Custom access level specification

The IP address the request originated from. If the IP address cannot be determined, origin.ip evaluates to an error. We recommend that you use inIpRange to check if the origin IP address is in a specific IP address range instead of doing a string comparison.

Example:

inIpRange(origin.ip, ["203.0.113.24"])

The ISO 3166-1 alpha-2 code for the country or region where the request originated from. If the region code cannot be determined, origin.region_code evaluates to an error.

Example:

origin.region_code == "GB"
origin.region_code in ["US", "FR", "JP"]

The unique ID of the user who issued the request.

The value for request.auth.principal must be one or more unique user IDs. The UUIDs can be obtained using the Admin SDK Directory API.

The value must be in the following format: https://accounts.google.com/UUID

Where UUID is the UUID of a user.

Example:

request.auth.principal == "https://accounts.google.com/1134924314572461055"
request.auth.principal in ["https://accounts.google.com/1134924314572461055", "https://accounts.google.com/3134824314572461115"]

User authenticated with a password.

Example:

request.auth.claims.crd_str.pwd == true

User authenticated with a push notification to the mobile device.

Example:

request.auth.claims.crd_str.push == true

User authenticated using a code sent to SMS or via a phone call.

Example:

request.auth.claims.crd_str.sms == true

2SV used a software key, such as a phone, as security key.

Example:

request.auth.claims.crd_str.swk == true

2SV used a hardware key, such as Google Titan Key.

Example:

request.auth.claims.crd_str.hwk == true

User authenticated with one time password methods (Google Authenticator and Backup Codes).

Example:

request.auth.claims.crd_str.otp == true

User authenticated with any of the methods in this table except pwd.

Example:

request.auth.claims.crd_str.mfa == true

level name corresponds to the name of an existing access level.

When used, the conditions of the specified access level must also be met in addition to the other requirements of your custom access level.

Example:

levels.allow_corp_ips

Where allow_corp_ips is the name of an access level.

Describes the encryption status of the device.

Enum values:

enum DeviceEncryptionStatus {
  // The encryption status of the device is not specified or not known.
  ENCRYPTION_UNSPECIFIED == 0;
  // The device does not support encryption.
  ENCRYPTION_UNSUPPORTED == 1;
  // The device supports encryption, but is currently unencrypted.
  UNENCRYPTED == 2;
  // The device is encrypted.
  ENCRYPTED == 3;
}

Example:

device.encryption_status == DeviceEncryptionStatus.ENCRYPTED

Whether the device has been approved by the domain administrator.

Example:

device.is_admin_approved_device == true

Whether the device is owned by the organization.

Example:

device.is_corp_owned_device == true

Whether the device has its screen lock function enabled.

Example:

device.is_secured_with_screenlock == true

Identifies which operating system the device is using.

Enum values:

enum OsType {
  // The operating system of the device is not specified or not known.
  OS_UNSPECIFIED == 0;
  // A desktop Mac operating system.
  DESKTOP_MAC == 1;
  // A desktop Windows operating system.
  DESKTOP_WINDOWS == 2;
  // A desktop Linux operating system.
  DESKTOP_LINUX == 3;
  // An Android operating system.
  ANDROID == 4;
  // An iOS operating system.
  IOS == 5;
  // A desktop ChromeOS operating system.
  DESKTOP_CHROME_OS == 6;
}

Example:

device.os_type == OsType.DESKTOP_MAC
device.os_type != OsType.OS_UNSPECIFIED

The vendors object is used to access data provided by third-party security and endpoint management vendors. Each vendor may populate three shared top-level attributes: is_compliant_device, is_managed_device, and device_health_score.

Additionally, vendors may provide their own keys and values that are referenced using the data attribute. The available keys for the data attribute vary from vendor to vendor. Ensure that you are consistent when comparing the key value in your policy expression. For example, if you expect the key value to be a string or boolean, ensure that you compare it with a string or boolean in the policy expression correspondingly. Note that when the value is an integer, you should compare it with a double number in the policy expression.

