Skip to main content
Many applications expect to know what role a user has (administrator, member, viewer, and so on), not just who they are. Iru can send a role to an application at sign-in, based on the user’s group membership, and can vary session length by role. You create roles on an application’s Roles tab and assign them to groups on its Assignments tab. As with other app settings, you edit roles in a draft and then publish. See Applications overview.

​
How a role reaches the application

You assign a role to one or more groups. When someone in those groups signs in, Iru sends the role’s identifier to the application using the role assertion method you choose.

​
Role assertion method

The role assertion method decides whether Iru sends roles to the application, and how.

​
What a role contains

The role’s name in the dashboard, and the role identifier Iru sends to the application. The identifier is the value the app receives for this role.
The groups whose members receive the role. You assign roles to groups on the Assignments tab, so role assignment follows your directory membership.
How long, in minutes, the sign-in Iru sends to the application stays valid. It doesn’t limit OIDC refresh tokens. When a user matches several roles, Iru uses the longest length set on those roles. Leave it blank if this role shouldn’t set a length.If none of the user’s roles sets a length, or the role assertion method is None, Iru uses the application’s default. That default starts at 60 minutes for apps you create without a template. Iru sends no expiry when a SAML app has Session Length Supported set to Unsupported.
A risk level label for the role. The dashboard requires one, so you can label more sensitive roles consistently. It isn’t sent to the app and doesn’t affect sign-in.
An application you create without a template has no roles, so no one can sign in until you add a role and assign it to a group. If the app doesn’t need a role, select None. The app then has a single Default role that you assign groups to.

​
Configure roles for an application

1

Choose the role assertion method

On the app’s Roles tab, select Groups or Custom attribute to send roles to the application. Select None if the app doesn’t need a role.
2

Add roles

For each role, set a display name and a risk level, and optionally an assertion value (the value sent to the app) and a session length.
3

Assign roles to groups

On the Assignments tab, choose a group and the roles its members receive.
4

Publish

Set the draft as current. From then on, Iru refuses sign-in for users who match no role, and sends the app each user’s roles using the role assertion method.

​
Where to go next

Assigning access

Assign groups to control who can reach the app.

Groups

Create and manage the groups you assign roles to.

SAML applications

Set the attribute name format for roles sent to SAML apps.

OIDC applications

Configure the claims Iru sends to OIDC apps, including roles.