Create and Assign App Roles

Number of APIs: 9

This activity shows you how to create and assign application roles to users, which helps to simplify managing application permissions.

Application permissions are used to protect application resources, and can be thought of as the actions that can be taken on a resource. Application roles are associated with application permissions, and can be assigned to users to determine which actions they can perform on an application resource.

In this activity, you'll create a custom resource and use the PingOne Authorize Endpoint to create an application permission and application role. You'll then assign the application role to a user.

The following operations are supported by the PingOne APIs:

• Create an application
• Create a custom resource
• Create PingOne Authorize application resources, roles, and permissions
• Create user application role assignments

Prerequisites

• You must have the PING_ONE_AUTHORIZE capability in the Bill of Materials (BOM) for your environment to run the PingOne Authorize requests to create application resources, application roles, and application permissions.

• Create a user to get a userID. See Create User or Read All Users to find an existing user. A userID is needed to assign an application role to a user in this activity.

• Get an access token from the worker application you created in Getting Started with the PingOne APIs. If you prefer to get a token from a different worker application in an alternate sandbox environment, run the token request endpoint using the client ID and client secret of your chosen worker app to authenticate the request. See GET a Worker Application Access Token.

Workflow order of operations

To create application permissions, application roles, and assign application roles to a user, the following tasks must be completed successfully:

1. Make a POST request to /environments/{{envID}}/applications to add a new application to the specified environment.

2. Make a POST request to /environments/{{envID}}/resources to define the custom resource.

3. Make a POST request to /environments/{{envID}}/resources/{{resourceID}}/scopes to define a scope for the custom resource.

4. Make a POST request to /environments/{{envID}}/applications/{{appID}}/grants to create a new resource access grant for the application.

5. Make a POST request to /environments/{{envID}}/resources/{{customResourceID}}/applicationResources to create the application resource.

6. Make a POST request to /environments/{{envID}}/applicationResources/{{appResourceID}}/permissions to create the application resource permission.

7. Make a POST request to /environments/{{envID}}/applicationRoles to create an application role.

8. Make a POST request to /environments/{{envID}}/applicationRoles/{{appRoleID}}/permissions to assign an application resource permission to the specified role.

9. Make a POST request to /environments/{{envID}}/users/{{userID}}/applicationRoles to assign the application role to a user.

1. Step 9: Assign the application role to user POST {{apiPath}}/environments/{{envID}}/users/{{userID}}/applicationRoles

2. Step 1: Create a web application POST {{apiPath}}/environments/{{envID}}/applications

3. Step 2: Create a custom resource POST {{apiPath}}/environments/{{envID}}/resources

4. Step 3: Create a custom resource scope POST {{apiPath}}/environments/{{envID}}/resources/{{customResourceID}}/scopes

5. Step 5: Create an application resource POST {{apiPath}}/environments/{{envID}}/resources/{{customResourceID}}/applicationResources

6. Step 6: Create application permissions POST {{apiPath}}/environments/{{envID}}/applicationResources/{{appResourceID}}/permissions

7. Step 7: Create an application role POST {{apiPath}}/environments/{{envID}}/applicationRoles

8. Step 8: Create application role permissions POST {{apiPath}}/environments/{{envID}}/applicationRoles/{{appRoleID}}/permissions

9. Step 4: Assign a resource grant to the web application POST {{apiPath}}/environments/{{envID}}/applications/{{customResourceAppID}}/grants