Enum values:

// Health score of the device as provided by the vendor (possibly third party).
enum DeviceHealthScore {
  // The health score for the device is not specified or unknown.
  DEVICE_HEALTH_SCORE_UNSPECIFIED = 0;
  // The health of the device is very poor.
  VERY_POOR = 1;
  // The health of the device is poor.
  POOR = 2;
  // The health of the device is ok.
  NEUTRAL = 3;
  // The health of the device is good.
  GOOD = 4;
  // The health of the device is very good.
  VERY_GOOD = 5;
}

Examples:

device.vendors["some_vendor"].is_compliant_device == true

device.vendors["some_vendor"].is_managed_device == true

device.vendors["some_vendor"].device_health_score == DeviceHealthScore.VERY_GOOD

device.vendors["some_vendor"].data["is_device_compromised"] == true

device.vendors["some_vendor"].data["some_num"] == 1.0

Whether the Android verified boot status is green.

Example:

device.android_device_security.verified_boot == true

Whether device passes CTS profile compliance.

Example:

device.android_device_security.cts_profile_match == true

Whether the device has Google Play Protect Verify Apps enabled.

Example:

device.android_device_security.verify_apps_enabled == true

Whether potentially harmful apps were found on the device.

Example:

device.android_device_security.has_potentially_harmful_apps == true

Whether the iOS device was found to be jailbroken.

Example:

device.ios_device_security.is_device_jailbroken == true

Whether the request comes from a device with a verified Chrome OS.

Example:

device.verified_chrome_os == true

Is the browser managed, at the browser level or at the profile level, and by the enterprise under the correct domain.

A browser is considered to be managed if the policies are centrally managed and pushed, and that the domain of the managed browser or profile matches the expected domain on the server side.

Following are the available Chrome management states:

Example:

device.chrome.management_state in
    [
        ChromeManagementState.CHROME_MANAGEMENT_STATE_BROWSER_MANAGED,
        ChromeManagementState.CHROME_MANAGEMENT_STATE_PROFILE_MANAGED,
    ]

Is the browser above a certain minimum version.

Example:

device.chrome.versionAtLeast("88.0.4321.44")

Is the real-time URL check connector enabled.

Example:

device.chrome.is_realtime_url_check_enabled == true | false

Is the file upload analysis connector enabled.

Example:

device.chrome.is_file_upload_analysis_enabled == true | false

Is the file download analysis connector enabled.

Example:

device.chrome.is_file_download_analysis_enabled == true | false

Is the bulk text (paste) analysis connector enabled.

Example:

device.chrome.is_bulk_data_entry_analysis_enabled == true | false

Is the security event reporting connector enabled.

Example:

device.chrome.is_security_event_analysis_enabled == true | false

Checks whether an IP address belongs to one of the given subnets.

Example:

inIpRange(origin.ip, ["192.0.2.0/24", "198.51.100.0/24", "203.0.113.0/24"])

Checks whether the device operating system is at least a given version. We recommend that you use this function with the device.os_type attribute.

Example:

device.versionAtLeast("10.0") == true

Checks if the client certificate associated with the origin matches the device and reports the state.

The state returned by the function can be one of the following:

• CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE
• CertificateBindingState.CERT_NOT_MATCHING_EXISTING_DEVICE
• CertificateBindingState.CERT_STATE_UNKNOWN

Example:

certificateBindingState(origin, device) == CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE

Tests whether the string operand starts with the prefix argument.

Example:

"Sample string".startsWith("Sample")

Tests whether the string operand ends with the suffix argument.

Example:

"Sample string".endsWith("string")

Returns the fingerprint of the certificate associated with the origin. You can use this in macros to test device certificates.

Example:

// Checks if the enterprise certificate associated with the origin matches the device.
device.certificates.exists(cert, cert.is_valid && cert.cert_fingerprint == origin.clientCertFingerprint())