> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and role bundles

> Assert a role to an application based on group membership in Iru Identity, and control session length and risk per role using role bundles.

Many applications expect to know **what role** a person has - administrator,
member, viewer, and so on - not just who they are. Iru can assert a role to an
application at sign-on, decided by the person's group membership, and can vary
**session length** and **risk** by role.

You configure this on an application's **Roles** tab. Like the rest of an app, you
edit it in a draft and publish it - see
[Applications overview](/en/identity/applications/applications-overview).

## How a role reaches the application

```mermaid theme={null}
flowchart LR
  group["Group membership"] --> role["Role"]
  role -->|"role identifier"| method["Role assertion method"]
  method --> app["Application"]
```

A **role** is granted to one or more [groups](/en/identity/directory/groups). When
someone in those groups signs on, Iru asserts the role's **identifier** to the
application using the method you choose.

## Role assertion method

This decides how - or whether - the role is sent to the application.

| Method               | What it does                                                                                                                                                      |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **None**             | The application does not receive a role over single sign-on. Role bundles are turned off.                                                                         |
| **Groups**           | The role identifier(s) are sent as values in the groups the application receives.                                                                                 |
| **Custom attribute** | The role identifier(s) are sent in a custom attribute or claim you name - as a single value or an array. For SAML apps you also choose the attribute name format. |

## Role bundles

Roles live inside **role bundles**, which group related roles and decide whether a
person can hold more than one of them at once.

| Bundle setting        | What it does                                                                                                                                                                |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Display name**      | The bundle's name in the dashboard.                                                                                                                                         |
| **Bundle identifier** | A unique identifier used only to organize related roles. It is **not** sent to the application as a role value.                                                             |
| **Exclusivity mode**  | **Include all** asserts every role the person qualifies for in the bundle. **Priority** asserts only the single highest-priority role, so the roles are mutually exclusive. |

In **Priority** mode, each role carries a unique **priority** number, and the
role with the best priority wins when someone qualifies for more than one.

## What a role contains

<AccordionGroup>
  <Accordion title="Display name and identifier" icon="tag">
    The role's name in the dashboard, and the **role identifier** that is asserted
    to the application (the value the app receives for this role).
  </Accordion>

  <Accordion title="Groups" icon="users">
    The [groups](/en/identity/directory/groups) whose members receive the role.
    Basing roles on groups keeps role assignment following your directory.
  </Accordion>

  <Accordion title="Session duration" icon="clock">
    How long a session granted through this role lasts, in minutes. Different
    roles can carry different session lengths.
  </Accordion>

  <Accordion title="Risk level" icon="gauge-high">
    An optional [risk level](/en/identity/authentication/risk-based-access)
    classification for the role, so you can label more sensitive roles
    consistently.
  </Accordion>
</AccordionGroup>

<Note>
  Every application starts with a **Default** bundle and role, so access works out
  of the box. Add bundles and roles only when an application needs role-based
  access.
</Note>

## Configure roles for an application

<Steps>
  <Step title="Choose the role assertion method" icon="list-check">
    On the app's **Roles** tab, set how roles should reach the application -
    **Groups** or a **Custom attribute** - or **None** if the app doesn't take a
    role over single sign-on.
  </Step>

  <Step title="Create a role bundle" icon="layer-group">
    Add a bundle, give it a name and identifier, and choose **Include all** or
    **Priority** exclusivity.
  </Step>

  <Step title="Add roles" icon="user-tag">
    For each role, set its identifier, assign the groups that should receive it,
    and set the session duration and (optionally) a risk level. In **Priority**
    bundles, give each role a priority number.
  </Step>

  <Step title="Publish" icon="circle-check">
    Set the draft as current. From then on, sign-on asserts each person's role
    according to your bundles.
  </Step>
</Steps>

## Where to go next

<CardGroup cols={2}>
  <Card title="Assigning access" icon="user-check" href="/en/identity/applications/assigning-access">
    Grant who can reach the app in the first place.
  </Card>

  <Card title="Groups" icon="users" href="/en/identity/directory/groups">
    Roles are granted to groups - organize membership there.
  </Card>

  <Card title="SAML applications" icon="file-signature" href="/en/identity/applications/saml-applications">
    Where the custom attribute name format is set for SAML role assertion.
  </Card>

  <Card title="OIDC applications" icon="id-card" href="/en/identity/applications/oidc-applications">
    Where roles ride along as a claim for OIDC apps.
  </Card>
</CardGroup>