# Client Policies

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F6LIf3XXaLvtkqElWQnfT%2F1.png?alt=media&#x26;token=3b629e5a-7f6d-402f-be2e-6d2e0a675cad" alt=""><figcaption></figcaption></figure>

Within Client Policies, under the Profile section, you can establish a set of executors that are enforced for various actions performed with the client.&#x20;

These actions may include administrative tasks like creating or updating a client, as well as user actions like authentication to the client.

Click the Refresh button to see the latest settings.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F7CibLLSoIHVBUEWGldoO%2F2.png?alt=media&#x26;token=f4901408-a74b-4dcf-91d0-089ec5429006" alt=""><figcaption></figcaption></figure>

You can also choose how many client policies you want to display on one screen. Select your preferred option from the dropdown menu as shown above.

You can use the search box to find a specific policy.

#### **Name**

It refers to the Name of the Client Profile.

It must be unique within the realm.

#### **Description**

It specifies any concise description that helps you in identifying the purpose of the profile.

#### **Global**

It indicates that the Client Profile is pre-configured in ZTrust by default.&#x20;

These profiles are pre-configured to align with standard security profiles such as FAPI and OAuth 2.1, simplifying the process for administrators to ensure their client applications comply with specific security profiles.&#x20;

If you've created a new Client Profile, it's not global.

If you wish to remove a specific client policy that is no longer necessary, select the Delete option.&#x20;

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fx0ngD60E0pEDP5sodZkr%2F3.png?alt=media&#x26;token=c154af02-ce11-45d5-a302-d36949e945b4" alt=""><figcaption></figcaption></figure>

Upon clicking Delete, you'll be prompted to confirm your decision.&#x20;

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FDHkRRHfPH1Uq1XO7pEhg%2F4.png?alt=media&#x26;token=05404fdf-509c-4785-abc3-60330dd8c9d2" alt=""><figcaption></figcaption></figure>

Choose Delete to proceed with removal, or select Cancel to retain the policy.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FgOilWyshNkxShWKbV6fx%2F5.png?alt=media&#x26;token=17932073-bc3a-4209-b654-75e676509154" alt=""><figcaption></figcaption></figure>

To create a new Client Profile, click on Create client profile.

On clicking on Create client profile, the following screen will appear.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FUEiuLBM9XZcu7312jfPQ%2F6.png?alt=media&#x26;token=e117a181-f844-4f13-8b3e-b060e8bfce26" alt=""><figcaption></figcaption></figure>

#### **Client profile name**

This denotes the Name of the Client Profile, which must be unique within the realm.&#x20;

You can select any name that you prefer.

#### **Description**

Enter any brief description that helps you in identifying the purpose of the profile.

#### **Save**

To create a Client Profile with the specified Name and Description, simply click on Save to apply those details.

You will get the below screen once you click on Save.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FXUtmj40F5fFaw0k1ASbm%2F7.png?alt=media&#x26;token=491bb242-d57d-441c-979a-6b60b52b7458" alt=""><figcaption></figcaption></figure>

#### **Executors**

Executors determine the action taken on a client that has adopted a client policy.&#x20;

This includes the Executors that will be enforced for this Client Profile.

To add Executors, click on Add executor.

Afterward, the subsequent screen will be displayed.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FbQuu1oqNdTlVzbzgco6H%2F8.png?alt=media&#x26;token=4f816dea-dd39-43b4-93da-60a7030be227" alt=""><figcaption></figcaption></figure>

#### **Executor Type**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FstcAgrVEyziVUbIokenw%2F9.png?alt=media&#x26;token=47c256c2-8727-4651-8d3d-295a2c885d22" alt=""><figcaption></figcaption></figure>

This indicates the type of Executor that you wish to add to this profile.&#x20;

You can choose the desired option from the dropdown menu.

You can consult the table below to observe the various executors and their functionalities.

<table><thead><tr><th width="202">Executor Type</th><th>Description</th></tr></thead><tbody><tr><td>confidential-client</td><td>At the authorization and token endpoints, this executor verifies if the client is a confidential client. If it is not, the request is denied.</td></tr><tr><td>consent-required</td><td>When present, registered or updated clients will undergo verification to ensure that the ConsentRequired switch is enabled. Subsequently, they will be automatically configured to have the ConsentRequired switch enabled.</td></tr><tr><td>full-scope-disabled</td><td>When present, registered or updated clients will undergo verification to ensure that the fullScopeAllowed switch is disabled. Consequently, they will be automatically configured to have the fullScopeAllowed switch disabled.</td></tr><tr><td>holder-of-key-enforcer</td><td>It prevents clients whose MTLS certificate does not match the certificate thumbprint from accessing tokens.</td></tr><tr><td>intent-client-bind-checker</td><td>The executor verifies whether the openbanking_intent_id is associated with a client.</td></tr><tr><td>pkce-enforcer</td><td>It ensures that the client enforces the use of Proof Key for Code Exchange (PKCE) operations with a secure algorithm such as S256.</td></tr><tr><td>reject-request</td><td>It declines all requests originating from clients.</td></tr><tr><td>reject-ropc-grant</td><td>It configures ZTrust to decline resource owner password credentials grant requests.</td></tr><tr><td>secure-ciba-req-sig-algorithm</td><td>The server rejects clients whose signature algorithms are deemed insecure. This is enforced for CIBA backchannel signed authentication requests. It only accepts ES256, ES384, ES512, PS256, PS384, and PS512 algorithms.</td></tr><tr><td>secure-ciba-session</td><td>To differentiate between authentications corresponding to different CIBA flows, it declines backchannel authentication requests that lack the binding_message parameter.</td></tr><tr><td>secure-ciba-signed-authn-req</td><td>This executor verifies if the client adheres to the Financial-grade API CIBA Security Profile by including signed authentication in its CIBA backchannel authentication request.</td></tr><tr><td>secure-client-authenticator</td><td>It ensures that the client enforces the registration or updating of secure client authentication.</td></tr><tr><td>secure-client-uris</td><td>It prevents clients from registering or specifying URIs with the HTTP scheme.</td></tr><tr><td>secure-logout</td><td>It mandates specific requirements regarding how clients should handle logout.</td></tr><tr><td>secure-request-object</td><td>This executor verifies if the client includes the request object in its authorization request in accordance with the Financial-grade API security profile : Read and Write API Security Profile.</td></tr><tr><td>secure-response-type</td><td>The executor examines whether the client has sent its authorization request with either code id_token or code id_token in its response type, depending on its configuration.</td></tr><tr><td>secure-session</td><td>To thwart CSRF attacks, it rejects the client's authorization request if it lacks the <a href="../../../../user-manual-ztrust-v2.0/key-terminologies#nonce">nonce</a> parameter in OIDC flow or the state parameter in OAuth2 grant.</td></tr><tr><td>secure-signature-algorithm</td><td>The server rejects clients whose signature algorithms are deemed insecure. This applies to signing ID Token, Userinfo, and Access Token. Additionally, it is used by the client for the Token endpoint Authentication signature algorithm (for JWT Client Authenticators) and OIDC Request objects. Secure algorithms accepted include ES256, ES384, ES512, PS256, PS384, and PS512.</td></tr><tr><td>secure-signature-algorithm-signed-jwt</td><td>Clients whose JWT token signature algorithms are deemed insecure are rejected. Secure algorithms accepted include ES256, ES384, ES512, PS256, PS384, and PS512.</td></tr><tr><td>suppress-refresh-token-rotation</td><td>During token refresh, a refreshed refresh token is not returned to the client.</td></tr></tbody></table>

#### **Add**

To save the executor, click on Add.

#### **Cancel**

If you do not want to apply any changes, click on Cancel to discard them.

After clicking on Add, the following table will be presented.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FOxV5XboeKJk7G4KZNgCq%2F10.png?alt=media&#x26;token=963299a3-5585-4739-b49f-52796bac6491" alt=""><figcaption></figcaption></figure>

#### **Delete**

If you no longer need that specific Executor, click on Delete to remove it.

