Assign agent permissions in IdP authentication mode

The OECC Agents grid includes a Partition ID column. In IdP authentication mode, IdP administrator uses this partition ID value to authorize users for a specific agent.

When an agent connects to OpenEdge Command Center, it automatically creates the roles for that agent. However, you must create the corresponding app roles manually in the IdP portal.

1. In the OECC Agents grid, locate the agent and copy its Partition ID value.
2. In the IdP portal, create an app role for each level of access that you want to grant for the agent, and then replace <partitionId> with the copied value:

   role:agent/<partitionId>/agent_admin role:agent/<partitionId>/agent_resource_user

3. Similarly, set the value of each app role, including case. Set the display name to a name that identifies the agent, such as the agent name. A role value that does not match an OpenEdge Command Center role is ignored and grants no permissions.
4. Users assigned the role:authz/authz_admin and role:agent/<partitionId>/agent_admin can create and manage custom roles.
5. Assign the users or groups that manage the agent to the new app roles.

At the next sign-in, or after the user refreshes the session, the identity provider must include the assigned agent role in the user’s access_token. OpenEdge Command Center uses that role to authorize the user to work with the agents assigned to that partition.