Access Policy Manager
Access Policy Manager
This domain covers APM access profiles, access policies, authentication, authorization, SSO, and endpoint inspection. Questions typically ask what happens during a user session and which policy item produces a given result.
Core rules
- An access profile is attached to a virtual server. It contains an access policy built in the visual policy editor, plus settings such as session timeouts and cookie options.
- Access policy items run in order. A logon page collects credentials; an authentication item validates them against AD, LDAP, RADIUS, or SAML; an authorization item checks group membership.
- SSO items use stored credentials or SAML assertions to sign the user in to backend applications. SSO credential caching is separate from the access session.
- Endpoint inspection checks the client device (antivirus, firewall, registry, file) and can branch to allow, deny, or remediate.
- A per-request policy evaluates each request; an access policy evaluates once at session establishment.
- Session variables carry data through the policy and can be used in iRules and SSO templates.
Worked example
A user opens the portal virtual server. The access profile runs a logon page, then AD authentication. If authentication succeeds, an AD group query checks for the VPN-Users group; a successful match goes to an SSO item that signs into the intranet, then to a webtop. If the group check fails, the policy branches to a deny page. The session is stored in the access session database; the browser holds an MRHSession cookie. On later requests, APM validates the cookie and applies the per-request policy.
Traps
- Confusing access policy with per-request policy; per-request runs after the session exists.
- Assuming SSO works without a credential cache or SAML IdP configuration.
- Putting an ACL before authentication, so unauthenticated users are evaluated against it.
- Forgetting that endpoint inspection requires a client component and a connectivity profile when network access is needed.
- Setting session timeout too low and breaking long-lived SSO sessions.