Manual Chapter : About per-request policy subroutines

Applies To:

Show Versions Show Versions


  • 15.0.1, 15.0.0
Manual Chapter

About per-request policy subroutines

A per-request policy
is a collection of actions. What distinguishes a subroutine from other collections of actions (such as macros), is that a subroutine starts a subsession that, for its duration, controls user access to specified resources. If a subroutine has an established subsession, subroutine execution is skipped. A subroutine is therefore useful for cases that require user interaction (such as a confirmation dialog or a step-up authentication), since it allows skipping that interaction in a subsequent access.
You cannot use subroutines in macros within per-request policies.
Subroutine properties specify subsession timeout values, maximum macro loop count, and gating criteria. You can reauthenticate, check for changes on the client, or take other actions based on timeouts or gating criteria.