Skip to content

Roles from Entra ID App Roles

Info

New in Atfinity 18.

With Load roles from Entra ID app roles switched on in the SCIM tab, Entra ID decides which of the users it provisions hold a role, and you set the role's permissions in Atfinity. It needs SCIM provisioning set up first, and it cannot be on while Load roles and groups on login is on in the SAML or OpenID Connect tab.

Setting it up

  1. Switch on Load roles from Entra ID app roles first, since Atfinity ignores the roles Entra ID sends while it is off.
  2. In the app registration of the application, create an app role for each role.
  3. Assign users or groups to the enterprise application with their app role, once per role for a user who holds several.
  4. In the attribute mappings, add roles to the user attributes as a multi-valued text attribute, map it with the expression AssertiveAppRoleAssignmentsComplex([appRoleAssignments]), and set the scope to sync only assigned users and groups. Changing the mappings makes Entra ID send every user again.

Linking app roles to roles

Each app role is linked to one role by its value. The first time Entra ID sends an app role, the role named like its display name, ignoring case, is linked to it, so a role you already use keeps its permissions. Otherwise Atfinity creates a role named after the display name, whose users can only view their own cases until you give it permissions. When a role linked to another app role already has that name, the new one is named after both, as in Officer (BranchOfficer). Default Access, which users assigned without an app role get, creates no role. Neither does the User role that an application you create yourself in Entra ID comes with, which has no value.

Renaming an app role in Entra ID or a linked role in Atfinity keeps the link, which the role shows as Entra ID app role. Changing an app role's value creates a new role without permissions, and its users move to it as Entra ID updates them. A deleted role is created again, without permissions, the next time Entra ID sends its app role.

Who holds a role

Each update replaces the linked roles of a user with the app roles Entra ID sends and keeps their other roles. For a provisioned user, the user form and the user import cannot give or take a linked role. When you start, the mapping AppRoleAssignmentsComplex([appRoleAssignments]) only adds roles, so users keep the roles you gave them while you mirror those assignments in Entra ID. Switch to the mapping above afterwards, since with this one a role removed in Entra ID stays in Atfinity. Where every user holds one app role, SingleAppRoleAssignment([appRoleAssignments]) mapped to roles[primary eq "True"].value works too, and each update replaces the linked roles with that one.

Switching it off

Switching loading roles or provisioning off keeps every role and who holds it, and removes the links, so you edit the roles like any others. Switching it on again links roles by name again, so a role renamed in the meantime is created anew. Entra ID only sends the users that changed since its last cycle, so restart provisioning in Entra ID afterwards to send all of them.