Required IdP app roles for OpenEdge Command Center

Before users can be authorized in IdP authentication mode, the identity provider Administrator must create app roles, or equivalent role or group mappings, whose values match the OpenEdge Command Center role values exactly.

Fixed roles

Create the following roles in the identity provider:

Display name Value Description Assign to
OECC Admin role:oecc/oecc_admin Full OpenEdge Command Center administration Users or groups
AuthZ Admin role:authz/authz_admin Authorization management Users or groups

Agent roles

OpenEdge Command Center creates agent roles automatically when an agent connects. Their values follow this pattern:

role:agent/<partitionId>/agent_admin
role:agent/<partitionId>/agent_resource_user

Where <partitionId> is the partition ID of the agent—you copy it from the Partition ID column of the Agents grid. You must create a matching app role in the identity provider for each agent that the identity provider users must manage, and then assign users or groups to that role.

Role matching rules

Role values must exactly match the OpenEdge Command Center role values. Remember the following details when creating app roles:

  • A role value that does not match any OpenEdge Command Center role is ignored, and grants no permissions.
  • A role for an agent that no longer exists is ignored.
  • A user who is assigned no OpenEdge Command Center app role can sign in but cannot view OpenEdge Command Center or agent details.
  • A user who is assigned only an agent role can manage the resources of that agent only.