Authorization

Use the Authorization Management page to control system access for users, groups, and clients. Gatekeeper uses a configurable permission manager for fine-grained access control (role-based authorization). For more information, see Global authorization service.

To access these pages you need minimal permissions.

  • For the Roles page, you need the following permissions:

    • Azman.Authorization.Management,
    • azman.PageRolesManagement,
    • azman.ListRoles,
    • azman.ListRoleOperations, and
    • azman.GetRoleDetails

  • For the Members page, you need the following permissions:

    • Azman.Authorization.Management,
    • azman.PageMembersManagement,
    • azman.ListRoles,
    • azman.ListRoleMembers,
    • azman.ListScopeMembers, and
    • azman.ListAssignedRoles.

Manage roles

Click the Roles tab to add, edit, or delete roles.

Your deployment comes with built-in factory roles and you can add custom roles.

To create a custom role:

  1. Click CREATE NEW. The Create Role dialog opens.
  2. Enter the following:
    1. Role ID - Enter a role ID which must be unique within the scope.
    2. Role description - Enter an optional description.
  3. Click OK. The new role is created.
  4. Select a role from the drop down on the left side of the screen to see its operations. You can expand each operation group to enable or disable its operations. You can also click the settings icon to enable or disable all operations.
  5. Click SAVE CHANGES.

If you edit a factory role, you can click restore role to undo your changes.

To copy a role, click the three dot menu on the right.

To filter roles by operations, use the search text box to find the operation. You can search for allowed or denied operations.

Manage members

Select the Members tab to apply roles to members.

To filter by users, clients, or IdP groups, click the member type icon.

To add a new user to a role:

  1. Click NEW. A menu opens.
  2. Select User. The Add user to role(s) dialog opens.
  3. Provide the email ID of the user, select the issuer, and select all the applicable roles.
  4. Click OK.

To add a new client to a role:

  1. Click NEW. A menu opens.
  2. Select Client. The Add client to role(s) dialog opens.
  3. Do the following:
    1. Provide a client ID and a label.
    2. When the client ID is registered under a customer’s tenant, select This client id is in customer tenant and provide the issuer associated with that tenant.
    3. Select all the applicable roles.
  4. Click OK.

To add a new group to a role:

  1. Click NEW. A menu opens.
  2. Select Group. The Add group to role(s) dialog opens.
  3. Provide a client ID, a label, and an issuer, and select all the applicable roles.
  4. Click OK.

To manage the roles applied to a member:

  1. Expand the member.
  2. To remove a role, click X next to the role.
  3. To add a role, click ADD ROLES and select a role from the list.

To delete a member or show a full list of a member’s operations, click the three-dot menu on the right.

  1. Select Delete Member. A confirmation dialog opens.
  2. Click YES.

You can search by member name and filter by specific roles. When you select more than one role, the grid displays members with all selected roles.

To refresh the display immediately, click Refresh Cache in the three-dot menu on the right. Otherwise, member’s roles are refreshed every 5 minutes.

Add user-friendly display names for issuers

To substitute user-friendly display names for issuer URLs:

  1. Click the Issuers tab.
  2. Open the three-dot menu on the right and click Edit. The Edit issue dialog opens.
  3. Provide a label. This is the display name.
  4. Click OK.