Add or manage Role

A Role is how you give business users and technical teams access to Nodinite without making them Administrators. This guide shows how to create and change a Role: who belongs to it, and what its members can see and do.

Roles work identically regardless of authentication mode. With Windows Authentication or OAuth 2.0/OIDC alike, the Role defines what users can access once logged in; only the way people are assigned to it differs.

Learn more about how Roles work: What is a Role?

Understanding the Role Editor

The Role editor has one tab for the Role's identity and members, and one tab per permission set, in this order: General, Log Permissions, Monitor Permissions, C4 Set Permissions, and Repository Permissions.

Blue = the General tab with the Role's name and members, teal = the four permission set tabs.

The number in brackets is how many Log Views, Monitor Views, or C4 Diagram Sets are assigned to the Role.

Before You Begin

Assignment Method by Authentication Mode

• Windows Authentication Mode: Create Users and/or Windows AD Groups first, then assign them to Roles. Windows AD Groups are available while the UseActiveDirectoryGroups System Parameter is true.
• OAuth 2.0/OIDC Mode: Create Policies (groups of Claims) first, then assign them to Roles.

Note

Your authentication mode is chosen when the environment is installed, see Install Nodinite v7 - Authentication. The Role functionality itself is identical in both modes.

• You must be a member of the built-in Administrators Role.
• The built-in Administrators Role can't be edited or deleted; create your own Roles for limited access.

Finding Roles in the Web Client

Navigate to Administration > Access Management > Roles. All Roles are listed in the Roles Overview.

The Access Management menu in Windows Authentication mode. In OIDC/OAuth 2.0 mode it lists Claims and Policies instead of Users and Windows AD Groups.

Step 1: Add or manage Role

Click the Add Role button to create a new Role, or click a Role's name in the Roles Overview to edit it.

The Add Role button is also available inside the Role editor, next to Save.

Step 2: Name and configure the Role

Mandatory Fields

• Name: Every Role must have a unique name. Administrators pick the Role by this name on Log Views, Monitor Views, and C4 Diagram Sets, and in the DefaultRolesInViews System Parameter.

  
  A new Role: Name is required before you can save. The permission tabs show (0) until you assign views or sets.

Optional Fields

• Description: Explain the purpose of the Role, such as the team or business area it serves.

Step 3: Assign Role membership

Windows Authentication Mode

A System Administrator can add or remove:

• Zero or more Users to the Role
• Zero or more Windows AD Groups

To assign Users to the Role, click Edit on the Users card:

Check the Users to add, then click Confirm and close; the Selected tab shows the current members.

To assign Windows AD Groups to the Role, click Edit on the Windows AD Groups card:

Every member of an assigned Active Directory group gets the Role.

Once populated, the General tab shows the assigned Users and Windows AD Groups:

The number next to each card title (#1) is the count of assigned members; the minus icon removes a member.

OAuth 2.0/OIDC Mode

A System Administrator can add or remove:

• Zero or more Policies to the Role

Policies are groups of Claims (key/value pairs like department=finance or access_level=admin). When a user authenticates through your identity provider (Azure AD, Okta, etc.), their Claims are matched against each Policy. A user with all Claims of a Policy gets that Policy's Roles.

To assign Policies to the Role, open the Policy and select the Role on the Policy's Roles tab, see Step 4: Assign to Roles. The Role's Policies card lists the Policies assigned to it.

Example: A user with Claims department=finance and access_level=editor matches the "Finance Editor Policy" and is automatically assigned to the "Finance Editor" Role.

Step 4: Set the permission sets

Open each permission tab and set Allow, Deny, or Inherited where the Role needs it:

1. Log Permissions - under Global permissions, set Access on the Log Views row, then set the rights per Log View, see Permission Set for Log Views.
2. Monitor Permissions - under Global permissions, set Access on the Monitor Views row, then set the rights per Monitor View, see Permission Set for Monitor Views.
3. C4 Set Permissions - under Global permissions, set Access, Create, and Modify on the C4 Diagram Sets row and Access on the Logging row; then click Edit to assign C4 Diagram Sets and set Access and Modify per set, see Permission Set for C4 Diagram Sets.
4. Repository Permissions - set Access, Create, and Modify per entity, see Permission Set for the Repository Model.

The C4 Set Permissions (1) tab of the Finance Role: global rights on top, the assigned sets with Access and Modify below.

You can also add a Role to a view from the other side: the Roles section on the General tab of Add or manage Log View and Add or manage Monitor View.

Step 5: Save and verify

Click Save. Then log in as a member of the Role, or open the User in Add or manage User, and check that the expected Log Views, Monitor Views, and Repository items are visible. Changes to Roles are recorded in Log Audits.

Next Steps

• Permission Set for Log Views
• Permission Set for Monitor Views
• Permission Set for the Repository Model
• Permission Set for C4 Diagram Sets

Related Topics

Windows Authentication Mode

• Users
• Add or manage User
• Windows AD Groups
• Add or manage Windows AD Group

OAuth 2.0/OIDC Mode

• Claims
• Policies
• Add or manage Policy
• Claims and Policies - Common Scenarios

General

• What is a Role?
• Roles Overview
• Access Management
• Add or manage Log View
• Add or manage Monitor View
• Add or manage C4 Diagram Set
• DefaultRolesInViews