Assign users to roles and manage roles

About the Everybody role

By default, all new users are added to the Everybody role. Members of the Everybody role are automatically granted permission to access the Identity Administration User Portal. Make sure the Everybody role allows user access to the Identity Administration User Portal at all times. This allows users to access the Identity Administration User Portal, open assigned applications and enroll mobile devices.

Change a user's role

To change a user's role, follow the steps above for Assign users to roles and manage roles, and assign the required user(s) to a new role.

When switching to a new role, the user's new permissions will take effect within a few minutes:

• For logged in users, up to 15 minutes

• After re-login, up to 3 minutes

Create a new role

You can create roles that are based on the service-specific roles described in CyberArk Identity Security Platform Shared Services user roles.

1. Go to Core Services > Roles, then click Add Role.

2. On the Description tab, complete the available fields and options.

   Field	Description
   Name	Enter a unique name for the role.
   Description	Enter a description for the role's purpose.
   Organization	Select an organization from the drop-down menu.
   Role Type	Select a role type. Static roles require you to manually add members. Dynamic roles evaluate membership based on object attributes. You can create this logic with JavaScript.

3. Click Members, then add members to the role.

   The steps to add members to a role are different depending on the type of role.

   • Static
   • Dynamic

   Click Add to add members to the role.

   You can add CyberArk Cloud Directory users and external directory service users.

   1. Click Administrative Rights, then add appropriate administrative rights.

   2. Click Assigned Applications, then assign applications to role members.

      Assigning applications to a role enables you to automatically deploy a default set of applications to the members of the role.

   3. Click Save to finish creating the role.

   1. Enter JavaScript in the Custom Logic box to add objects to the role based on attribute values, then click Save.

      You can use attributes from either AD or CyberArk Cloud Directory (including Additional Attributes). Examples of attributes that you could use include co (AD attribute for Country), Department, Location, Group membership, and Title.

      Click Load Sample to load an example script that you can start with. For example, there is a sample script that adds users with a specific value for the co attribute (AD) or Country attribute (CyberArk Cloud Directory).

      The following example shows the sample script that checks for the country code stored for a user.

      trace(User.UserType);
      if(User.UserType == 'AD') { // User is an Active Directory user
          try {
              trace('Looking for property: co');
              if(User.Properties.Properties.co == 'Aruba') {
                  return true;
              }
          } catch (error) {
      		trace('property: co not found');
          }
      } else if(User.UserType == 'CUS') { // User is a cloud directory user
          try {
              trace('Looking for additional attribute: country_');
              if(User.Properties.Properties['country_'] == 'Aruba') {
                  return true;
              }
          } catch (error) {
      		trace('additional attribute: Country not found');
          }
      }
      
      return false;

   2. Click Test User, then search for the user that you want to add to the role and click Next.

      A window displays indicating whether or not the user would be a member based on your custom logic.

      1. Click Administrative Rights, then add appropriate administrative rights.

      2. Click Assigned Applications, then assign applications to role members.

         Assigning applications to a role enables you to automatically deploy a default set of applications to the members of the role.

      3. Click Save to finish creating the role.

Export dynamic role membership

1. Click Export Users.

   You can choose from the following:

   Member set and export type options

   Field	Description
   Member set
   Active users	Users that are logged in with role-based attributes.
   All users	All users, active or not active, with roles.
   Export type
   Excel	You can export data in an Excel file. The Excel format is compact and can contain up to one million records.
   CSV	You can export data in a CSV file. The CSV format limitation is 150,000 records.

2. Click OK to generate the report based on the dynamic role script.

   You will receive an email with the report as an attachment.

   Due to email restrictions, the attachment size is limited based on the email server. The default is 20 MB.