PingOne

Configuring roles for a worker application

Worker applications have no roles by default. After the application is created, you can add or remove roles as needed, up to the level of your roles as a user. That is, you cannot assign roles that you do not have, or do not have permission to assign.

About this task

If you create a Worker app through the PingOne API, the app inherits your roles by default. Use the assignActorRoles parameter to create a Worker app with minimal roles. Learn more in Create Application - OIDC - Worker App in the PingOne Platform API Reference.

Steps

  1. Go to Applications → Applications and browse or search for the application that you want to edit.

    You can apply administrator roles to Worker applications only. To view the specific permissions for each role, go to Directory → Administrator Roles. Click a role to see its details. Learn more in Administrator Roles.

  2. Click the application entry to open the details panel.

  3. Click the Roles → Administrator Roles tab.

    If roles are assigned, they’re listed here with information about where those roles apply. For example, in the following image, BX User has the Application Owner role in two environments. Because the role is assigned at the environment level, they have the role over all of the applications in those environments. In a third environment, they have the role over only two applications. They also have the Environment Admin role, and they have that role in three environments.

    You can assign administrator roles to users, groups, applications, or PingFederate gateway integrations.
    A screen capture of the user details for BX User. Roles > Administrator Roles is selected, and shows the assignment of the Application Owner role over 2 environments, and in a third over two applications. Also shows the Environment Admin role in three environments.

    Click the Info icon to view the permissions associated with the role. Click the down arrow on the right to view the list of environments or populations for which the role is assigned.
    Screen capture of the Environment Admin and Application Owner roles expanded to display detailed information about the environments and applications over which the user is assigned the role.

  4. Click Grant Roles.

    The Available Responsibilities tab lists the roles that you are allowed to assign and the environments for which you are allowed to assign them. A responsibility is the combination of the role assignment and the level, or scope, at which the role is applied. Depending on the role, it could be assigned at the organization, environment, population, or application level.

    The Granted Responsibilities tab lists any roles that are currently assigned.

  5. On the Available Responsibilities tab, click the role that you want to assign or change and perform any combination of the following:

    1. To assign the role, select the checkboxes next to the applicable environments.

      Click Select All or Remove All to select or clear all available responsibilities.

    2. To remove a role assignment, clear the checkboxes next to the applicable environments.

    3. To grant this access for only a portion of the environment, click the Reduce Access icon (image of reduce access icon), select a subset of the available applications or populations on the Limit Access page, and click Confirm.

      A screen capture of the Limit Access page showing one population selected out of three populations

      You can grant only roles that are assigned to you or that confer the permissions needed to assign that role to others. For example, if you do not have the Environment Admin role, you cannot assign the Environment Admin role to others (and that role will not be listed under Available Responsibilities). However, if you have the Identity Data Admin role, you can assign either the Identity Data Admin role or the Identity Data Read Only role to others.

      Learn more about the permissions associated with each role in Roles.

  6. Click Save.

Result

The role assignments you selected are listed on the Granted Responsibilities tab.