Manage Users, Claims and Roles

Use the /RoleManager URL to manage users, claims and roles.

The RoleManager component handles the user authentication and access management. RoleManager can integrate with external identity management provider (Idp) for user authentication and user profile synchronisation. 

User will be redirected to the RoleManager to log in before the user can access any OneList application. RoleManager issues token for authenticated users to access other OneList functionalities. Claims are granted to authenticated user via respective roles in RoleManager, OneList applications and services implement claims based authorisation. 

Create User Account

Administrator can create two types of account in RoleManager.  

• Interactive User account can log on to OneList applications;
• System User account is designed for APIs, a system user cannot log on to OneList applications. API keys are generated and used for accessing OneList API. 

The type of account cannot be changed once an account is created. Access permissions are granted to both type of accounts by assigning roles to them.

Create the system user account for OneList APIs

As best practice, it is advised to create a dedicated service account and assign it the OneList Integration role. API keys linking to this account are used for OneList Adapters to authenticate and authorise access to OneList DataSync APIs.

• Navigate to RoleManager and select the Users menu;
• Select the New System User link to create a System User account

• Complete the user detail then click the Save button;
• On the Manage Account page, select the Roles tab on the left;
• Search for the OneList Integration role and assign the role to the user;

Generate API key for OneList integration

• Navigate to RoleManager and select the Users menu;
• Enter the name of the OneList integration system user then click the Search button;
• Select the Edit link to view the account detail;
• Select the Keys tab on the left

• Click the Generate New Access Key button to generate a new key, or click the Show Access Key button to view an existing key;
• The Allowed clients field is optional. If specified, only the requests made from these IP addresses are accepted;
• A unique access key must be generated for each source system which integrates with OneList. The key is required to register a source system in OneList. The OneList adapters for that source system use the same key in the HTTP Request header to connect to OneList APIs.

Maintain access for users

• Navigate to RoleManager and select the Users menu;
• Enter the name or email address of the user then click the Search button;

• Select the Edit button under the Actions column;
• Select the Roles tab on the left;
• Search for the required role and assign the role to the user, or remove the current assigned role. Note the user needs to log off and log on to have the updated access.

How to setup external authentication provider

RoleManager supports integration with the following authentication providers

• Azure AD
• ADFS
• Google
• Salsforce
• Other provider supporting Open ID Connect protocol

Prerequisites

• Complete application registration in the respective authentication provider, e.g. configure redirect_URL, rely_party;
• Request credentials for connecting to the authentication provider, e.g. client_id, client_secret;
• Setup claim mapping at the authentication provider if require.

How to add an authentication provider in RoleManager

1. Navigate to RoleManager and select Authentication Providers menu;
2. Click the Create New button, enter the name and display name of the provider. The name has to be unique and starts with letter without space, e.g. AzureAD, then click the Next button;
   • For ADFS, the name must be WsFederation;
   • For Google, the name must be Google;
   • For other providers, the name can be any value.
3. Enter the configuration JSON applicable for the authentication provider. See below list for the applicable provider.
4. Select the applicable status
   • Is Active - RoleManager only interact with active providers;
   • Is Interactive - RoleManager displays a button for each interactive provider on the log in page so user can use the external account to log in;
   • Is Default - RoleManager automatically redirects the user to the default authentication provider's log on page, i.e. user does not need to select which provider to log on.

External authentication provider configuration requirement