OAuth roles

Every user within the OAuth subsystem has a role. The role determines which APIs can be used and what tasks can be performed by the user.

Listed below are the roles and details of their access:

OAuth roles
Code Role Access details
0 User

  • Any identity that has not specifically assigned a different role automatically has the User role. The User role cannot be assigned directly.
1 Auditor

  • Can see everything but change nothing

  • The Auditor role is automatically given to an identity that has Trust Protection Platform auditor rights. It can also be assigned directly to any identity.
2 Application Maintainer

  • Can modify the properties (such as name, scope, description) of specific applications

  • This role can be assigned by an Admin or by the Application Owner.

3 Application Owner

  • Can modify and delete applications they own

  • Can modify and delete rules related to applications they own

  • Can revoke grants issued for applications they own

  • Can assign and revoke the maintainer role for applications they own

  • Can assign and revoke the owner role for applications they own

  • This role can only be assigned by an Admin.
4 Mixed Owner/Maintainer

  • Indicates that the user is the Application Maintainer of at least one application and the Application Owner of at least one application.

  • This role cannot be directly assigned but is implied from a user being assigned the Application Owner and Application Maintainer roles.
5 Grant Admin

  • Can view all applications and rules

  • Can view and revoke all grants for a user

  • This role is intended for users or processes performing off-boarding tasks

  • This role can be assigned by an Admin.

6

Admin

  • Can create, modify and delete applications

  • Can create, modify and delete rules

  • Can issue and revoke grants

  • Can assign and revoke Application Maintainer and Application Owner roles for any application

  • Can assign and revoke the Admin role

  • Can configure global settings (session parameters, auth parameters, etc.)

  • Any master administrator automatically has this role, but it can also explicitly be assigned to regular identities by an existing OAuth Admin.

NOTE  If you assign a global role (Admin/ Grant Admin/Auditor) to a user, it overrides their assigned roles (Application Owner/Application Maintainer/Mixed Owner/Maintainer. This can result in a user implicitly losing access APIs.