Skip to main content

Protect applications with developer metadata

Instructions on how to protect an application using details on a developer who created the application.

note

Developer metadata can be used for validating policies. It enables, for example, blocking the scope assignment to an application created by a developer identified with specific metadata.

Prerequisites​

  • You can log in to SecureAuth as an administrator.

  • You have at least one application in SecureAuth.

Create App Metadata​

  1. In the workspace, select Applications > Clients from the sidebar.

  2. Select an application that you want to add/check the metadata on.

  3. In the application view, select the Metadata tab.

  4. In the Metadata view, navigate to Developer metadata and review or add content.

    Result: You've learned details on a developer who created the application and you are able to use this data for your purposes.

Create Policy​

  1. Create a SecureAuth user or machine-to-machine policy as described in Creating SecureAuth policies in the Visual Policy Editor.

  2. In the policy generating engine, select ADD VALIDATOR.

    acp_how-to_config_devmeta_vali.png

  3. From the fly-out Add new validator pane, select Developer.

    acp_how-to_config_devmeta_devi.png

  4. In the Developer validator, select ADD FIELD.

    acp_how-to_config_devmeta_field.png

  5. In the Cross context condition editor, select an attribute for the developer context from the drop-down list, for example URL of the webpage.

    note

    You can also define your own attribute by selecting Custom value from the top of the list of predefined attributes.

    acp_how-to_config_devmeta_attrib.png

  6. Continue the validator setup in the Cross context condition editor:

    1. Select an attribute operator, for example, equals.

    2. Enter a value (target) for your attribute that would validate the policy, for example, https://example.com/.

    3. Select SAVE to complete the field setup.

  7. Select the OK icon from the top right corner if you're done with adding fields.

    acp_how-to_config_devmeta_complete.png

  8. If you're done with adding validators, select SAVE to complete the policy setup.

    acp_how-to_config_devmeta_ok.png

    Result: Your policy validating developer metadata is ready to be used.

Next Steps​

Use the developer metadata for various authorization operations on the 3rd party application in SecureAuth. See, for example, Restricting Access to Services Using Authorization Scopes as a reference.