Skip to content

Commit 5d257d6

Browse files
committed
Add role management docs.
1 parent 8ac44d2 commit 5d257d6

File tree

4 files changed

+35
-2
lines changed

4 files changed

+35
-2
lines changed
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Role management
2+
3+
{{ product_name }} supports role management through different versions of the SCIM2 Roles API.
4+
5+
!!! note
6+
{{ product_name }} deprecated the `SCIM 2.0 Roles API (v2)` API.
7+
8+
## Roles API (V3)
9+
10+
The SCIM2 Roles V3 API introduces a permission model that separates role metadata management and role assignment operations. This allows administrators to delegate responsibilities more precisely—for example, allowing one set of users to create and edit roles, while another manages user and group assignments.
11+
12+
!!! note
13+
You can't register `SCIM2 Roles V1/V2 API` and `SCIM2 Roles V3 API` under the same application. Before you register the `SCIM2 Roles V3 API`, remove the `SCIM2 Roles V1/V2 API` resource.
14+
15+
**Key changes in V3:**
16+
17+
- The `internal_role_mgt_update` permission handled both role metadata updates and role assignments. V3 splits these operations as below:
18+
19+
- `internal_role_mgt_meta_update`: for metadata updates.
20+
21+
- `internal_role_mgt_users_update`: for user assignments.
22+
23+
- `internal_role_mgt_groups_update`: for group assignments.
24+
25+
- Console roles with permissions `Roles` lose assignment privileges under V3. To keep role assignment capabilities, update these roles to include `Role Assignments` permissions.
26+
27+
### Register SCIM2 Roles V1/V2 API under an application
28+
29+
1. If you have registered `SCIM2 Roles V1/V2 API` resource already, remove it by clicking on the bin button next to the `SCIM2 Roles V1/V2 API`.
30+
2. Add `SCIM2 Roles V3 API` by following this [API Authorization with Role Based Access Control guide]({{base_path}}/guides/authorization/api-authorization/api-authorization).
31+
3. Update existing application role with the `SCIM2 Roles V3 API` permissions by following this [Edit permissions of a role guide]({{base_path}}/guides/users/manage-roles/#edit-permissions-of-a-role).
File renamed without changes.
File renamed without changes.

en/asgardeo/mkdocs.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -615,8 +615,10 @@ nav:
615615
- Organization discovery API: apis/organization-discovery.md
616616
- Organization discovery configuration management API: apis/organization-discovery-config-mgt-rest-api.md
617617
- Organization management API: apis/organization-management.md
618-
- Role management (SCIM 2.0) V3 API: apis/roles-v3.md
619-
- Role management (SCIM 2.0) API (deprecated): apis/roles.md
618+
- Role management:
619+
- Role management: apis/role-management/index.md
620+
- Role management (SCIM 2.0) V3 API: apis/role-management/roles-v3.md
621+
- Role management (SCIM 2.0) API (deprecated): apis/role-management/roles.md
620622
- Rule Metadata API: apis/rule-metadata-rest-api.md
621623
- User management:
622624
- SCIM 2.0 API:

0 commit comments

Comments
 (0)