GAM - Security Policies

GAM Security Policies define access control rules for Users and Roles to ensure secure interaction with Applications. These policies govern sessions, tokens, and password requirements.

GAM security policies can be configured in two ways:

• Through the GAM Web Backoffice
• Programmatically via the GAM API.

When using the GAM Web Backoffice, you can add or update a Security Policy. For detailed steps, see GAM Web Backoffice - Security Policies section.

At runtime, the applicable security policy for a user is determined according to the following precedence:

How GAM determines which Security Policy applies to a User 

1. Security policy assigned to the user.

Each GAM user can have one security policy assigned to them or none at all.

To assign or update a user's security policy in the GAM Web Backoffice, go to the Users section and edit the user properties (as shown in Figure 2).

Figure 2.

Programmatically, you can retrieve a user's security policy with the SecurityPolicyId property of the GAMUser object.

&User.Load(&UserId) //&User is GAMUser object, &UserId is GAMGUID data type
&SecurityPolicyId   = &User.SecurityPolicyId //&SecurityPolicyId is GAMKeyNumShort data type.

2. If the user has no associated Security Policy, the one assigned to their Main Role is used.

If the user doesn't have a security policy assigned, the policy applied at runtime will be the one associated with their Main Role. See GAM Main Role of a user for more information.

To check or update this in the GAM Web Backoffice, go to the Users section, select the user, and review their main role (only one role can be set as Main Role at a time).

Figure 3. Main Role of the User, in this example it's "Role1". 

By editing the role's properties, you can see the security policy of the role (which can be "none").

Figure 4. Security Policy assigned to a role

You can also retrieve the Security Policy of the role with the SecurityPolicyId property of the GAMRole object.

&Role.Load(&Id)//&Role is GAMRole, &Id is GAMKeyNumLong
&SecPolId = &Role.SecurityPolicyId //&SecPolId is GAMKeyNumShort data type

3. If none of the above, but the user has other roles assigned, GAM applies the Security Policy of the Default Repository Role. 
 

4. If none of the above, the default Security Policy of the Repository is used.
 

If the user has no security policy assigned, the security policy applied is the Default Security Policy of the Repository.

Figure 5. Default Security Policy of the Repository

The DefaultSecurityPolicyId property of the GAMRepository object indicates the default security policy of the repository.

&Repository.Load(&Id) //&Repository is GAMRepository, &Id is GAMKeyNumLong data type
&DefaultSecurityPolicyId  = &Repository.DefaultSecurityPolicyId //&DefaultSecurityPolicyId is GAMKeyNumShort data type

 

Note: When setting a value higher than 0 for the property MinimumSpecialCharactersPassword, the following regular expression is used:

&UserPassword.Matches(!"[^\d\w]")

Which means:

\w [a-zA-Z0-9_] (literal or digit or underscore)
\d [0-9] (digit)
^ not 

So, the regular expression means all that is NOT \d\w

See Also

GAM - Roles
GAM - Permissions
Security Session Management in Applications using GAM
GAM Web Backoffice - Security Policies section