diff --git a/server_admin/topics.adoc b/server_admin/topics.adoc index f49591a587..c8ea3c711d 100644 --- a/server_admin/topics.adoc +++ b/server_admin/topics.adoc @@ -32,6 +32,7 @@ include::topics/authentication/flows.adoc[] include::topics/authentication/kerberos.adoc[] include::topics/authentication/x509.adoc[] include::topics/authentication/webauthn.adoc[] +include::topics/authentication/conditions.adoc[] include::topics/sso-protocols.adoc[] include::topics/sso-protocols/oidc.adoc[] include::topics/sso-protocols/saml.adoc[] diff --git a/server_admin/topics/authentication/conditions.adoc b/server_admin/topics/authentication/conditions.adoc new file mode 100644 index 0000000000..26a7cf3070 --- /dev/null +++ b/server_admin/topics/authentication/conditions.adoc @@ -0,0 +1,43 @@ +=== Conditions in Conditional flows + +As was mentioned in <<_execution-requirements, Execution requirements>>, _Condition_ executions can be only contained in _Conditional_ subflow. +If all _Condition_ executions evaluate as true, then the _Conditional_ sub-flow acts as _Required_. +You can process the next execution in the _Conditional_ sub-flow. +If some executions included in the _Conditional_ sub-flow evaluate as false, then the whole sub-flow is considered as _Disabled_. + +==== Available Conditions + +`Condition - User Role`:: +This execution has the ability to determine if the user has a role defined by _User role_ field. +If the user has the required role, the execution is considered as true and other executions are evaluated. +The administrator has to define the following fields: + +Alias::: +Describes a name of the execution, which will be shown in the authentication flow. + +User role::: +Role the user should have to execute this flow. +To specify an application role the syntax is `appname.approle` (for example `myapp.myrole`). + +`Condition - User Configured`:: +This checks if the other executions in the flow are configured for the user. +The Execution requirements section includes an example of the OTP form. + +`Condition - User Attribute`:: +This checks if the user has set up the required attribute. +There is a possibility to negate output, which means the user should not have the attribute. +The <<_user-attributes,User Attributes>> section shows how to add a custom attribute. +You can provide these fields: + +Alias::: +Describes a name of the execution, which will be shown in the authentication flow. + +Attribute name::: +Name of the attribute to check. + +Expected attribute value::: +Expected value in the attribute. + +Negate output::: +You can negate the output. +In other words, the attribute should not be present. diff --git a/server_admin/topics/users/attributes.adoc b/server_admin/topics/users/attributes.adoc index e0ce4568f1..ffc5737120 100644 --- a/server_admin/topics/users/attributes.adoc +++ b/server_admin/topics/users/attributes.adoc @@ -1,3 +1,4 @@ +[[_user-attributes]] === User Attributes