Skip to main content

Rules

A Rule defines how USP Server authenticates partner connections, manages credentials during the proxying process, and optionally applies in-line content scanning using an ICAP server. More specifically, a Rule defines:

  • The authentication method required for external incoming connections (e.g., password or public key).
  • The authentication source used to verify the credentials provided by the external partner (e.g., LDAP or Account Repository).
  • The credential source used to authenticate outbound connections to internal targets.
  • An optional ICAP Scanner used to inspect file content before it is forwarded to the internal target.

Rules sit between Inbound Nodes and Outbound Nodes, defining how credentials are handled as connections traverse the proxy boundary.

Before You Begin​

Authentication​

Authentication within a Rule is defined by three settings:

SettingDescription
Inbound Authentication MethodUsed to inform the inbound client what authentication methods are expected, regardless of whether single or double authentication is performed.
Inbound Authentication Source

Determines whether USP authenticates inbound connections.

When authentication is enabled, USP validates the credentials against the selected source: either an internal Account Repository or an external LDAP directory.

Outbound Credential SourceSpecifies the credentials USP must use when authenticating to the internal target. These can either be the same credentials provided by the inbound client (passthrough) or a dedicated set of credentials.

These three authentication settings work together to determine how USP authenticates the external partner on the inbound connection and how it then authenticates to the internal target on the outbound connection.

However, supported authentication methods and valid combinations vary depending on the protocol. Not all protocols support the same inbound methods, identity sources, or outbound credential scenarios.

For a complete reference of valid protocol-specific combinations, see Rules Possible Configuration Scenarios.

Inbound Authentication Methods​

The Inbound Authentication Methods field defines how the USP Server authenticates partner connections before forwarding them to the internal target.

FTP(S) supports only a single authentication method:

  • Basic: The partner authenticates using a username and password sent over the protocol's standard FTP(S) authentication commands.
warning

Because only Basic authentication is available for FTP(S), the USP Admin UI does not display a field for selecting the Inbound Authentication Methods. However, partners must still provide valid credentials when connecting.

Inbound Authentication Source​

This setting determines whether USP validates inbound partner credentials, and, if validation is enabled, where those credentials are checked.

Use the Authentication at the Proxy toggle to enable or disable inbound authentication:

  • Disabled: USP does not authenticate inbound connections.
  • Enabled: Inbound connections are authenticated in the proxy. Therefore, you must specify an authentication source, either:
    • Account Repository: Validates credentials against a local repository.
    • LDAP: Validates credentials via an LDAP server (only supports password authentication).
info
  • To use Account Repository authentication, you must first create so it can be selected from the Account Repository dropdown.
  • To use LDAP authentication, you must first create an LDAP Query and an LDAP Connection.

Outbound Authentication Source​

This option defines how the USP Server obtains credentials for outbound connections to internal targets. While it supports reusing inbound credentials, it also allows the configuration of dedicated outbound credentials. Dedicated outbound credentials allow you to separate how clients authenticate to USP (inbound) from how USP authenticates to internal targets (outbound).

The available options are:

  • Passthrough Credentials: Uses the same username and password supplied by the client during inbound authentication for the outbound connection to the internal target.
  • Dedicated Credentials: Uses a predefined username and password specified in the Rule configuration. This method is typically used when the USP Server authenticates to internal systems using a shared or service-specific account.

ICAP Scanning​

To enable in-line file inspection, a Rule can be configured to use an ICAP Scanner. When associated with a Rule, the ICAP Scanner is applied to all file transfers matched by that Rule, allowing content to be scanned before it reaches the USP Server instance.

An ICAP Scanner must be associated with a Rule for ICAP scanning to be operational. The same ICAP Scanner can be reused across multiple Rules to enforce consistent scanning policies throughout your deployment.

Rule Administration via USP Admin UI​

Adding a Rule​

To add a Rule, follow these steps:

  1. From the Sidebar, click Configuration > Rules.
  2. Click the protocol card you want.
  3. Click Add Rule.
  4. Complete the details for the new Rule using the Field Descriptions table as a guide.
  5. Click Save.

Field Descriptions​

info

Some fields and options dynamically appear or hide based on your selections in related fields.

NameDescriptionSpecificationsRequired
NameThe name of the Rule.Must be unique.Yes
DescriptionThe description of the Rule.No
Inbound Authentication Methods

The authentication method that the Inbound Node uses.

Options:

  • None
  • Basic

Default value: Basic

Yes
Authentication at the ProxyEnables or disables inbound authentication.Yes
Inbound Authentication Source

The source from which inbound credentials are validated.

Options:

  • Account Repository
  • LDAP
Yes, if Authentication at the Proxy is enabled.
Account RepositoryThe account collection to use for inbound credentials authentication.Must reference an already-created Account Repository.Yes, if Inbound Authentication Source is Account Repository.
LDAP QueryThe LDAP Query used for inbound credentials authentication.Must reference an already-created LDAP Query.Yes, if Inbound Authentication Source is LDAP.
LDAP ConnectionThe LDAP Connection used for inbound credentials authentication.Must reference an already-created LDAP Connection.Yes, if Inbound Authentication Source is LDAP.
Outbound Authentication Source

The source of credentials for outbound connections to internal targets.

Options:

  • Passthrough
  • Dedicated
Yes
Outbound UsernameUsername for the internal target.Yes, if Outbound Authentication Source is Dedicated Credentials.
Outbound PasswordPassword for the internal target.Yes, if Outbound Authentication Source is Dedicated Credentials, at least one of the following must be provided: Outbound Password or Private Key for Outbound Connection.
ICAP ScannerThe ICAP Scanner used to inspect file content during in-line transfers.Must reference an already-created ICAP Scanner.No

Editing a Rule​

To edit a Rule, follow these steps:

  1. From the Sidebar, click Configuration > Rules.
  2. Click the row of the Rule you want to edit.
  3. Click the Edit button above the Rule details.
  4. Edit the details of the Rule using the Field Descriptions table above as a guide.
  5. Click Save.
warning

If you modify a Rule that is currently in use by a USP Server instance, the changes will not take effect until you manually apply the updated configuration by pushing it to the server. To apply the changes:

  1. Navigate to Monitoring > Status.
  2. Click the Name of the associated USP Server instance.
  3. Go to the Configuration tab.
  4. Review the pending changes in the Updated Configuration column.
  5. If the changes are correct, click Push Configuration.

Rule Metadata​

Rule details include all parameters given in the Field Descriptions table above, plus the following read-only metadata:

NameDescription
IDUniversally Unique Identifier of this Rule.
Created AtDate and time this Rule was created.
Updated AtDate and time this Rule was last updated.

Deleting a Rule​

To delete a Rule, follow these steps:

  1. From the Sidebar, click Configuration > Rules.
  2. Click the row of the Rule you want to delete.
  3. Click Delete.
  4. You will be asked to confirm the deletion. Click Delete.
warning

USP Manager prevents deletion of a Rule if it is currently referenced by an Inbound Node.

Additionally, if the Rule is used by a USP Server instance, the updated configuration must be manually applied. To apply the changes:

  1. Navigate to Monitoring > Status.
  2. Click the Name of the associated USP Server instance.
  3. Go to the Configuration tab.
  4. Review the pending changes in the Candidate Configuration - Preview section.
  5. If the changes are correct, click Push Configuration.

The changes do not take effect on the server until this step is completed.