How a role reaches the application
A role is granted to one or more groups. When someone in those groups signs on, Iru asserts the role’s identifier to the application using the method you choose.Role assertion method
This decides how - or whether - the role is sent to the application.| Method | What it does |
|---|---|
| None | The application does not receive a role over single sign-on. Role bundles are turned off. |
| Groups | The role identifier(s) are sent as values in the groups the application receives. |
| Custom attribute | The role identifier(s) are sent in a custom attribute or claim you name - as a single value or an array. For SAML apps you also choose the attribute name format. |
Role bundles
Roles live inside role bundles, which group related roles and decide whether a person can hold more than one of them at once.| Bundle setting | What it does |
|---|---|
| Display name | The bundle’s name in the dashboard. |
| Bundle identifier | A unique identifier used only to organize related roles. It is not sent to the application as a role value. |
| Exclusivity mode | Include all asserts every role the person qualifies for in the bundle. Priority asserts only the single highest-priority role, so the roles are mutually exclusive. |
What a role contains
Display name and identifier
Display name and identifier
The role’s name in the dashboard, and the role identifier that is asserted
to the application (the value the app receives for this role).
Groups
Groups
The groups whose members receive the role.
Basing roles on groups keeps role assignment following your directory.
Session duration
Session duration
How long a session granted through this role lasts, in minutes. Different
roles can carry different session lengths.
Risk level
Risk level
An optional risk level
classification for the role, so you can label more sensitive roles
consistently.
Every application starts with a Default bundle and role, so access works out
of the box. Add bundles and roles only when an application needs role-based
access.
Configure roles for an application
Choose the role assertion method
On the app’s Roles tab, set how roles should reach the application -
Groups or a Custom attribute - or None if the app doesn’t take a
role over single sign-on.
Create a role bundle
Add a bundle, give it a name and identifier, and choose Include all or
Priority exclusivity.
Add roles
For each role, set its identifier, assign the groups that should receive it,
and set the session duration and (optionally) a risk level. In Priority
bundles, give each role a priority number.
Where to go next
Assigning access
Grant who can reach the app in the first place.
Groups
Roles are granted to groups - organize membership there.
SAML applications
Where the custom attribute name format is set for SAML role assertion.
OIDC applications
Where roles ride along as a claim for OIDC apps.