policy

When logging into SingleID or logging into an application registered with SingleID, various settings such as login method, authentication session, and password need to be configured according to the organization’s security policy.

SingleID provides a policy management feature that allows detailed configuration of login and authentication information.
If you have purchased the Anomalous Behavior Detection feature (ADM), you can configure it to analyze a user’s login activity at login and, when it detects authentication anomalies that differ from the norm, notify the user of a potential security threat.

The policy features provided by SingleID are as follows.

• Login Policy
• Authentication Policy
• Anomaly detection policy
  

By using SingleID’s policy feature, you can configure a secure authentication environment that meets organizational security requirements by specifying detailed login methods based on who is logging in, when, in which environment, and to which application.

Login Policy

The administrator can set detailed policies specifying which authentication methods users can use when logging in with SingleID, and, if necessary, create condition-based authentication policies for users authenticating in specific environments.

Login policies can be configured using the following conditions.

• Which application are you logging into?
• Who is logging in?
• In which environment are you logging in?

To access the login policy menu, navigate as follows.

• Admin Portal > Policy > Login Policy

Basic login policy

The Admin Portal creates two default policies as follows.

• Admin Portal Policy: Admin Portal access permission control policy
• Default Policy: User’s default access control policy

The Admin Portal Policy is the login policy applied when attempting to log in to the Admin Portal, and the Default Policy is the login policy applied when attempting to log in to the user portal.

If you have linked an application to SingleID and have not assigned a separate login policy, the Default Policy is automatically assigned as the default login policy.

Register login policy

The login policy sets the login policies for administrators and users. You can configure login policies based on the connection environment, application, and situation.

Login policies can be registered through a screen consisting of four steps as follows.

1. General
2. Allocation
3. Initial Redirection
4. rule

General

On the general screen, enter the name and description of the login policy.

The fields that need to be entered are as follows.

Click the Next button to go to the assignment screen.

Allocation

Specify the application to which the login policy will be applied on the assignment screen.

1. Click the Assign button to display the application assignment popup on the screen.
2. In the Application Assignment popup, select one or more applications to assign to the login policy, then click the Assign button.
3. If you have assigned all applications, click the Cancel button to close the Application Assignment popup.

Initial Redirection

Specifies the user’s login screen entry method and login method on the Initial Redirection screen.

• Redirected to SingleID’s Sign-in page (login page)

• Redirected to the external IdP

  
  

The explanations of the two methods above are as follows.

• If you select Redirected to SingleID’s Sign-in page, the SingleID login page will be displayed to the user attempting to log in.
• If you select Redirected to the external IdP, the user attempting to log in will see the login page of the selected Identity Provider.
• After selecting Redirected to the external IdP, you must select the Identity Provider from the selection list and designate it.
• If you select Redirected to SingleID’s Sign-in page, you can optionally display an additional button at the bottom of the SingleID login screen that allows login via an Identity Provider.
• AND see the following external IdP buttons on the Sign-In page. Click the text input field below and select one or more Identity Providers registered in SingleID to configure them to be displayed on the login screen.

Rule

In the Rules screen, edit or add login rules and set the priority among them.

Default Rule configuration

The login rule list on the rule screen displays Default Rule by default.

Default Rule cannot be deleted and can only be modified. Also, you cannot set a priority when adding one or more login rules. (Always the lowest priority.)

To modify the Default Rule, follow the steps below.

1. Click Default Rule in the rule list.
2. The WHEN condition of Default Rule cannot be modified.
3. You can modify the THEN result of Default Rule.

In the access permission setting, you can select one of the following two options.

• Deny Access
• Allow Access

If you select Deny Access, login will be denied for all users.

When Allow Access is selected in the access permission setting, you can configure the user’s login method.

Add rule

To add a login rule, follow the steps below.

1. Click the Register button at the top right of the rule list.
2. On the rule registration screen, enter the rule’s name and description.
3. Enter the rule items by referring to the below.

Access environment

THEN configuration

THEN Set the login method and procedure in the result area.

You can select one of the two options in the access permission setting (a).

• Deny Access
• Allow Access

Selecting Deny Access will deny login for all users. (The default value for access permission setting (a) is Deny Access.)

To allow users to log in and configure detailed login methods, select Allow Access.

