Forming condition expressions using CEL

ConductorOne’s conditional policies use the Common Expression Language (CEL) built by Google. As you work with CEL, you might find these references useful:

• Introduction to CEL

• Full CEL language definition

A basic CEL expression is made up of conditions and function calls, with references to global variables.

Functions

These library functions let you interact with the ConductorOne system to look up whether a user has access to a certain application or entitlement, or to find the user or list of users who should review a task.

Objects

When writing a condition expression or an approval step expression, you have the “subject” variable (which refers to the ConductorOne user) in scope.

Use custom user attributes. You can write conditional expressions that leverage the custom user attributes you’ve set up in ConductorOne. Any custom user attribute can be passed in to the subject.profile.<CUSTOM USER ATTRIBUTE> property and used in your conditional expressions.

Operators

CEL supports common Boolean operators, like !, <, >, <=, >=, ||, &&, ==, !=, and in. All operators work as they do in C, and in functions as a “list contains” operator.

CEL allows for basic arithmetic operations, with +, -, *, and \ for adding, subtracting, multiplying, and dividing.

CEL also supports ternary operators, similar to C or JavaScript. These are formed as “If this ? then check this : otherwise check this”.

Example condition expressions

Expressions that return a Boolean

Check that the subject’s email is “cheddar.crackers@company.com”:

subject.email == "cheddar.crackers@company.com"

Check that the user’s email address starts with “engineering”:

subject.email.startsWith("engineering")

Check that the user’s email address ends with “@company.com”:

subject.email.endsWith("@company.com")

Check that the user’s email address doesn’t end with “@company.com”:

!subject.email.endsWith("@company.com")

Check that the subject’s favorite food is macaroni:

subject.profile.favorite_food == "macaroni"

Check that the subject’s favorite foods include sushi:

"Sushi" in subject.profile.favorite_foods

Check if the user is enabled in the directory:

subject.directory_status == USER_STATUS_ENABLED

Check that the user status is enabled and the department is IT:

subject.status == USER_STATUS_ENABLED && subject.department == "IT"

Check that the user’s status is disabled or suspended, and their department is “ENG”:

(subject.status == USER_STATUS_DISABLED || subject.status == USER_STATUS_SUSPENDED) 
&& subject.department == "ENG"

Check that the user has access to the app with that ID:

c1.user.v1.HasApp(subject, "2SWtmlkdW0dtROVwIN0zYthXIud") <APP ID>

Check that the user doesn’t have that app, and their department is engineering:

!c1.user.v1.HasApp(subject, "2SWtmlkdW0dtROVwIN0zYthXIud") 
&& subject.department == "Engineering"

Check if the subject’s employment type is full time:

subject.employment_type == "Full Time"

Check that the user has the entitlement in that app:

c1.user.v1.HasEntitlement(subject, "2SWtmlkdW0dtROVwIN0zYthXIud", 
"2SWtwwe5n7AOXhRBRNK1fUakc4F")

If the subject has the director profile attribute, check that the director is Holly. Otherwise, check that their manager is Ivy:

has(subject.profile.director) ? subject.profile.director == 
"holly.berry@company.com" : subject.profile.manager == "ivy.vine@company.com"

If the subject’s employee status is ENABLED, check that their department is Engineering, otherwise check that their last date active was April 1, 2024:

subject.employee_status == EMPLOYEE_STATUS_ENABLED ? subject.profile.department == 
"Engineering" : subject.profile.last_date_active == "04/1/2024"

Check whether an entitlement is granted to a user as part of an access profile:

c1.user.v1.GrantedFromEnrollment(subject, entitlement.app_id, entitlement.id)

Expressions that return a user

Return the subject user’s director:

c1.directory.users.v1.FindByEmail(subject.profile.director)

Return the subject user’s manager:

c1.directory.users.v1.FindByEmail(subject.profile.manager)

Return the subject outright, meaning they’ll have to self approve:

subject

If the subject is in the IT department, return themselves, otherwise return their manager:

subject.profile.department == "IT" ? subject : c1.directory.users.v1.FindByEmail(subject.profile.manager)

If the user has the prop_that_only_exists_sometimes, check its value. If the value matches, find the user by email. If it doesn’t match, find a user by ID. If the user doesn’t have that prop, return a separate user:

has(subject.profile.prop_that_only_exists_sometimes) ? subject.profile.prop_that_only_exists_sometimes == "Value That Happens" ? c1.directory.users.v1.FindByEmail("some.email@insulator.one") : c1.directory.users.v1.GetByID("012345678901234567890123456") : c1.directory.users.v1.GetByID("999999999977777777773333333")

Pre-built policy condition expressions

You can add condition expressions to two places in a policy:

Policy condition expressions determine what action the policy will take. They must return a Boolean.

Reviewer condition expressions determine who will review a task. They must return a list of users.

Here are some basic conditional policy use cases and their corresponding condition expressions. You can use these expressions as-is, or adapt them to suit your organization’s needs.

Pre-approve access based on group membership

Use case

If a user has an active account in Okta, and they currently have the Admin role in Jira, they can be automatically approved for the Admin role in Confluence.

Condition expression

c1.user.v1.HasApp(subject, "<APP ID>") && 
c1.user.v1.HasEntitlement(subject, "<APP ID>", "<ENTITLEMENT ID>")

Go to an application or entitlement’s details page to look up its ID, or use Cone.

Pre-approve access for employees who are currently on call

Use case

If a user is currently in a PagerDuty on-call rotation, they can be automatically approved for AWS S3 read access.

Condition expression

c1.user.v1.HasEntitlement(subject, "<APP ID>", "<SCHEDULE 1 ENTITLEMENT ID") || 
c1.user.v1.HasEntitlement(subject, "<APP ID>", "<SCHEDULE 2 ENTITLEMENT ID")

Auto-certify low-risk access

Use case

If a user has an active account in Google Workspace, and they are in the Engineering department, their GitHub access is automatically certified.

Condition expression

c1.user.v1.HasApp(subject, "<APP ID>") && 
subject.department == "<DEPARTMENT>"

Custom review flow for contractors

Use case

Access reviews for contractors (whose email addresses all end in @contract.company.com) are automatically assigned to their current manager, while all full-time employees (whose email addresses all end in @company.com) complete a self-evaluation.

Condition expression

!subject.email.endsWith("@company.com")

Proactively check for potential access conflicts

Use cases

Check if the requested access would create any access conflict and route the request to the security team for review if so.

Check if the requested access would create a specific access conflict and auto-deny the request if so.

Condition expressions

//would create an access conflict
task.analysis.conflict_violations

//would create a specific access conflict
`2mw8cxniKGdpndC9GJ5RVwQPnEg` in task.analysis.conflict_violations