Upon clicking on Delete, you will be prompted with the following confirmation message.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fp1dQ8JoUU25ZZtM5zuhI%2F11.png?alt=media&#x26;token=78b03e62-8138-4958-8203-732f036cdc5e" alt=""><figcaption></figcaption></figure>

Choose Delete to proceed with removing the Executor, or click Cancel if you wish to retain it.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F03MPZNiXcPgxbVidzIKQ%2F12.png?alt=media&#x26;token=4c2026a2-e96c-4a27-a4b3-4cf56971e0ed" alt=""><figcaption></figcaption></figure>

If you've made some changes but wish to discard them and revert to the previous settings, click on Reload.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FipwdKaxiAX6VSLcvjNEE%2F13.png?alt=media&#x26;token=d24487d8-4b14-4220-8f70-da83e7fe33cd" alt=""><figcaption></figcaption></figure>

This displays the JSON Editor for the Client Profiles and Executors found in the Form View within the Profiles section.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FKd5tWaojeLziGprBcQ6z%2F14.png?alt=media&#x26;token=dc45753d-cef4-40e4-87a6-3dd15eb1b202" alt=""><figcaption></figcaption></figure>

Within the Policies section, you can link Client Profiles with different conditions to specify precisely when the behavior enforced by Executors of that specific Client Profile is applied.

To initiate the creation of a new client policy, select Create client policy.

You will be redirected to the below screen.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F881FBMYBZpA7517h35sb%2F15.png?alt=media&#x26;token=eadf2537-5c86-49d7-ae4c-19a3205a6073" alt=""><figcaption></figcaption></figure>

#### **Name**

This refers to the Name of the Client Policy. It is unique within a Realm, without any duplication.

#### **Description**

This field helps to identify the purpose of the Client Policy for which it has been created.

#### **Save**

Once you've filled in the required fields, click on Save to implement those changes.

After clicking on Save, you'll be directed to the following screen.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FKIa0TVPsK94eoiOisTe5%2F16.png?alt=media&#x26;token=b465ae5f-d2dd-473e-a9b8-e76b04f54bee" alt=""><figcaption></figcaption></figure>

#### **Reload**

If you've entered details for the required fields but choose not to save, click on Reload.

#### **Conditions**

This pertains to the conditions that will be assessed to decide whether the Client Policy should be applied during a specific action or not.

Click on Add condition to add a new condition to this Policy.

#### **Create**

Upon clicking on Add condition, you'll be directed to the screen below.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FagJVdvYH7x8kp1kM064D%2F17.png?alt=media&#x26;token=3942d0e8-c037-45b8-892c-07b43a1e9424" alt=""><figcaption></figcaption></figure>

#### **Condition type**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F4zPLkY765QzaGyai8lrF%2F18.png?alt=media&#x26;token=e8f6bf67-6cc5-40d2-bdd2-aaa779582c41" alt=""><figcaption></figcaption></figure>

This indicates the type of Condition you wish to apply to this policy.

You can choose the necessary option from the dropdown menu based on your needs.

#### **Negative Logic**

This toggle button, when enabled (turned ON), reverses the results from the evaluation of the condition from True to False or vice versa.&#x20;

If deactivated (turned OFF), there is no reversal of results.

You can consult the table below to view the various conditions and their corresponding descriptions.

