Skip to main content

RoleAccount resource data model

/Role (addon version 1.2.0+)

Dictionary table

The diagran service model of the object: http://www.soffid.org/doc/console/2.9.0/uml/com/soffid/iam/api/Role.html

Soffid allows you to add customized data to the group object. You can do that on metadata option:

  • Main Menu > Administration > Configure Soffid > Global Settings > Metadata

It is allowed to consult all the Role definition using the Schema query:

http://<your-domain>/webservice/scim2/v1/Schemas/urn:soffid:com.soffid.iam.api.Role

Full JSON example

Request

http://<your-domain>/webservice/scim2/v1/Role/393195

Response

&&TODO&& Cambiar JSON

{
    "approvalEnd": "2021-02-04 15:39:05",
    "ownedRoles": [],
    "description": "AD role",
    "granteeGroups": [],
    "informationSystemName": "Operation/Business process/ad",
    "password": false,
    "system": "ad",
    "ownerGroups": [],
    "ownerRoles": [
        {
            "informationSystem": "Operation/Business process/ad",
            "ownerRole": 63,
            "ownerRoleDescription": "SOFFID Administrator",
            "roleId": 393195,
            "mandatory": true,
            "enabled": true,
            "ownerSystem": "soffid",
            "system": "ad",
            "meta": {
                "location": "http://<your-domain>/webservice/scim2/v1/RoleGrant/1563461",
                "resourceType": "RoleGrant"
            },
            "schemas": [
                "urn:soffid:com.soffid.iam.api.RoleGrant"
            ],
            "roleName": "AD role",
            "hasDomain": false,
            "id": 1563461,
            "ownerRoleName": "SOFFID_ADMIN",
            "roleDescription": "AD role",
            "status": "A"
        }
    ],
    "bpmEnabled": true,
    "meta": {
        "location": "http://<your-domain>/webservice/scim2/v1/Role/393195",
        "resourceType": "Role"
    },
    "schemas": [
        "urn:soffid:com.soffid.iam.api.Role"
    ],
    "name": "AD role",
    "approvalStart": "2021-02-04 15:39:05",
    "attributes": {},
    "id": 393195,
    "enableByDefault": false
}

Notes about role domains

By default, roles have no security domain (sometimes referred to as scope). When a security domain is assigned to a role, each account-role object is tagged with the proper security domain value. It is allowed to assign one role multiple times to the same user, as long as each assignment is tagged with a different security domain value. For instance, one can create the SOFFID_OU_MANAGER role bound to the GROUPS security domain. Then, you can assign the role SOFFID_OU_MANAGER/Group1 to any user.

Four kinds of security domains are available:

  • SENSE_DOMAIN: No security domain applies.
  • GROUP: A business unit is bound to each grant of this role.
  • APPLICATION:  A information system is bound to each grant of this role.
  • Custom domain: Each application can have its own security domains with arbitrary meanings.

To set or modify the role domain for a role, one can use the "domain" attribute. This attribute is a complex object composed of a name and a description. Only the name is mandatory.

Notes about role inheritance

Role inheritance is driven by the ownedRoles, ownerRoles and ownedGroups. Each of these attributes is an array of grants. Each grant has the following attributes:

  • ownerRole: id of owner role.
  • ownerSystem: name of owner role's system.
  • ownerRoleName: name of owner role's name.
  • ownerRolDomainValue: security domain of the owner role. If a user is granted with the owner role, and the
  • ownerRolDomainValue does not match the grant domain, the inheritance rule does not apply.
  • roleId: id of owned role.
  • system: name of owned role's system
  • roleName: name of owned role's name
  • domainValue: security domain of the owned role.

The role inheritance can vary slightly depending on whether the owned role and the owner role are in the same domain or not:

Resulting domain value

Owner role has no domain

Owner role has a different domain

Same domain
Domain value not specified Blank Blank Owner role domain value
Domain value specified Specified value Specified value Specified value

 

Back to top