I am looking at a decryption/access policy created long before I joined the network team and try to understand the outcome.
The policy says:
Identification Profiles
Name = Hacking, Autenticate users by Active Directory, Use Kerberos, NTLMSSP or Basic
Auth Surrogate = IP addr, Member subnets - Empty, Member Protocols = HTTP/HTTPS
Proxy ports - Empty, User Agents - Empty, URL Category = Hacking
-------------------------------------------------------------------------------------------
Decryption Policy
Group:
Name = Hacking, Identification Profile = Hacking,
Selected Groups and Users; Groups - EMPTY, Realm = Example-Domain, Users = Example-Domain\username
Proxy Ports - none selected, Subnets - none selected, Time Range - Not defined
User Agents - none selected, URL Categories = URL Categories Hacking in Identification Profile Hacking
URL Filtering: Category - Hacking > Monitor
Web Reputation = Global Policy (Enabled)
Default Action = Global Policy (Pass Through)
The Global policy Have drop for category Hacking
-------------------------------------------------------------------------------------------
Access Policy
Group:
Name = Hacking, Identification Profile = Hacking,
Selected Groups and Users; Groups - EMPTY, Realm = Domain, Users = Domain\username
Protocols = HTTP/HTTPS/FTP over HTTP in Identification Profile Hacking
Proxy Ports - none selected, Subnets - none selected, Time Range - Not defined
User Agents - none selected, URL Categories = URL Categories Hacking in Identification Profile Hacking
Protocols and User Agents = Global Policy (No Blocked items)
URL Filtering: Category - Hacking > Monitor
Applications = Global Policy (most applications allowed)
Objects = Global Policy (No Blocked items)
Anti-Malware and Reputation = Global Policy (both enabled)
The Global policy Have drop for category Hacking
-------------------------------------------------------------------------------------------
From what I can see we require autentication for visitors to websites of the category Hacking.
Unless you are the user listed in the "Hacking policy" you will end up on the Global Policy and
be blocked from visiting the site.
If this is correctly setup the policy named Hacking will require Autentification for the specific URL Category Hacking.
Now, back to the quote about Identification Profiles from the user guide:
"If you need to define membership by URL category, only define it in the Identity group when you need to exempt from authentication requests to that category."
According to this statement the above config is wrong because we are not exempting the Identity group from authentication. So what is the meaning of the quote? It must be of some importance since the user guide explicitly spell it out. Why only define URL category for the purpose of exempting from autentication?
In my example above the purpose is to trigger autentication not to exempt from autentication.
