Add Custom Policy

To add custom policy to an application:

  1. Open the Access Gateway Admin UI console.
  2. Select the Application tab.
  3. In the row containing the previously created application, click Edit ( ).
  4. Expand the Essentials tab.
  5. In the Protected Web Resource field, specify http://policy.service.spgw.

    Important Note

    Important

    Specifying a Protected Web Resource as policy.service.spgw instructs Access Gateway that this is a policy test application and results in policy test suite being executed when you select Goto application > SP Initiated or IDP Initiated tests.
    This is only for testing purposes.

  6. Expand the Advanced sub-tab.
  7. Activate the Debug toggle.

    Important Note

    Important

    Activating Debug mode allows Access Gateway to display debug information when testing.
    This is only for testing and should not be activated in production.

  8. Select the Policies tab.
  9. Click Add () and select Not Protected.

  10. Enter a name and resource. For this example, we added a not protected rule named Public referencing Resource Path /public.
    Optionally enter a description of Not protected resource.
  11. Click Okay to save the rule.
  12. Click the Add() button and choose Protected Rule.
  13. Enter a name, resource, and resource matching rule. For this example, enter:
  14. Name Deny
    Resource Path /deny
    Resource Matching Rule Groups=(?!.*Everyone:)
  15. Click Okay to save the rule.
  16. Click Done.

Test the application

  1. In the row containing the application, click the Goto> SP Initiated.
  2. Sign in to your Okta tenant using a valid account.
  3. Examine the results of the test.
    Note that the default path is '/' and is covered by the root policy.
  4. Modify the URL to append /deny/.
  5. Refresh the browser. If the user was in the Everyone group, then the request should be similar to: