By: Benjamin Sebbah user 01 Jun 2016 at 4:31 a.m. CDT

5 Responses
Benjamin Sebbah gravatar
Hi, Customer is asking if it would be possible to disallow access to some federated applications for some people depending on the timezone. For instance, if user is working from France access would be allowed from 9am to 6pm (French TZ) and from NY from 8am to 7pm (New-york TZ). (There is a law that is being discussed (not voted yet) in Europe/France that would force such a behaviour) Would that be doable via custom scripts? Thanks! Ben

By Mohib Zico staff 01 Jun 2016 at 5:33 a.m. CDT

Mohib Zico gravatar
Hi Benjamin, Sharing the ticket with Mike and Yura.

By Michael Schwartz Account Admin 01 Jun 2016 at 9:31 a.m. CDT

Michael Schwartz gravatar
Benjamin, Its an authz policy (because it happens post-authn). Its definitely possible, but you'd have to make sure the application requires an OAuth2 token--either an UMA RPT token, or our simpler GAT token. There is another trick that may be required. During authentication, you have a connection to the user's browser. At this point, I think you can get the timezone from the person's preferences. You'll need to write this to the session for future use in the authorization policy. Yuriy Movchan can confirm if there is a session variable that you could use to store this information during the custom authn script, that would make it available in the authz script. - Mike

By Benjamin Sebbah user 01 Jun 2016 at 9:39 a.m. CDT

Benjamin Sebbah gravatar
Thanks guys for the fast feedback! Unfortunately, we're talking about SAAS SAML applications here.

By Yuriy Movchan staff 01 Jun 2016 at 10:04 a.m. CDT

Yuriy Movchan gravatar
Hi, Yes, it's possible to achieve in custom authentication script. We stores browser ip address in LDAP session. We can use it to get geolocation [data]( Also we can write JavaScript to pass browser data, timezone, etc to server in hidden variable on login page or add cookie with this information. And when user try to log in we can additionally check them. Regards, Yura

By Benjamin Sebbah user 05 Jun 2016 at 9:25 a.m. CDT

Benjamin Sebbah gravatar