Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add tokeninfo or tokentype to policy condition #1947

cornelinux opened this issue Nov 28, 2019 · 0 comments


Copy link

@cornelinux cornelinux commented Nov 28, 2019

For certain policies it might make sense to allow the tokentype to be taken into accout like:

  • only require a PIN for a certain token type
  • ...

But there are a lot of other policies, where it would not make sense or where it would result in wrong expectations

  • A userlist admin-policy with a condition "tokentype" - what do you think would this mean? Only allow the admin to list users, who have a token of this very tokentype? - probably not.

So the question is, if it makes sense at all to add further conditions to the policies or to split the actions, where it seems to be necessary like:

  • allow max tokens for different tokentypes
  • otppin for certain tokentypes...

In some scenarios we already have this distinction like totp_hash and hotp_hash.

This is why tokenclasses were allowed to add policy-actions in the first place.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
1 participant
You can’t perform that action at this time.