<table><thead><tr><th width="230">Condition Type</th><th>Description</th></tr></thead><tbody><tr><td>any-client</td><td>This condition applies to any client during any event.</td></tr><tr><td>client-access-type</td><td>It utilizes the client's access type (confidential, public, bearer-only) to determine the application of the policy. This condition is assessed during the majority of OpenID Connect requests, including Authorization requests, token requests, and introspection endpoint requests.</td></tr><tr><td>client-roles</td><td>This condition verifies the presence of one of the specified client roles on the client to determine the application of the policy. This enables the client administrator to create a client role with the specified name on the client, ensuring that a specific client policy will be applied to the requests from this client. This condition is evaluated during most OpenID Connect requests, including Authorization requests, token requests, introspection endpoint requests, etc.</td></tr><tr><td>client-scopes</td><td>It relies on the scopes requested or pre-assigned to the client to determine whether the policy is applied. This condition is assessed during the OpenID Connect authorization request and/or token request.</td></tr><tr><td>client-updater-context</td><td>The condition examines the context of how the client is created or updated to determine whether the policy is applied.</td></tr><tr><td>client-updater-source-groups</td><td>The conditions assess the group of the entity attempting to create or update the client to determine whether the policy is applied.</td></tr><tr><td>client-updater-source-host</td><td>This condition examines the host/domain of the entity attempting to create or update the client to determine whether the policy is applied.</td></tr><tr><td>client-updater-source-roles</td><td>The condition assesses the role of the entity attempting to create or update the client to determine whether the policy is applied.</td></tr></tbody></table>

#### **Add**

If you've entered the necessary details and wish to apply those changes, select Add.

#### **Cancel**

If you prefer not to save your modifications, click on Cancel to discard your changes.

If you opt not to create the Condition, selecting Cancel will return you to the screen displayed below.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FNxvYLWBOYNu5IlQaO2fk%2F19.png?alt=media&#x26;token=374e06dd-0228-4163-950e-71f9635a5f06" alt=""><figcaption></figcaption></figure>

Clicking on Add will redirect you to the screen above, with the condition added under the Conditions tab.&#x20;

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FdeQ8d96o1zgkvC2GJwQ7%2F20.png?alt=media&#x26;token=65d4c663-eec9-4e4d-ab7b-421e991ecf6c" alt=""><figcaption></figcaption></figure>

#### **Delete**

If you no longer require a specific condition, choose Delete to remove it.

Following this action, a confirmation prompt will be displayed as depicted below.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F9A2iWCAPbZB0e38efTKE%2F21.png?alt=media&#x26;token=a52ac813-bdbf-4c57-9089-c9385ef47498" alt=""><figcaption></figcaption></figure>

Choose Delete if you want to remove it, otherwise select Cancel.

#### **Client Profiles**

It lists the Client Profiles that are applied to this Policy.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FtLcqSbytcjFeSuaQRLQv%2F22.png?alt=media&#x26;token=9faa2a95-9366-4825-b200-6bfddc00ab7d" alt=""><figcaption></figcaption></figure>

Click on Add Client Profile and choose the desired option from the menu.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FnxFEq5tKv1tNfEY8P3Hp%2F24.png?alt=media&#x26;token=f0cf8625-fc74-4f15-bcc3-5e02a79c280d" alt=""><figcaption></figcaption></figure>

It will display a list containing all the Client Profiles existing within the Realm.

#### **Name**

This refers to the Name of the Client Profile, which is unique within a Realm.

#### **Description**

It specifies any concise description that helps you in identifying the purpose of the profile.

Click the Refresh button to see the latest settings.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FbAXAqNK9NLwdoIXFNJ8Z%2F25.png?alt=media&#x26;token=060d9ac8-8d26-4fd4-9660-775c1060a6bf" alt=""><figcaption></figcaption></figure>

You can also choose how many client profiles you want to display on one screen. Select your preferred option from the dropdown menu as shown above.

You can use the search box to find a specific profile.

To select a specific client profile, click on the checkbox next to that client profile, then click on Add.

You will be redirected to the below screen, with the selected profile added under the Client profiles tab.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FprsVt55hmZZtdJLjm8PD%2F26.png?alt=media&#x26;token=4e93ec15-d38e-4be0-8dee-7a426dcdd09e" alt=""><figcaption></figcaption></figure>

If you wish to eliminate a specific profile applied to this policy, select the delete icon.

You'll receive a prompt below requesting confirmation.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FlllGHwSQiwW3E1qIittb%2F27.png?alt=media&#x26;token=a4ee6263-03cb-4035-a00c-7f7f1e35e070" alt=""><figcaption></figcaption></figure>

Choose Delete if you want to remove the profile, otherwise, click Cancel.

<br>
