> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles

> Create roles for an application in Iru Identity, assign them to groups, and set session length per role.

Many applications expect to know **what role** a user has (administrator,
member, viewer, and so on), not just who they are. Iru can send a role to an
application at sign-in, based on the user's group membership, and can vary
**session length** by role.

You create roles on an application's **Roles** tab and assign them to groups on
its **Assignments** tab. As with other app settings, you edit roles in a draft
and then publish. See
[Applications overview](/en/identity/applications/applications-overview).

## How a role reaches the application

```mermaid theme={null}
flowchart LR
  group["Group membership"] --> role["Role"]
  role -->|"role identifier"| method["Role assertion method"]
  method --> app["Application"]
```

You assign a **role** to one or more [groups](/en/identity/directory/groups).
When someone in those groups signs in, Iru sends the role's **identifier** to
the application using the role assertion method you choose.

## Role assertion method

The role assertion method decides whether Iru sends roles to the application,
and how.

| Method | What it does |
| - | - |
| **None** | The application doesn't receive a role at sign-in. On the **Assignments** tab, you can assign only the **Default** role to groups. |
| **Groups** | Iru sends the role identifiers as the values of a claim or attribute named `groups`, unless your attribute mapping already sends one with that name. |
| **Custom attribute** | Iru sends the role identifiers in a claim or attribute you name: as an array for OIDC, and as one value per role for SAML. For OIDC, don't use a claim name Iru already sends, such as `sub`, `exp`, or `scope`. |

## What a role contains

> **Display name and identifier**
>
> The role's name in the dashboard, and the **role identifier** Iru sends to
> the application. The identifier is the value the app receives for this role.

> **Groups**
>
> The [groups](/en/identity/directory/groups) whose members receive the role.
> You assign roles to groups on the **Assignments** tab, so role assignment
> follows your directory membership.

> **Session length**
>
> How long, in minutes, the sign-in Iru sends to the application stays valid.
> It doesn't limit OIDC refresh tokens. When a user matches several roles, Iru
> uses the longest length set on those roles. Leave it blank if this role
> shouldn't set a length.
>
> If none of the user's roles sets a length, or the role assertion method is
> **None**, Iru uses the application's default. That default starts at
> **60 minutes** for apps you create without a template. Iru sends no expiry
> when a SAML app has **Session Length Supported** set to **Unsupported**.

> **Risk level**
>
> A [risk level](/en/identity/authentication/risk-based-access) label for the
> role. The dashboard requires one, so you can label more sensitive roles
> consistently. It isn't sent to the app and doesn't affect sign-in.

> [!NOTE]
>
> An application you create without a template has no roles, so no one can sign
> in until you add a role and assign it to a group. If the app doesn't need a
> role, select **None**. The app then has a single **Default** role that you
> assign groups to.

## Configure roles for an application

**1. Choose the role assertion method**

On the app's **Roles** tab, select **Groups** or **Custom attribute** to
send roles to the application. Select **None** if the app doesn't need a
role.

**2. Add roles**

For each role, set a display name and a risk level, and optionally an
assertion value (the value sent to the app) and a session length.

**3. Assign roles to groups**

On the **Assignments** tab, choose a group and the roles its members receive.

**4. Publish**

Set the draft as current. From then on, Iru refuses sign-in for users who
match no role, and sends the app each user's roles using the role assertion
method.

## Where to go next

> **[Assigning access](/en/identity/applications/assigning-access)**
>
> Assign groups to control who can reach the app.

> **[Groups](/en/identity/directory/groups)**
>
> Create and manage the groups you assign roles to.

> **[SAML applications](/en/identity/applications/saml-applications)**
>
> Set the attribute name format for roles sent to SAML apps.

> **[OIDC applications](/en/identity/applications/oidc-applications)**
>
> Configure the claims Iru sends to OIDC apps, including roles.