Soft website block override

1. A method performed by data processing apparatus, the method comprising:

receiving first user credentials from a user device during a login process that provides a user access to the user device;

identifying, using the first user credentials, a first policy group for the user device and a second policy group for the user device in response to receiving the first user credentials from the user device during the login process;

determining that the first policy group should be associated with the user device based on the receipt of the first user credentials during the login process;

applying the first policy group to communications for the user device;

receiving, from the user device, a request to access a resource;

determining, using the first policy group, that the user device should be prevented from accessing the resource;

providing, to the user device and based on determining that the user device should be prevented from accessing the resource, instructions for presentation of a user interface including a user credentials field;

receiving second user credentials from the user device;

determining that the second user credentials are the same as the first user credentials used during the login process;

determining that the first policy group has a first priority that is lower than a second priority of the second policy group and that the second policy group applies to the request to access the resource, wherein a policy group with a higher priority is always selected over a policy group with a lower priority except during a login process when the higher priority policy group is flagged as not for use during the login process;

determining, using the second policy group, that the user device should be allowed access to the resource; and

allowing the user device access to the resource based on determining that the user device should be allowed access to the resource.

2. The method of claim 1 , wherein determining that the first policy group should be associated with the user device based on the receipt of the first user credentials during the login process comprises determining that the second policy group is flagged as not for use during a login process when a user logs onto the user device.

3. The method of claim 1 , comprising:

applying the second policy group to communications for the user device for a predetermined period of time.

4. The method of claim 3 , comprising:

initiating a timer for the predetermined period of time upon receipt of the user credentials from the user device.

5. The method of claim 3 , comprising:

initiating a timer for the predetermined period of time upon receipt of a most recent request from the user device, wherein the timer expires when the data processing apparatus does not receive another request from the user device for the predetermined period of time.

6. The method of claim 3 , comprising:

applying the first policy group to communications for the user device after expiration of the predetermined period of time.

7. The method of claim 1 , comprising:

creating an entry in a log indicating the user device's access to the resource and a user corresponding with the user credentials received from the user device.

8. The method of claim 7 , comprising:

adding entries to the log only for resources that were restricted using the first policy group.

9. The method of claim 7 , comprising:

adding entries to the log only for resources accessed by the user device while the second policy group is applied to communications for the user device.

10. The method of claim 1 , wherein:

receiving the first user credentials from the user device during the login process that provides the user access to the user device comprises receiving, by a first device different from the user device, the first user credentials; and

receiving the second user credentials from the user device comprises receiving, by the first device, the second user credentials.

11. The method of claim 1 , wherein:

receiving the first user credentials from the user device during the login process that provides the user access to the user device comprises receiving the first user credentials across a network; and

receiving the second user credentials from the user device comprises receiving the second user credentials across the network.

12. The method of claim 1 , wherein receiving the second user credentials from the user device comprises receiving the second user credentials that were entered into the user interface when the user device presented the user interface to the user.

13. A system comprising:

one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:

receiving first user credentials from a user device during a login process that provides a user access to the user device;

identifying, using the first user credentials, a first policy group for the user device and a second policy group for the user device in response to receiving the first user credentials from the user device during the login process;

determining that the first policy group should be associated with the user device based on the receipt of the first user credentials during the login process;

applying the first policy group to communications for the user device;

receiving, from the user device, a request to access a resource;

determining, using the first policy group, that the user device should be prevented from accessing the resource;

providing, to the user device and based on determining that the user device should be prevented from accessing the resource, instructions for presentation of a user interface including a user credentials field;

receiving second user credentials from the user device;

determining that the second user credentials are the same as the first user credentials used during the login process;

determining that the first policy group has a first priority that is lower than a second priority of the second policy group and that the second policy group applies to the request to access the resource, wherein a policy group with a higher priority is always selected over a policy group with a lower priority except during a login process when the higher priority policy group is flagged as not for use during the login process;

determining, using the second policy group, that the user device should be allowed access to the resource; and

allowing the user device access to the resource based on determining that the user device should be allowed access to the resource.

14. The system of claim 13 , wherein determining that the first policy group should be associated with the user device based on the receipt of the first user credentials during the login process comprises determining that the second policy group is flagged as not for use during a login process when a user logs onto the user device.

15. The system of claim 13 , the operations comprising:

applying the second policy group to communications for the user device for a predetermined period of time.

16. The system of claim 15 , the operations comprising:

initiating a timer for the predetermined period of time upon receipt of the user credentials from the user device.

