situation.

Login policies can be registered through a screen consisting of four steps as follows.

1. General
2. Allocation
3. Initial Redirection
4. Rule

General

Enter the name and description of the login policy on the general screen.

The fields that need to be entered are as follows.

Click the Next button to go to the assignment screen.

allocation

Specify the application to which the login policy will be applied on the assignment screen.

1. Click the Assign button to display the application assignment popup on the screen.
2. In the Application Assignment popup, select one or more applications to assign to the login policy, then click the Assign button.
3. If you have assigned all applications, click the Cancel button to close the Application Assignment popup.

Initial Redirection

Specifies how users access the login screen and the login method on the Initial Redirection screen.

• Redirected to SingleID’s Sign-in page (login page)

• Redirected to the external IdP

  
  

The explanations of the two methods above are as follows.

• If you select Redirected to SingleID’s Sign-in page, the SingleID login page will be displayed to the user attempting to log in.
• If you select Redirected to the external IdP, the user trying to log in will see the login page of the selected Identity Provider.
• After selecting Redirected to the external IdP, you must choose the Identity Provider from the selection list and designate it.
• If you select Redirected to SingleID’s Sign-in page, you can optionally display an additional button at the bottom of the SingleID login screen that allows login via an Identity Provider.
• AND see the following external IdP buttons on the Sign-In page Click the text input field below, select one or more Identity Providers registered in SingleID, and configure them to be displayed on the login screen.

Rule

On the Rules screen, modify or add login rules and set the priority among login rules.

Default Rule configuration

In the rule screen’s login rule list, Default Rule is displayed by default.

Default Rule cannot be deleted and can only be edited. Also, when you add one or more login rules, you cannot set the priority. (It always has the lowest priority.)

To modify the Default Rule, follow the steps below.

1. Click Default Rule in the rule list.
2. Default Rule’s WHEN condition cannot be modified.
3. You can modify the THEN result of Default Rule.

You can select one of the following two options when configuring access permission settings.

• Deny Access
• Allow Access

If you select Deny Access, it will reject login for all users.

When you select Allow Access in the access permission setting, you can configure the user’s login method.

Add rule

To add a login rule, follow the steps below.

1. Click the Register button at the top right of the rule list.
2. Enter the rule’s name and description on the rule registration screen.
3. Refer to the following and enter the rule items.

Access Environment

THEN configuration

THEN Set the login method and procedure in the result area.

In the access permission setting (a), you can select one of the following two options.

• Deny Access
• Allow Access

If you select Deny Access, login for all users will be denied. (The default value for the access permission setting (a) is Deny Access.)

To allow users to log in and configure detailed login methods, select Allow Access.

1. Select the Authenticator to use for login from the first login configuration’s selection list.
2. If you want users to be able to log in with another Authenticator in addition to the selected primary login method, select the checkbox (V) of And allow another factors below: and choose one or more Authenticators to add in the text input box.

Click the Save button to register the login rule and return to the rule list.

Rule priority management

If one or more login rules are added, the administrator can set the priority among the login rules. If a user matches the conditions set in multiple rules, the login method of the rule with the higher priority will be applied.

Follow the steps below to set the priority of login rules.

1. Drag the ≡ area displayed to the left of the rule name in the rule list with the mouse.
2. The priority of login rules is determined by the drag-and-drop location.
3. Rules that appear higher in the list have higher priority.

Policy Status Change

The status of the login policies managed by SingleID is as follows.

The administrator can change the login policy status according to its current state as follows.

Disable policy

To disable an active login policy, follow these steps.

1. Click the policy you want to deactivate in the policy list to navigate to the policy detail screen.
2. Click the Disable button.
3. Confirm popup displays login policy information (number of assigned applications, number of rules included in the login policy); after reviewing it, click the Deactivate button.

Policy activation

To change a login policy from inactive to active, follow these steps.

1. Click the policy you want to activate in the policy list to navigate to the policy detail screen.
2. Click the Activate button to change the login policy status to active.

Delete Policy

Administrators can delete the login policy from SingleID.

To delete the login policy, follow these steps.

1. Click the policy you want to delete in the policy list to navigate to the policy detail screen.
2. If the login policy is enabled, click the Disable button to deactivate the policy.
3. Click the Delete button displayed at the top right of the disabled login policy.
4. A popup screen confirming the deletion of the login policy is displayed.
5. To delete a login policy, first review the policy information, then enter the name of the policy you want to delete and click the Delete button.

Access Simulation

When there are many login policies and the rules they contain, it can be difficult to determine which user is governed by which policy for login methods.

SingleID provides an access simulation feature that allows administrators to quickly verify the login policies and rules applied to users.

Using the access simulation feature, you can select the user and the target application, arbitrarily define the user’s login environment (network, device, browser, OS), and predict in advance which login method the user will experience under various circumstances.

Additionally, if there are review requests from users experiencing login difficulties, you can quickly verify using the access simulation feature and modify the problematic policies or rules.

To use the access simulation feature, click the Access Simulation button located at the top right of the login policy list screen.

To run the access simulation, follow the steps below.

1. Enter the ID of the user to be simulated.
2. Specify the IP of the user to simulate. After selecting Specific IP Address, you can manually enter the IP. Enter the IP in the format 123.123.123.123.
3. Specify the device information of the user to simulate. After selecting Platform, you can choose a device from the selection list.
4. Specify the browser information of the user to be simulated. After selecting Browser, you can choose a browser from the dropdown list.
5. Specify the OS information of the user to simulate. After selecting OS, you can choose the OS from the selection list.
6. Click the Application Selection button to select the application to simulate.
7. In the Application Selection popup, click the radio button to the left of the application name to select the application, then click the Add button.

