role_assignment_users

Creates, updates, deletes, gets or lists a role_assignment_users resource.

Overview

Name	role_assignment_users
Type	Resource
Id	okta.users.role_assignment_users

Fields

The following fields are returned by SELECT queries:

get_user_assigned_role

Name	Datatype	Description
id	string	Role assignment ID
_embedded	object	Optional embedded resources for the role assignment
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification.
assignmentType	string	Role assignment type (CLIENT, GROUP, USER)
created	string (date-time)	Timestamp when the object was created
label	string	Label for the role assignment
lastUpdated	string (date-time)	Timestamp when the object was last updated
resource-set	string	Resource set ID
role	string	Role ID
status	string	Status of the role assignment (ACTIVE, INACTIVE)
type	string	| Role type | Description | |------------------------------|-------------------------------------------------------------| | ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator IAM-based standard role | | ACCESS_REQUESTS_ADMIN | Access Requests Administrator IAM-based standard role | | API_ACCESS_MANAGEMENT_ADMIN | Access Management Administrator standard role | | APP_ADMIN | Application Administrator standard role | | CUSTOM | Custom admin role | | GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard role | | HELP_DESK_ADMIN | Help Desk Administrator standard role | | ORG_ADMIN | Organizational Administrator standard role | | READ_ONLY_ADMIN | Read-Only Administrator standard role | | REPORT_ADMIN | Report Administrator standard role | | SUPER_ADMIN | Super Administrator standard role | | USER_ADMIN | User Administrator standard role | | WORKFLOWS_ADMIN | Workflows Administrator IAM-based standard role | (ACCESS_CERTIFICATIONS_ADMIN, ACCESS_REQUESTS_ADMIN, API_ACCESS_MANAGEMENT_ADMIN, APP_ADMIN, CUSTOM, GROUP_MEMBERSHIP_ADMIN, HELP_DESK_ADMIN, ORG_ADMIN, READ_ONLY_ADMIN, REPORT_ADMIN, SUPER_ADMIN, USER_ADMIN, WORKFLOWS_ADMIN) (title: roleType)

list_assigned_roles_for_user

Name	Datatype	Description

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_user_assigned_role	select	userId, roleAssignmentId, subdomain		Retrieves a role assigned to a user (identified by userId). The roleAssignmentId parameter is the unique identifier for either a standard role assignment object or a custom role resource set binding object.
list_assigned_roles_for_user	select	userId, subdomain	expand	Lists all roles assigned to a user (identified by userId)
assign_role_to_user	insert	userId, subdomain, type, role, resource-set	disableNotifications	Assigns a standard role to a user. You can also assign a custom role to a user, but the preferred method to assign a custom role to a user is to create a binding between the custom role, the resource set, and the user. See Create a role resource set binding. > Notes: > * The request payload is different for standard and custom role assignments. > * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.
unassign_role_from_user	delete	userId, roleAssignmentId, subdomain		Unassigns a role assignment (identified by roleAssignmentId) from a user (identified by userId)
assign_all_apps_as_target_to_role_for_user	exec	userId, roleAssignmentId, subdomain		Assigns all apps as target to an APP_ADMIN role
assign_app_target_to_admin_role_for_user	exec	userId, roleAssignmentId, appName, subdomain		Assigns an OIN app target for an APP_ADMIN role assignment to an admin user. When you assign the first app target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. Assigning an OIN app target overrides any existing app instance targets of the OIN app. For example, if a user was assigned to administer a specific Facebook instance, a successful request to add an OIN app target with facebook for appName makes that user the admin for all Facebook instances.
assign_app_instance_target_to_app_admin_role_for_user	exec	userId, roleAssignmentId, appName, appId, subdomain		Assigns an app instance target to an APP_ADMIN role assignment to an admin user. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. > Note: You can target a mixture of both OIN app and app instance targets, but can't assign permissions to manage all instances of an OIN app and then assign a subset of permission to the same OIN app. > For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
appId	string	Application ID
appName	string	Name of the app definition (the OIN catalog app key name)
roleAssignmentId	string	The id of the role assignment
subdomain	string	(default: my-org)
userId	string	ID of an existing Okta user
disableNotifications	string	Setting this to true grants the user third-party admin status
expand	string	An optional parameter used to return targets configured for the standard role assignment in the embedded property. Supported values: targets/groups or targets/catalog/apps

SELECT examples

get_user_assigned_role

Retrieves a role assigned to a user (identified by userId). The roleAssignmentId parameter is the unique identifier for either a standard role assignment object or a custom role resource set binding object.