17. The system of claim 15 , the operations comprising:

initiating a timer for the predetermined period of time upon receipt of a most recent request from the user device, wherein the timer expires when one of the computers does not receive another request from the user device for the predetermined period of time.

18. The system of claim 15 , the operations comprising:

applying the first policy group to communications for the user device after expiration of the predetermined period of time.

19. The system of claim 13 , the operations comprising:

creating an entry in a log indicating the user device's access to the resource and a user corresponding with the user credentials received from the user device.

20. The system of claim 19 , the operations comprising:

adding entries to the log only for resources that were restricted using the first policy group.

21. The system of claim 19 , the operations comprising:

adding entries to the log only for resources accessed by the user device while the second policy group is applied to communications for the user device.

22. The system of claim 13 , the operations comprising:

receiving the first user credentials from the user device during the login process that provides the user access to the user device comprises receiving, by at least one of the computers different from the user device, the first user credentials; and

receiving the second user credentials from the user device comprises receiving, by the at least one of the computers, the second user credentials.

23. The system of claim 13 , wherein:

receiving the first user credentials from the user device during the login process that provides the user access to the user device comprises receiving the first user credentials across a network by at least one of the computers; and

receiving the second user credentials from the user device comprises receiving the second user credentials across the network by at least one of the computers.

24. The system of claim 13 , wherein receiving the second user credentials from the user device comprises receiving the second user credentials that were entered into the user interface when the user device presented the user interface to the user.

25. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

receiving first user credentials from a user device during a login process that provides a user access to the user device;

identifying, using the first user credentials, a first policy group for the user device and a second policy group for the user device in response to receiving the first user credentials from the user device during the login process;

determining that the first policy group should be associated with the user device based on the receipt of the first user credentials during the login process;

applying the first policy group to communications for the user device;

receiving, from the user device, a request to access a resource;

determining, using the first policy group, that the user device should be prevented from accessing the resource;

providing, to the user device and based on determining that the user device should be prevented from accessing the resource, instructions for presentation of a user interface including a user credentials field;

receiving second user credentials from the user device;

determining that the second user credentials are the same as the first user credentials used during the login process;

determining that the first policy group has a first priority that is lower than a second priority of the second policy group and that the second policy group applies to the request to access the resource, wherein a policy group with a higher priority is always selected over a policy group with a lower priority except during a login process when the higher priority policy group is flagged as not for use during the login process;

determining, using the second policy group, that the user device should be allowed access to the resource; and

allowing the user device access to the resource based on determining that the user device should be allowed access to the resource.

26. The computer storage medium of claim 25 , wherein determining that the first policy group should be associated with the user device based on the receipt of the first user credentials during the login process comprises determining that the second policy group is flagged as not for use during a login process when a user logs onto the user device.

27. The computer storage medium of claim 25 , the operations comprising:

applying the second policy group to communications for the user device for a predetermined period of time.

28. The computer storage medium of claim 27 , the operations comprising:

initiating a timer for the predetermined period of time upon receipt of the user credentials from the user device.

29. The computer storage medium of claim 27 , the operations comprising:

initiating a timer for the predetermined period of time upon receipt of a most recent request from the user device, wherein the timer expires when one of the computers does not receive another request from the user device for the predetermined period of time.

30. The computer storage medium of claim 27 , the operations comprising:

applying the first policy group to communications for the user device after expiration of the predetermined period of time.

31. The computer storage medium of claim 25 , the operations comprising:

creating an entry in a log indicating the user device's access to the resource and a user corresponding with the user credentials received from the user device.

32. The computer storage medium of claim 31 , the operations comprising:

adding entries to the log only for resources that were restricted using the first policy group.

33. The computer storage medium of claim 31 , the operations comprising:

adding entries to the log only for resources accessed by the user device while the second policy group is applied to communications for the user device.

34. The computer storage medium of claim 25 , the operations comprising:

receiving the first user credentials from the user device during the login process that provides the user access to the user device comprises receiving, by at least one of the computers different from the user device, the first user credentials; and

receiving the second user credentials from the user device comprises receiving, by the at least one of the computers, the second user credentials.

35. The computer storage medium of claim 25 , wherein:

receiving the first user credentials from the user device during the login process that provides the user access to the user device comprises receiving the first user credentials across a network by at least one of the computers; and

receiving the second user credentials from the user device comprises receiving the second user credentials across the network by at least one of the computers.

36. The computer storage medium of claim 25 , wherein receiving the second user credentials from the user device comprises receiving the second user credentials that were entered into the user interface when the user device presented the user interface to the user.