Organization Policy API, gRPC: AuthenticationPolicyRuleService.Get

Field

Description

rule_id

string

Required field. ID of the authentication policy rule to retrieve.

The maximum string length in characters is 50.

Field

Description

id

string

ID of the authentication policy rule.

name

string

Name of the authentication policy rule.
The name is unique within the organization and contains 1-63 characters.

description

string

Description of an authentication policy rule. 0-256 characters long.

organization_id

string

ID of the organization that the authentication policy rule belongs to.

effect

enum Effect

Effect to apply when the rule matches.

• ALLOW_WITH_OBLIGATIONS: Allow authentication provided the obligations in AuthenticationPolicyRule.obligations are satisfied.
• DENY: Deny authentication.

obligations[]

Obligation

Obligations to satisfy when the effect is ALLOW_WITH_OBLIGATIONS.

created_at

google.protobuf.Timestamp

Creation timestamp.

updated_at

google.protobuf.Timestamp

Modification timestamp.

subjects_include[]

string

List of IDs of subjects affected by the authentication policy rule.
Empty list matches all subjects and is functionally equal to ["allUsers"].

subjects_exclude[]

string

List of IDs of subjects not affected by the authentication policy rule.
Empty list matches no subjects.

networks_include[]

string

Source IP ranges in CIDR notation that the authentication policy rule applies to.
Empty list matches any source and is functionally equal to ["0.0.0.0/0", "::0/0"].

networks_exclude[]

string

Source IP ranges in CIDR notation excluded from the authentication policy rule.
Empty list matches no sources.

applications_exclude[]

string

List of IDs of applications not affected by the authentication policy rule.
Empty list matches no applications.

applications_include[]

string

List of IDs of applications affected by the authentication policy rule.
Empty list matches all applications.

status

enum Status

Status of the authentication policy rule.

• CREATING: Authentication policy rule is being created.
• ACTIVE: Authentication policy rule is active.
• INACTIVE: Authentication policy rule is inactive and is not considered during authentication.
• UPDATING: Authentication policy rule is being updated.
• DELETING: Authentication policy rule is being deleted and might not be considered during authentication.

labels

object (map<string, string>)

Labels of the authentication policy rule.

Field

Description

step_up_required

StepUpRequired

Require step-up authentication.

Includes only one of the fields step_up_required, skip_mfa, reauthentication_required.

skip_mfa

SkipMfa

Allow skipping the organization's current MFA requirements.

Includes only one of the fields step_up_required, skip_mfa, reauthentication_required.

reauthentication_required

ReauthenticationRequired

Require full authentication again.

Includes only one of the fields step_up_required, skip_mfa, reauthentication_required.

Field

Description

acr_id

string

Required field. ACR ID required to satisfy this obligation.

The maximum string length in characters is 50.

ttl

google.protobuf.Duration

Required field. Maximum age of a factor verification that can satisfy this obligation.

Field

Description

require_once

bool

If true, the organization's current MFA requirements must have been satisfied at least once
during the current session.

Field

Description

ttl

google.protobuf.Duration

Required field. Maximum age of an authentication that can satisfy this obligation.