1. From the first login settings selection list, select the Authenticator to use for login.
2. If you want users to be able to log in with another Authenticator besides the selected primary login method, select the checkbox (V) of And allow another factors below: and choose one or more Authenticators to add in the text input box.

Click the Save button to register the login rule and return to the rule list.

Rule priority management

If one or more login rules are added, the administrator can set the priority among the login rules. If a user meets the conditions set in multiple rules, the login method is applied according to the rule with the highest priority.

To set the priority of login rules, follow the steps below.

1. Drag the ≡ area displayed to the left of the rule name in the rule list with the mouse.
2. The priority of login rules is set based on the drag-and-drop position.
3. The higher a rule appears in the list, the higher its priority.

Change Policy Status

The status of the login policies managed by SingleID is as follows.

An administrator can change the status of the login policy according to its current state as follows.

Disable policy

To disable an active login policy, follow these steps.

1. Click the policy you want to deactivate in the policy list to navigate to the policy detail screen.
2. Click the Disable button.
3. After reviewing the login policy information displayed in the Confirm popup (the number of assigned applications and the number of rules included in the login policy), click the Deactivate button.

Activate policy

To change a login policy from inactive to active, follow these steps.

1. Click the policy you want to activate in the policy list to navigate to the policy detail screen.
2. Click the Activate button to change the login policy status to active.

Delete policy

Administrators can delete the login policy from SingleID.

To delete the login policy, follow the steps below.

1. Click the policy you want to delete in the policy list to navigate to the policy detail screen.
2. If the login policy is enabled, click the Disable button to deactivate the policy.
3. Click the Delete button displayed at the top right of the disabled login policy.
4. A popup screen confirming the deletion of the login policy is displayed.
5. To delete a login policy, first verify the policy information, then enter the name of the policy you want to delete and click the Delete button.

Access Simulation

When there are many login policies and the rules they contain, it can be difficult to determine which user is governed by which policy for login methods.

SingleID provides an access simulation feature so that administrators can quickly verify the login policies and rules applied to users.

Using the access simulation feature, you can select the user and target application, arbitrarily define the user’s login environment (network, device, browser, OS), and predict in advance which login method the user will experience in each scenario.

Additionally, if there are review requests from users experiencing login difficulties, you can quickly verify using the access simulation feature and modify the problematic policies or rules.

To use the access simulation feature, click the Access Simulation button located at the top right of the login policy list screen.

To run the access simulation, follow the steps below.

1. Enter the ID of the user to be simulated.
2. Specify the IP of the user to simulate. 2. After selecting Specific IP Address, you can manually enter the IP. 2. Enter the IP in the format 123.123.123.123.
3. Specifies the device information of the user to be simulated. 3. After selecting Platform, you can select a device from the selection list.
4. Specify the browser information of the user to be simulated. 4. After selecting Browser, you can select a browser from the selection list.
5. Specify the OS information of the user to be simulated. 5. After selecting OS, you can select the OS from the selection list.
6. Click the Application Selection button to select the target application for simulation.
7. In the Application Selection popup, click the radio button to the left of the application name to select the application, then click the Add button.

Authentication Policy

The administrator needs to change detailed authentication settings according to the organization’s security policy.

SingleID categorizes and manages detailed authentication settings into the following four policies.

• Session Policy
• Authenticator policy
• MFA Service Provider Policy
• Password policy

To access the authentication policy menu, navigate as follows.

• Admin Portal > Policy > Authentication Policy

To modify the authentication policy, click the Edit button at the lower right of the authentication policy screen to change the settings, then click the Save button.

Session Policy

To change the session policy, follow the steps below.

1. Click the Edit button at the lower right of the authentication policy screen.
2. In the maximum session limit setting, set the maximum number of sessions a user can create simultaneously.
3. The minimum value that can be set is 1, and the maximum value is 100. 3. When set to 1, the user can only log in from one browser at a time and cannot log in simultaneously from multiple PCs or browsers.
4. In the session priority settings, set the priority of sessions created by the user. 4. The priority can be set to one of the following two options.
   • Old session
   • New session

When you set the maximum session limit to 1 and select Old session in the maximum session count restriction setting, a logged-in user will have their login blocked when they attempt a new login from another PC or browser that is not logged in.

