A custom role gives a user access to specific OpenEdge resources, such as a PAS for OpenEdge instance or an OpenEdge database that the OpenEdge Command Center agent manages. Unlike predefined system roles, which provide access to all the resources, a custom role applies only to the resources you choose.

When you grant access to a specific resource through a custom role, the user must also have access to all parent resources in the resource hierarchy. For example, to give a user access to a specific OpenEdge database, the user must also have access to the OpenEdge Command Center agent and the OpenEdge installation that host the database.

Before you create a custom role or add, modify, or remove permissions from an existing role, you must retrieve the resourceURN values for the target resources. For details, see "Retrieve resources for administered systems" in Authorization Server REST API Reference.

The Authorization server provides the following REST operations for creating and managing custom roles. For details about each operation, see the corresponding topic in Authorization Server REST API Reference.

  • Create a custom role (POST /authz/api/roles)—Creates a custom role that grants permissions to selected resources.
  • Update a custom role (PUT /authz/api/roles/{roleURN})—Adds, modifies, or removes permissions from a custom role.
  • Delete custom roles (DELETE /authz/api/roles)—Deletes custom roles that are no longer required.
Note: Updating or deleting a custom role requires its roleURN. You can obtain this value from the response returned when the role is created or by retrieving it separately. For details, see "Retrieve roles for a system" in Authorization Server REST API Reference.