Missing roles for Company Admin + wrong documentation

[MaximilianHauer]

Current Behavior

based on the role concept some roles are missing in the roles

documentation:
https://github.com/eclipse-tractusx/portal-iam/blob/main/docs/technical%20documentation/06.%20Roles%20%26%20Rights%20Concept.md

Roles missing for

Company Admin

roles need to be added

• modify_user_account
• view_service_subscriptions
• app_management
• activate_subscription

---

IT Admin

roles need to be removed
subscribe_service

---

Purchaser

roles need to be removed
upload_certificates
delete_certificates

---

Sales Manager

roles need to be removed
app_management
activate_subscription
roles need to be added
view_idp -> why idp ?
subscribe_apps

---

Service Manager

roles need to be removed
delete_documents

roles need to be added
add_technical_user_management
delete_tech_user_management
view_managed_idp
view_connectors
add_connectors
delete_connectors
subscribe_apps
view_service_subscriptions
view_subscription

roles need to be removed from the R&R concept
add_idp
setup_idp
disable_idp
delete_idp

---

Business Partner Data Manager

roles need to be added to the R&R
view_user_management
view_own_user_account
update_own_user_account
delete_own_user_account

Document adjustment

• add_technical_user_management in the documentation is named add_tech_user_management in the portal
• Managed via Client: Cl7-CX-BPDM needs to be added after 2.5.4 Managed Wallets

Open Questions

• what is technical_roles_management a client or a group ? doesnt fit in the structure. currently existing as role in the R&R and as client in the token

 "technical_roles_management": {
      "roles": [
        "BPDM Pool Consumer"
      ]

• Discrepancy between Activate App Subscription Request and Activate App Subscription

[jjeroch]

@MaximilianHauer I have validated our keycloak image once; and it is existing. It may make sense to check why the test env. is acting differently:

code link: https://github.com/eclipse-tractusx/portal-iam/blob/main/import/realm-config/generic/catenax-central/CX-Central-realm.json#L932

---

Same applies for a couple of roles for Service Manager

...I would not suggest to add:

• add_idp
• setup_idp
• disable_idp
• delete_idp

to the Service Manager.

[MaximilianHauer]

thanks @jjeroch will have a look

[evegufy]

@MaximilianHauer Service Manager already has the roles add_tech_user_management and delete_tech_user_management
https://github.com/eclipse-tractusx/portal-iam/blob/v3.0.1/import/realm-config/generic/catenax-central/CX-Central-realm.json#L240 which is what even lead to #176