7.1

1 To access the service from outside the enterprise network, the user is required to log in with RSA
SecurID. The user logs in using a browser and now has access to the apps portal for a four hour session
as provided by the default access rule.
2 After four hours, the user tries to launch a Web application with the Sensitive Web Applications policy
set applied.
3 The service checks the rules in the policy and applies the policy with the ALL RANGES network range
since the user request is coming from a Web browser and from the ALL RANGES network range.
The user logs in using the RSA SecurID authentication method, but the session just expired. The user is
redirected for reauthentication. The reauthentication provides the user with another four hour session
and the ability to launch the application. For the next four hours, the user can continue to launch the
application without having to reauthenticate.
Example 2 Stricter Web-Application-Specific Policy
For a stricter rule to apply to extra sensitve Web applications, you could require re-authentication With
SecureId on any device after 1 hour. The following is an example of how this type of policy access rule is
implemented.
1 User logs in from an inside the enterprise network using the password authentication method.
Now, the user has access to the apps portal for eight hours, as set up in Example 1.
2 The user immediately tries to launch a Web application with the Example 2 policy rule applied, which
requires RSA SecurID authentication.
3 The user is redirected to an identity provider that provides RSA SecurID authentication.
4 After the user successfully logs in, the service launches the application and saves the authentication
event.
The user can continue to launch this application for up to one hour but is asked to reauthenticate after
an hour, as dictated by the policy rule.
Chapter 2 Configuring Tenant Settings
VMware, Inc. 99