Context-Aware Access examples for Advanced mode

You can use enterprise certificates for devices in custom access levels to determine if a device is a corporate-owned asset. This access level uses the device attribute for the asset verification. Read Configuring enterprise certificate conditions for more information and examples.

A device can have more than one certificate. Enterprise certificates are used in a custom access level using the exists() macro. For example:

device.certificates.exists(cert, predicate)

In this example, cert is a simple identifier to use in the variable predicate to bind to the device enterprise certificate. The exists() macro combines per-element predicate results with the or (||) operator. Macros return true if at least one certificate satisfies the predicate expression.

The table below lists attributes you can use to form CEL expressions to use with custom access levels.  Note that string comparisons are case sensitive.

Attribute	Description	Example of predicate expression (where cert is an identifier of macros)
is_valid	True if the certificate is valid and not expired. (boolean)	cert.is_valid
cert_fingerprint	Fingerprint of the certificate (base64 unpadded SHA256)	cert.cert_fingerprint == origin. clientCertFingerprint()
root_ca_fingerprint	Fingerprint of root CA certificate used to sign this certificate (base64 unpadded SHA256)	cert.root_ca_fingerprint == "the_fingerprint"
issuer	Issuer name (fully expanded names) To find the issuer name, run the following command on the cert: $ openssl x509 -in ca_1.crt -noout -issuer issuer= /C=IN/ST=UP/L=NCR/O=BCEDemo/ OU=BCEDemo_1/CN=inter_1/ emailAddress=test_inter1@beyondcorp.in The issuer string used in the access level is the reverse of the output and the “/” replaced by a comma, for example: EMAILADDRESS=test_inter1@beyondcorp.in, CN=inter_1, OU=BCEDemo_1, O=BCEDemo, L=NCR, ST=UP, C=IN	cert.issuer == "EMAILADDRESS=test_inter1 @beyondcorp.in, CN=inter_1, OU=BCEDemo_1, O=BCEDemo, L=NCR, ST=UP, C=IN"
subject	Subject name of the certificate (fully expanded names)	cert.subject == "CA_SUB"
serial_number	Serial number of the certificate (string)	cert.serial_number == “123456789”
template_id	Template Id of X.509 extension Certificate Template for the certificate (string)	cert.template_id == "1.3.6.1.4.1.311.21. 8.15608621.11768144. 5720724. 16068415.6889630.81. 2472537.7784047"

Examples of commonly-used policies:

Validate that the device has a valid enterprise certificate signed by the company root certificate

device.certificates.exists(cert, cert.is_valid && cert.root_ca_fingerprint == "ROOT_CA_FINGERPRINT")

Validate the issuer of the enterprise certificate on the device

device.certificates.exists(cert, cert.is_valid && cert.issuer == "EMAILADDRESS=test_inter1@beyondcorp.in, CN=inter_1, OU=BCEDemo_1, O=BCEDemo, L=NCR, ST=UP, C=IN”)

In this example the access level uses the device attribute to require Chrome browser with basic security requirements.

// Require Chrome to be managed at profile or browser level, must have
// security event reporting enabled and must be version 97 or greater
levels.Require_Secure_Device &&
(
  device.chrome.management_state == ChromeManagementState.CHROME_MANAGEMENT_STATE_BROWSER_MANAGED ||
  device.chrome.management_state == ChromeManagementState.CHROME_MANAGEMENT_STATE_PROFILE_MANAGED
) &&
device.chrome.is_security_event_analysis_enabled &&
device.chrome.versionAtLeast("97")

A requirement for controlling access is to only allow access when the device is managed or owned by the company. There are many ways to determine whether a device is corporate-owned or managed, including:

• If a device has a serial number that matches one that’s in the company’s asset management system
• If a device has a valid enterprise certificate that’s issued by the company

These two approaches can be used in the following custom access level that uses levels and device attributes to determine if the device is corporate-owned or managed.

// The device is a corporate if one of the following conditions is true:
// 1. If the serial number matches what the admin has uploaded
// 2. If the device has a valid enterprise-issued certificate
levels.Require_Secure_Device &&
(
   device.is_corp_owned_device ||
   device.certificates.exists(cert, cert.is_valid && cert.root_ca_fingerprint == "SOME_ROOT_CA_FINGERPRINT")
)

The fingerprint is the unpadded base64 encoded sha256 digest (in binary format) of the DER-encoded certificate. The string can be generated from the certificate in PEM format using the following procedure with openssl:

$ openssl x509 -in cert.pem -out cert.der -outform DER
$ openssl dgst -sha256 -binary cert.der >  digest.sha
$ openssl base64 -in digest.sha

Enterprises sometimes want to allow break glass access during emergencies when the administrator does not have access to a secure device but needs emergency access for a short period of time. 

In this case, create a time and location-constrained access level using the levels attribute, and assign it to the specific administrator. When this access level is assigned, it would only be valid during the time specified. After this time period expires, the administrator access would again be controlled by existing requirements.

// Allow temporary access to resources on March 1, 2022, between 10 PM to midnight,
// and this access must come from within the US region.
levels.Require_Secure_Device &&
request.time.between('2022-03-01T23:00:00+08:00', '2022-03-02T23:59:59+08:00') &&
origin.region_code == “US”
// Note that the end time is exclusive, so the above potentially has 2 seconds that 
// the users may not have access. Another option is to use this 
// !between(‘00:00:01’,’16:00:00’) 

This access level uses levels attributes, and requires that users meet the combined conditions of two access levels. In this example, access_level_name_1 and access_level_name_2 refer to Internal Name.

levels.access_level_name_1 && levels.access_level_name_2