Create Authentication Policy with Time Restriction
Last Updated:
Overview
In Okta Identity Engine (OIE) use expressions to Allow, Challenge or Deny access to applications, and the OIE Okta Expression Language (OEL) allows DateTime functions to be used for custom policy rules.
Any expression used will be evaluated during authentication to the app that has the policy applied.
Applies To
- Okta Expression Language
- Authentication
- Policy
- Rule
Solution
The example below can be used to deny access between 10PM and 10AM the next day since it will return TRUE for any hour that is lower or equal to 10 (from 00:00 to 10:00) or higher or equal to 22 (from 22:00 to 23:59 since it jumps to 00:00 after).
DateTime.now().toZone('America/Los_Angeles').toString('HH').toInteger() <= 10 OR DateTime.now().toZone('America/Los_Angeles').toString('HH').toInteger() >= 22
To capture consecutive hours, that do not go around after midnight, use the below format.
This will return TRUE for hours that are strictly between 7PM and 10PM, if the hour is bigger or equal to 19:00 while still being under 22:00.
DateTime.now().toZone('America/Los_Angeles').toString('HH').toInteger() >= 19 AND DateTime.now().toZone('America/Los_Angeles').toString('HH').toInteger() <= 22
NOTE: In this example, 'America/Los_Angeles' timezone which is PST is referenced, refer to the Time zone codes documentation.