Authentication Policy

The administrator needs to change detailed authentication settings according to the organization’s security policy.

SingleID classifies and manages detailed authentication settings into the following four policies.

• Session Policy
• Authenticator policy
• MFA Service Provider Policy
• Password Policy

To access the authentication policy menu, navigate as follows.

• Admin Portal > Policy > Authentication Policy

To modify the authentication policy, click the Edit button at the lower right of the authentication policy screen to change the settings, then click the Save button.

Session Policy

To change the session policy, follow the steps below.

1. Click the Edit button at the lower right of the authentication policy screen.
2. In the maximum session limit setting, you set the maximum number of sessions a user can create simultaneously.
3. The minimum value that can be set is 1, and the maximum value is 100. When set to 1, a user can log in only from a single browser at a time and cannot log in simultaneously from multiple PCs or browsers.
4. Set the priority of the session created by the user in the session priority settings. The priority can be selected from the following two options.
   • Old session
   • New session

When you set the maximum session limit to 1 and select Old session, a logged-in user will be blocked from logging in when they attempt a new login from another PC or browser where they are not logged in.

Also, when the maximum session limit setting (Œ) restricts the maximum number of sessions to 1 and New session is selected, if a logged-in user attempts a new login from another PC or browser that is not logged in, the previous browser’s session is forcibly expired and the session logged in from the new PC or browser is maintained.

In the maximum session time setting, set the maximum duration a session can be retained.

The maximum session time can be set to one of the following two options.

• No time limit
• Set time limit

If you set No time limit, a session that has been created will not automatically expire until the user logs out. After setting Set time limit and specifying a time, the session expires when the set time elapses, and the user is automatically logged out. Configure the maximum idle session time for the session in the maximum idle session time setting. If you set the maximum idle session time, the session will expire and the user will be automatically logged out when the user does not make an authentication request for the configured duration.

To save the changed settings, click the Save button at the bottom right of the authentication policy screen.

To avoid saving the changed settings, click the Cancel button at the lower right of the authentication policy screen.

Authenticator policy

To change the Authenticator policy, follow the steps below.

1. Click the Edit button at the lower right of the authentication policy screen.
2. Configure according to each item below.
3. When the setup is complete, click the Save button.

MFA Service Provider Policy

To change the MFA Service Provider policy, follow the steps below.

1. Click the Edit button at the lower right of the authentication policy screen.
2. Refer to the table below and configure each item accordingly.
3. When the configuration is complete, click the Save button.

Password Policy

To change the password policy, follow the steps below.

1. Click the Edit button at the lower right of the authentication policy screen.
2. Refer to the table below and configure each item accordingly.
3. When the configuration is complete, click the Save button.

Sign‑up Policy

To allow user sign‑up, enable the registration policy, which permits registration of users other than those provisioned from the HR system or IdP. Through account synchronization, you can not only register, create, modify, and delete accounts but also provide features to invite users via the login screen or email.

To enable and use the registration policy, follow the steps below.

1. Click Admin Portal > Policy > Sign‑up Policy.
2. Enable Allow user registration.
3. If you enable it, the Policy tab and User Invitation tab will appear.
4. Review the descriptions of the Policy tab and the User Invitation tab below, and configure the policy.
5. Click the Save button when the setup is complete.

Policy

You can set general policies for member registration.

Dormant User Policy

Provides a feature that changes users who have not used the SingleID system for an extended period to a dormant state. Users who have been set to a dormant state can be configured, according to the settings, to be restored either by the user themselves or by an administrator.

To enable and use the dormant user policy, follow these steps.

1. Click Admin Portal > Policy > Human User Policy.
2. Human User Policy Activation Click the toggle button

Additional settings are as shown in the table below.

Approval Policy

The administrator can select an approval system and, depending on the type, set policies for member registration and app access through various approval lines. With diverse approval policies, security policies can be flexibly applied each time they change.

Approval can be performed by distinguishing between the built-in approval system function and the Knox Portal approval system. If integration with another approval system is required, please request it via a 1:1 inquiry.

To check the approval policy, follow the path below.

• Admin Portal > Policy > Approval Policy

Approval Policy List

The administrator can select an approval system and, depending on the type, set policies for member registration and app access using various approval lines. With diverse approval policies, security policies can be flexibly applied each time they change.

Register Approval Policy

When you click the Register button, you can set the approval system, type, approver, notification method, and approval period.

Anomaly Detection Policy

SingleID provides a feature that collects and analyzes user behavior data before and after authentication in real time to determine whether there are abnormal authentication activities, and immediately notifies the user of risk when identified as belonging to an abnormal authentication category.

To access the anomalous behavior detection policy menu, proceed as follows.

• Admin Portal > Policy > Anomalous Activity Detection Policy

User Life Cycle Management

User lifecycle management provides configuration functions for setting default values when a user is created or registers, and for extending the user account’s usage period.

To enable and configure the user lifecycle management function, refer to the following.

Onboarding (subscriber)

Set the phone country code, language, and time zone when creating a user and signing up. To configure, click the Edit button at the bottom right to make changes.

Offboarding (former member)

Users can request an extension of their account usage period, and it can be configured to allow the maximum possible extension.

1. Click the Activate toggle when requesting an extension of the user’s usage period.
2. Enter N days for the maximum extendable period.
3. Click the Change button in the usage period request approval to set the approver.

Conditional Authentication Policy

Conditional authentication policies can set rules to match the environment, settings, and individual circumstances of user accounts.

You can set the following rules.