# Rules examples

This page contains a few useful Perl expressions you can use in your Handler rules, SAML/OIDC/CAS security rules, 2FA Activation rules, etc.

## Using session attributes

Session attributes are visible in the Manager’s Session browser, any attribute you see there can be used in a rule!

- Restricting access to a single user:

    $uid eq "dwho"
    $uidNumber == 1000
    $cn eq "Doctor Who"
    $email eq "dwho\@badwolf.org"
    etc.

Tip

In Perl, `eq` means Equal and must be used on strings. `==` should be used only on numbers

Danger

In Perl, `@` character means an array and `%` a hash! If you want to write a macro with these characters, you have to escape them like this:

    $my_email = "$uid\@my-domain.com"
    $percent = "$rate\%more"

- Restricting access to specific groups

    # 2.0.8 and higher only
    inGroup('administrators')

    # older versions
    $groups =~ /\b(?:admins|su)\b/ # admins OR su
    $groups =~ /\badmin_[1-3a]\b/ # admin_1 OR admin_2 OR admin_3 OR admin_a

    defined $hGroups->{'administrators'}

- Combining multiple expressions

    inGroup('timelords') and not $uid eq 'missy'

- Using Perl’s regular expressions

    $cn =~ /^Doctor.*/i
    $email !~ /\@spam.com$/

- Filtering on Authentication Level

    $authenticationLevel >= 3

- Filtering on IP subnet

    # since 2.17
    inSubnet('192.168.0.0/16')

- Filtering on Authentication method

    $_auth ne 'Demo'

- Checking if the user has a an available second factor.

    # Since 2.0.10
    has2f()
    has2f('TOTP')
    has2f('TOTP') or has2f('UBK')

    # Before 2.0.10
    $_2fDevices =~ /"type":\s*"TOTP"/s

Tip

In Perl, `ne` means Not Equal and must be used on strings. `\b` means word Boundary. (?:) means non capturing parenthesis.

## Using environment variables

- Comparing the IP address

    # Before 2.17
    $env->{REMOTE_ADDR} =~ /^10\./

    # Since 2.17
    inSubnet('10.0.0.0/8')

- Comparing requested URI

    $env->{REQUEST_URI} =~ /test/