7.1

Device Type
Select the type of device that the rule manages. The client types are Web Browser, Identity Manager Client
App, iOS, Android, and All device types.
Authentication Methods
Set the priority of the authentication methods for the policy rule. The authentication methods are applied in
the order they are listed. The rst identity provider instances that meets the authentication method and
network range conguration in the policy is selected, and the user authentication request is forwarded to the
identity provider instance for authentication. If authentication fails, the next authentication method in the
list is selected. If Certicate authentication is used, this method must be the rst authentication method in
the list.
You can congure access policy rules to require users to pass credentials through two authentication
methods before they can sign in. If one or both authentication method fails and fallback methods are also
congured, users are prompted to enter their credentials for the next authentication methods that are
congured. The following two scenarios describe how authentication chaining can work.
n
In the rst scenario, the access policy rule is congured to require users to authenticate with their
password and with their Kerberos credential. Fallback authentication is set up to require the password
and the RADIUS credential for authentication. A user enters the password correctly, but fails to enter
the correct Kerberos authentication credential. Since the user entered the correct password, the fallback
authentication request is only for the RADIUS credential. The user does not need to re-enter the
password.
n
In the second scenario, the access policy rule is congured to require users to authenticate with their
password and their Kerberos credential. Fallback authentication is set up to require RSA SecurID and a
RADIUS for authentication. A user enters the password correctly but fails to enter the correct Kerberos
authentication credential. The fallback authentication request is for both the RSA SecurID credential
and the RADIUS credential for authentication.
Authentication Session Length
For each rule, you set the length that this authentication is valid. The value determines the maximum
amount of time users have since their last authentication event to access their portal or to launch a specic
Web application. For example, a value of 4 in a Web application rule gives users four hours to launch the
web application unless they initiate another authentication event that extends the time.
Custom Access Denied Error Message
When users aempt to sign in and fail because of invalid credentials, incorrect conguration, or system
error, an access denied message is displayed. The default message is
Access denied as no valid authentication methods were found.
You can create a custom error message for each access policy rule that overrides the default message. The
custom message can include text and a link for a call to action message. For example, in a policy rules for
mobile devices that you want to manage, if a user tries to sign in from an unenrolled device, the follow
custom error message could appear:
Please enroll your device to access corporate resources by clicking the link at the end of this
message. If your device is already enrolled, contact support for help.
Example Default Policy
The following policy serves as an example of how you can congure the default policy to control access to
the apps portal. See “Manage the User Access Policy,” on page 100.
The policy rules are evaluated in the order listed. You can change the order of the policy by dragging and
dropping the rule in the Policy Rules section.
In the following use case, this policy example applies to all applications.
Chapter 2 Configuring Tenant Settings
VMware, Inc. 97