Add Custom Policy
To add custom policy to an application:
- Navigate to your Access Gateway InstanceAn instance, or computer instance, is a virtual machine (VM) or individual physical computer, used to host a software appliance..
- Select the Application tab.
- In the row containing the previously created application, click the Edit button (
). - Expand the Essentials tab.
- Change the Protected Web Resource field to specify http://policy.service.spgw.
Important
Specifying a Protected Web Resource of policy.service.spgw instructs Access Gateway that this is a policy test application and results in policy test suite being executed on Goto > SPAn acronym for service provider. Generally, an SP is a company, usually providing organizations with communications, storage, processing, and a host of other services. Within Okta, it is any website that accepts SAML responses as a way of signing in users, and has the ability to redirect a user to an IdP (e.g., Okta) to begin the authentication process. or IDPAn acronym for Identity Provider. It is a service that manages end user accounts analogous to user directories such as LDAP and Active Directory, and can send SAML responses to SPs to authenticate end users. Within this scenario, the IdP is Okta. Initiated tests.
This is only for testing purposes - Expand the Advanced sub-tab.
- Set the Debug toggle on.
Important
Enabling Debug mode allows Access Gateway to display debug information when testing.
This is only for testing and should not be enabled in production. - Select the Policies tab.
- Click the Add(
) button and choose Not Protected. 
- Enter an name and resource. For this example we added a not protected rule named Public referencing Resource Path /public.
Optionally enter a description of Not protected resource. - Click Okay to save the rule.
- Click the Add() button and choose Protected Rule.
- Enter a name, resource and Resource Matching Rule. For this example, enter:
-
Name Deny Resource Path /deny Resource Matching Rule GroupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups.=(?!.*Everyone:) - Click Okay to save the rule.
- Click Done to complete the application edit.
Test the application
- In the row containing the application click the Goto> SP Initiated.
- Login to your Okta tenant using a valid account.
- Examine the results of the test.
Note the default path is '/' and is covered by the root policy.
- Modify the URL to append /deny/.
- Refresh the browser. If the user was in the Everyone group, then the request should resemble.