SELECT
id,
_embedded,
_links,
assignmentType,
created,
label,
lastUpdated,
resource-set,
role,
status,
type
FROM okta.users.role_assignment_users
WHERE userId = '{{ userId }}' -- required
AND roleAssignmentId = '{{ roleAssignmentId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_assigned_roles_for_user

Lists all roles assigned to a user (identified by userId)

SELECT
*
FROM okta.users.role_assignment_users
WHERE userId = '{{ userId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND expand = '{{ expand }}'
;

INSERT examples

assign_role_to_user

Assigns a standard role to a user.

You can also assign a custom role to a user, but the preferred method to assign a custom role to a user is to create a binding between the custom role, the resource set, and the user. See Create a role resource set binding.

> Notes:
> * The request payload is different for standard and custom role assignments.
> * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.

INSERT INTO okta.users.role_assignment_users (
type,
resource-set,
role,
userId,
subdomain,
disableNotifications
)
SELECT 
'{{ type }}' /* required */,
'{{ resource-set }}' /* required */,
'{{ role }}' /* required */,
'{{ userId }}',
'{{ subdomain }}',
'{{ disableNotifications }}'
RETURNING
id,
_embedded,
_links,
assignmentType,
created,
label,
lastUpdated,
resource-set,
role,
status,
type
;

Manifest

# Description fields are for documentation purposes
- name: role_assignment_users
props:
  - name: userId
    value: "{{ userId }}"
    description: Required parameter for the role_assignment_users resource.
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the role_assignment_users resource.
  - name: type
    value: "{{ type }}"
    description: |
      Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:
    valid_values: ['ACCESS_CERTIFICATIONS_ADMIN', 'ACCESS_REQUESTS_ADMIN', 'API_ACCESS_MANAGEMENT_ADMIN', 'APP_ADMIN', 'GROUP_MEMBERSHIP_ADMIN', 'HELP_DESK_ADMIN', 'ORG_ADMIN', 'READ_ONLY_ADMIN', 'REPORT_ADMIN', 'SUPER_ADMIN', 'USER_ADMIN', 'WORKFLOWS_ADMIN']
  - name: resource-set
    value: "{{ resource-set }}"
    description: |
      Resource set ID
  - name: role
    value: "{{ role }}"
    description: |
      Custom role ID
  - name: disableNotifications
    value: "{{ disableNotifications }}"
    description: Setting this to `true` grants the user third-party admin status
    description: Setting this to `true` grants the user third-party admin status

DELETE examples

unassign_role_from_user

Unassigns a role assignment (identified by roleAssignmentId) from a user (identified by userId)

DELETE FROM okta.users.role_assignment_users
WHERE userId = '{{ userId }}' --required
AND roleAssignmentId = '{{ roleAssignmentId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

Lifecycle Methods

assign_all_apps_as_target_to_role_for_user

Assigns all apps as target to an APP_ADMIN role

EXEC okta.users.role_assignment_users.assign_all_apps_as_target_to_role_for_user 
@userId='{{ userId }}' --required, 
@roleAssignmentId='{{ roleAssignmentId }}' --required, 
@subdomain='{{ subdomain }}' --required
;

assign_app_target_to_admin_role_for_user

Assigns an OIN app target for an APP_ADMIN role assignment to an admin user. When you assign the first app target, you reduce the scope of the role assignment.
The role no longer applies to all app targets, but applies only to the specified target.

Assigning an OIN app target overrides any existing app instance targets of the OIN app.
For example, if a user was assigned to administer a specific Facebook instance, a successful request to add an OIN app target with facebook for appName makes that user the admin for all Facebook instances.

EXEC okta.users.role_assignment_users.assign_app_target_to_admin_role_for_user 
@userId='{{ userId }}' --required, 
@roleAssignmentId='{{ roleAssignmentId }}' --required, 
@appName='{{ appName }}' --required, 
@subdomain='{{ subdomain }}' --required
;

assign_app_instance_target_to_app_admin_role_for_user

Assigns an app instance target to an APP_ADMIN role assignment to an admin user. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment.
The role no longer applies to all app targets, but applies only to the specified target.

> Note: You can target a mixture of both OIN app and app instance targets, but can't assign permissions to manage all instances of an OIN app and then assign a subset of permission to the same OIN app.
> For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app.

EXEC okta.users.role_assignment_users.assign_app_instance_target_to_app_admin_role_for_user 
@userId='{{ userId }}' --required, 
@roleAssignmentId='{{ roleAssignmentId }}' --required, 
@appName='{{ appName }}' --required, 
@appId='{{ appId }}' --required, 
@subdomain='{{ subdomain }}' --required
;