Also, when the maximum session limit setting (Œ) restricts the maximum number of sessions to 1 and New session is selected, if a logged-in user attempts a new login from another PC or browser that is not logged in, the session of the previously logged-in browser is forcibly expired and the session logged in from the new PC or browser is maintained.

In the maximum session time setting, set the maximum duration a session can be kept.

The maximum session time can be selected from one of the following two options.

• No time limit
• Set time limit

If set to No time limit, a session that has been created will not automatically expire until the user logs out. After configuring Set time limit and setting the time, when the specified time elapses, the session expires and the user is automatically logged out. In the Maximum Idle Session Time setting, set the session’s maximum idle time. If you set the maximum idle session time, the session will expire and the user will be automatically logged out when the user does not make an authentication request for the configured duration.

To save the changed settings, click the Save button at the bottom right of the authentication policy screen.

To avoid saving the changed settings, click the Cancel button at the lower right of the authentication policy screen.

Authenticator policy

To change the Authenticator policy, follow the steps below.

1. Click the Edit button at the lower right of the authentication policy screen.
2. Configure each item as described below.
3. When the setup is complete, click the Save button.

MFA Service Provider Policy

To change the MFA Service Provider policy, follow the steps below.

1. Click the Edit button at the lower right of the authentication policy screen.
2. Refer to the table below and configure each item accordingly.
3. When the setup is complete, click the Save button.

Password policy

To change the password policy, follow the steps below.

1. Click the Edit button at the lower right of the authentication policy screen.
2. Refer to the table below and configure each item accordingly.
3. When the setup is complete, click the Save button.

Sign-up Policy

If you want to allow user registration, enable the sign‑up policy, and users other than those provisioned from the HR system or IdP can also be registered. Through account synchronization, it provides the ability to register, create, modify, and delete accounts, as well as to invite users via the login screen or email.

To enable and use the registration policy, follow the steps below.

1. Admin Portal > Policy > Sign‑up Policy click.
2. Enable User Registration Allowed.
3. If you enable it, the Policy tab and User Invitation tab will appear.
4. Review the descriptions of the Policy tab and the User Invitation tab below, and configure the policy.
5. When the setup is complete, click the Save button.

Policy

You can configure general policies for member registration.

Dormant User Policy

Provides a function to set users who have not used the SingleID system for an extended period to a dormant status. Users who have been changed to a dormant state can be configured, according to settings, to allow either self-recovery by the user or recovery by an administrator.

To enable and use the dormant user policy, follow the steps below.

1. Admin Portal > Policy > Human User Policy Click.
2. Human User Policy Activation Click the toggle button.

Additional settings are shown in the table below.

Approval Policy

The administrator can select an approval system and, depending on the type, configure sign‑up and app‑access policies across various approval lines. Various approval policies allow flexible application whenever the security policy changes.

Approval can be performed using either the built-in approval system feature or the Knox Portal approval system. If integration with another approval system is required, please request it via a 1:1 inquiry.

To check the approval policy, follow the path below.

• Admin Portal > Policy > Approval Policy

Approval policy list

The administrator can select an approval system and, depending on the type, configure sign‑up and app‑access policies across various approval lines. It can be flexibly applied whenever the security policy changes, using various approval policies.

Register approval policy

When you click the Register button, you can set the approval system, type, approver, notification method, and approval period.

Anomaly Detection Policy

SingleID provides a function that collects and analyzes user behavior information before and after authentication in real time to determine whether there is abnormal authentication behavior, and if identified as belonging to an abnormal authentication category, immediately notifies the user of the risk.

To access the Anomaly Detection Policy menu, navigate as follows.

• Admin Portal > Policy > Anomalous Activity Detection Policy

User lifecycle management

User lifecycle management provides configuration functions for setting default values when a user is created or registers, and for extending the user account usage period.

To enable and configure user lifecycle management, refer to the following.

Onboarding (subscriber)

Set the phone country code, language, and time zone when creating a user and signing up. To configure, click the Edit button at the bottom right to make changes.

Offboarding (departed user)

Users can request an account usage period extension, and it can be configured to allow the maximum possible extension.

1. When requesting a user usage period extension, click the Activate toggle.
2. Enter N days for the maximum extendable period.
3. Click the Change button in the usage period request approval to set the approver.

Conditional Authentication Policy

Conditional authentication policies can set rules to match the environment, settings, and individual circumstances of user accounts.

You can set the following rules.