Conditional Access Lab

# ============================================
# POLICY: Block Access from High-Risk Countries
# Name: geo-block-countries
# ============================================

# List of blocked country codes (ISO 3166-1 alpha-2)
# Add/remove countries based on your threat model
BLOCKED_COUNTRIES = [
    "RU",  # Russia
    "CN",  # China
    "KP",  # North Korea
    "IR",  # Iran
]

# Get the GeoIP data from the request context
# Authentik automatically enriches requests with GeoIP
geo_data = request.context.get("geoip", {})
country_code = geo_data.get("country", "")

# Log the access attempt for audit
ak_logger.info(
    f"GeoIP check: User {request.user} from {country_code}"
)

# Return False to DENY access, True to ALLOW
if country_code in BLOCKED_COUNTRIES:
    ak_message("Access denied: Your location is restricted")
    return False

return True

# ============================================
# POLICY: Require MFA for Admin Users
# Name: require-mfa-admins
# ============================================

# Check if user is in the admins group
admin_groups = ["authentik Admins", "IT-Admins"]
user_groups = [g.name for g in request.user.ak_groups.all()]

# Check if user is admin
is_admin = any(g in admin_groups for g in user_groups)

if not is_admin:
    # Not an admin, policy doesn't apply
    return True

# Admin user - check if MFA is configured
mfa_devices = request.user.mfa_devices.filter(confirmed=True)

if not mfa_devices.exists():
    ak_message(
        "Administrators must configure MFA before accessing this application"
    )
    return False

return True

# ============================================
# POLICY: Block Outdated/Insecure Browsers
# Name: block-legacy-browsers
# ============================================

import re

# Get User-Agent from request
user_agent = request.http_request.META.get("HTTP_USER_AGENT", "")

# Patterns for blocked browsers
BLOCKED_PATTERNS = [
    r"MSIE [0-9]",           # Internet Explorer
    r"Trident/",              # IE 11
    r"Chrome/[0-6][0-9]\.",   # Chrome < 70
    r"Firefox/[0-5][0-9]\.",  # Firefox < 60
]

for pattern in BLOCKED_PATTERNS:
    if re.search(pattern, user_agent):
        ak_message(
            "Your browser is outdated. Please update to continue."
        )
        ak_logger.warning(
            f"Blocked legacy browser: {user_agent}"
        )
        return False

return True