What is the best approach to equal the association of a role to an organization?
Original message was deleted
RHi @silversonicaxel thanks for the bump, "what's the best approach to achieve org role"
Who's trying to achieve this role.
Where's your end goal?.
I'll try to help here.
Thanks
Who's trying to achieve this role.
Where's your end goal?.
I'll try to help here.
Thanks
Rhi @silversonicaxel based on what I understood, I dont think we have a natice solution for this in zitadel. As a workaround, try this(and please lmk if this makes sense 
)
To make your WebApp aware of user roles , Add user roles to the access token . This ensures that roles assigned to users are present in the access token. Your backend services (APIs) can inspect the token and grant permissions accordingly.
For adding organization-level roles (which you can't unfortunately). Create a role like
This is a possibiluty I can come up in my mind atm. I think it would be nice for you to lmk if this makes sense for your use case. And also, you can open an issue and our engineers can take a look at it. Get involved in the discussion.
)To make your WebApp aware of user roles , Add user roles to the access token . This ensures that roles assigned to users are present in the access token. Your backend services (APIs) can inspect the token and grant permissions accordingly.
For adding organization-level roles (which you can't unfortunately). Create a role like
org_admin:org123 for org123. Assign those roles to users. Click on Assert Roles on Authentication. And now the role info will be included in token.This is a possibiluty I can come up in my mind atm. I think it would be nice for you to lmk if this makes sense for your use case. And also, you can open an issue and our engineers can take a look at it. Get involved in the discussion.
application_token_setting168.82KB
retrieve_user_roles119.75KB
Rhi @silversonicaxel yes ytou are right, I just assumed that you did not try this
Rhi @silversonicaxel I know what you mean but ig there's no such things discussed internally. My idea/suggestion would be to open an issue on github and fill the description with great details. The use case that you mentioned is very practical for large number of users. Someone from the team will reach out in the comments and we can come up with something?. WDYT?.
Rthanks @silversonicaxel someone should take a look at ti from the team