Authorization model

Administrative access is explicitly scoped.

OpenIssuer stores AuthzManager privileges as assignments to either an organization or a tenant subdomain. Application roles remain separate from these administrative assignments.

Role scopes

RoleScopePurpose
OrgAdminOrganization IDAdmin login and management for one organization.
SubdomainAdminSubdomain IDAdministration across organizations mapped to one subdomain.

Assignment storage

The role service stores assignments in Authz_Manager_Role_Assignment. The scope_type is ORGANIZATION or SUBDOMAIN, and scope_id contains the corresponding UUID.

Administrative capabilities

CapabilityOrgAdminSubdomainAdmin
OrganizationsView and edit the assigned organization.View and edit organizations in the assigned subdomain.
Organization usersSearch, add, remove, and set defaults in the assigned organization.Perform the same operations across the assigned subdomain.
Default organizationAvailable only when the affected user belongs to the organization.Subdomain access does not create organization membership.
Subdomain administratorsNo subdomain-wide delegation.Assign or remove eligible administrators in the same subdomain.
Role managementCreate, edit, and delete roles in the assigned organization.Create, edit, and delete roles from an organization's Roles tab within the assigned subdomain.

Every SubdomainAdmin operation verifies that the target organization belongs to the current subdomain. Cross-subdomain access is rejected. Roles are bound to their organization when created; there is no separate role-to-organization assignment step.

Current login behavior

AuthzManager login resolves the organization associated with the admin host and requires an OrgAdmin assignment for that organization. SubdomainAdmin does not currently satisfy this check by itself.

GET /roles/authzmanagerroles/users/{userId}/organizations/{organizationId}/org-admin

A subdomain administrator currently also needs OrgAdmin for the organization used to enter AuthzManager. Removing that duplicate assignment requires implementing SubdomainAdmin implication during the authorization check.

Manage subdomain administrators

A current SubdomainAdmin can assign or remove the role from the subdomain users page. A candidate must have a default organization in the same subdomain and must already be OrgAdmin for that organization.

OpenIssuer rejects cross-subdomain management, duplicate assignments, and removal of the final SubdomainAdmin for a subdomain.

Continue to the administration guideReview the platform architectureReturn to documentation