Post-authentication context
The Post Authentication policy context defines how and when a policy is enforced during the login process. The policy used in this context executes after your users see a login screen.
Post-authentication context record
Policies in the post-authorization context execute after your users enter their credentials or SSO response. Your instance allows or denies access based on your selected policy. Because your users have identified themselves via their login credentials, the policy can use user information such as role or group to determine whether to grant access.
Use the fields in the Post-authentication policy context record to define how your instance uses your policy.
| Field | Description |
|---|---|
| Name | Name of the policy context. This field is static and cannot be changed. |
| Description | Description of the context |
| Default Policy | Defines the default behavior of this context when evaluating the policy. Select from the following options.- Allow Policy Denies access to all users by default, and only allows access when the conditions the policy selected in the Allow Policy field evaluate to true.
Allows access to all users by default, and only denies access when the conditions the policy selected in the Deny Policy field evaluate to true. |
| Allow Policy | The policy used for this context uses. This field appears only when the Default Policy field is set to Allow Policy. |
| Deny Policy | The policy used for this context uses. This field appears only when the Default Policy field is set to Deny Policy. |
Policy inputs and conditions
The Policy Input and Policy Conditions tabs display the inputs and conditions of the policy selected in the Allow Policy or Deny Policy field. These tabs serve as a reference, but cannot be used to change the policy inputs or conditions. To modify your policy settings, navigate to the policy using the reference icon (
Reference icon\) next to the **Allow Policy** or **Deny Policy** field.
This example shows a post-authentication policy context record configured to deny access by default. The context uses a policy called Deny access policy. That policy has a set of inputs and conditions that are displayed in the Policy Input and Policy Condition tabs.
Post-authentication policy context record