Reauthentication POP: creating and applying

Forced reauthentication based on security policy is configured by creating a protected object policy (POP) with a special extended attribute named "reauth". We can attach this POP to any object that requires the extra protection provided by forced reauthentication.

Remember that all children of the object with the POP also inherit the POP conditions. Each requested child object requires a separate reauthentication.

Use the pdadmin pop create, pdadmin pop modify, and pdadmin pop attach commands to create and apply the reauthentication POP. The following example illustrates creating a POP called "secure" with the reauth extended attribute and attaching it to an object (budget.html):

pdadmin> pop create secure
pdadmin> pop modify secure set attribute reauth true
pdadmin> pop attach /WebSEAL/hostA/junction/budget.html secure

Anyone attempting to access budget.html is forced to reauthenticate using the same identity and authentication method that generated the existing credential.

If the user requesting the resource is unauthenticated, the POP forces the user to authenticate. No reauthentication is necessary for this resource after successful initial login.

Details about the pdadmin pop commands can be found in the Command reference topics in the Knowledge Center.

Parent topic: Reauthentication