# 4.8 Time Fencing Configuration

Time Fencing is a security feature that restricts user login access to specific time windows, days, and date ranges. This control mechanism ensures that users can only access systems during their designated login periods. Any login attempt outside the configured time frame will be denied.

**Use Case Example:**&#x20;

Suppose users are allowed to log in during a certain time period such as:

* From **Monday** to **Friday**, between **09:00 AM** and **06:00 PM**, and only from **August 1st** to **August 10th, 2025**.
* If a user tries to log in on a Saturday or outside the **09:00**–**18:00** window, **ZTrust** will block the login and deny access.

**Important:**\
Time Fencing can be configured at two levels:

1. **Realm-Level** Time Fencing – Applies to all users present in the **realm**.
2. **Group-Level** Time Fencing – Applies only to specific user assigned to the **groups**.

**Note**:&#x20;If a user is assigned both realm-level and group-level time fencing, the group-level configuration takes priority.

**Key Features:**

* **Two-Level Configuration** → Realm-level and group-level fencing available.
* **Time-Based Control** → Define allowed login time slots (e.g., **09:00–17:00**).
* **Day-Based Restriction** → Restrict logins to specific weekdays (e.g., **Monday–Friday** only).
* **Date Range Enforcement** → Allow logins only within valid date ranges (e.g., **1st Aug to 10th Aug**).
* **Visual Calendar Interface** → Configure rules easily using an **interactive calendar.**

1. **Realm-level Time Fencing:**

Realm-level time fencing applies to all users in the realm unless overridden by group-level settings.

**Step 1 — Enable Time Fencing in the Authentication Flow**

* Go to the Admin Console → **Authentication** section.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FRxkxNjxpzU5Rv5X7gSo7%2Fimage.png?alt=media&#x26;token=c3a95029-53ba-4a27-87b9-494e6adb32c8" alt=""><figcaption><p>Fig 4.8.a: Choose realm and choose Authentication section in side bar</p></figcaption></figure>

* Open the **Authentication** tab.
* Create a **duplicate** of the existing browser flow.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FwCpR9rilEiTY11ybiojS%2Fimage.png?alt=media&#x26;token=34134179-0992-4b81-82c3-465c7f2562cb" alt=""><figcaption><p>Fig 4.8.b: In Flow tab duplicate the browser flow</p></figcaption></figure>

* Name it, for example: Time Fencing Browser Flow.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fvihnh3Z8bDWjuxarI13S%2Fimage.png?alt=media&#x26;token=a77ea383-6743-4206-82ba-474e61ccbf4d" alt=""><figcaption><p>Fig 4.8.c: Confirm to duplicate</p></figcaption></figure>

* Inside the new flow

  * Click **Add Execution**.
  * Choose Time Fencing Authenticator from the list.

  <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F50CDvJbmNsZFEtUHQXz8%2Fimage.png?alt=media&#x26;token=5787400a-c6d7-48d9-80a8-332da8e08fd2" alt=""><figcaption><p>Fig 4.8.d: Choose Time based login fencing </p></figcaption></figure>

  * Set it under Username Password Form.
  * Set Requirement to Required.

  <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FBC1lPPeTPms88dln4lRF%2Fimage.png?alt=media&#x26;token=7df5ea57-0a78-46b5-b368-737136ed0bd8" alt=""><figcaption><p>Fig 4.8.e: Make it as required </p></figcaption></figure>

  Note: **"**&#x53;etting this as Required ensures every login attempt is checked against the realm-level configuratio&#x6E;**"**.

#### Step 2 — Configure Realm-Level Time Fencing

* Need to configure the settings directly in the Time-Based-Login-Fencing config form.
* Here admin need to set up the following fields:

  * **Alias** → A unique name for this configuration.
  * **Authenticator Reference** → Optional reference name if needed.
  * **Authenticator Reference Max Age** → Maximum validity period for the authenticator.
  * **Login Start Time** → Define the start time when users are allowed to log in (e.g., 09:00 AM).
  * **Login End Time** → Define the end time when login is allowed (e.g., 06:00 PM).
  * **Timezone** → Select the applicable Timezone for enforcing the login window.
  * **Allowed Login Days** → Choose the days of the week when login is permitted (e.g., Mon–Fri).

  <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F7MweWic0gVFtYjwvVA1o%2Fimage.png?alt=media&#x26;token=531d7118-59f1-48cd-838f-be328e84b662" alt=""><figcaption><p>Fig 4.8.f: Complete the necessary configuration</p></figcaption></figure>
* &#x20;Click Save to apply the realm-wide restrictions.

2. **Group-Level Time Fencing:**&#x20;

Group-level time fencing applies only to users assigned to specific groups and overrides realm-level settings.

**Step 1 — Create or Select a Group**

* Go to the **Groups** section in the Admin Console.
* Click Create **Group** or **select** an existing group.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F3Rf7YqrQyMELkQSM9lmo%2Fimage.png?alt=media&#x26;token=5d819d61-16b9-4ceb-90c3-e8179628723f" alt=""><figcaption><p>Fig 4.8.g: Choose the Groups in side bar</p></figcaption></figure>

**Step 2 — Configure Group-Level Time Fencing**

* Create a group

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FhAkMtMqSkrk1RuvbO7Qd%2Fimage.png?alt=media&#x26;token=8fb6a720-b884-4695-acc7-f96da259a2ff" alt=""><figcaption><p>Fig 4.8.h: Create a new group</p></figcaption></figure>

* Navigate to the **Time Fencing** tab within the **group** settings.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FTKVIJVtiRZG8qsovGiqd%2Fimage.png?alt=media&#x26;token=4673b37a-eccb-4f6d-ad88-d922453aeb12" alt=""><figcaption><p>Fig 4.8.i: Navigate to Time fencing tab</p></figcaption></figure>

* Use the interactive **calendar** to:

  * Define login windows specific to this group.
  * Select allowed **days** (e.g., **Mon–Fri**).
  * Set **start and end** times (e.g., **08:00–17:00**).
  * Specify valid **date ranges**.
  * Add **titles** for each time block if required.

  <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F8WQWSpQ3xT4OCCpykPi3%2Fimage.png?alt=media&#x26;token=5ad8c547-519a-4f9d-897c-4f799323691e" alt=""><figcaption><p>Fig 4.8.j:  Choose days to configure time fencing</p></figcaption></figure>
* Click Save to store the configuration in the group’s attributes.

**Login Behavior After Configuration:**

Once the configurations are saved in the Admin Console, the changes take immediate effect.

1. **Example 1 — Time Window Change**

   Realm/group time changed from 09:00–18:00 to 08:00–17:00:

   1. Login at 08:30 →  **Allowed**
   2. Login at 17:30 →  **Denied**
2. #### Example 2 — Day Restriction Change

   Allowed days changed from Mon-Wed to Thu-Sun:

   1. Login on Friday →  **Allowed**
   2. Login on Monday → **Denied**
