A permission determines the name of a granular right within one of your applications.
A permission is associated with only one application at a time.
You can create multiple permissions for an application, depending on your business needs. The number of permissions for an application is limited to 50.
You can manage the permissions of users by assigning roles to them.
You can assign multiple permissions to a role, and the same, one permission to multiple roles.
You can also assign permissions of different applications to the same role.
Define permissions for users
You can only assign roles to users, you cannot assign permissions directly to a user, only through roles.
The rights of users are defined by the permissions configured to the roles that are assigned to users.
When a user logs into one of your applications, all of the permissions that the user has for the specific application are fetched. You can process the user's permissions in your application, and based on them, decide what the user is allowed to do.
Permissions and protocols
When a user logs into your applications
- with OAuth 2.0/OIDC protocol type, the claim
permissionsof the issued access token contains the user's permissions.
- with SAML protocol type, the issued SAML attribute
permissionsof the SAML assertion contains the user's permissions.