Mapping between OAuth scopes and built-in roles

Questions OAuth/OIDC
1

Hello, I wonder if there is any documentation on mappings between OAuth 2.0 scopes granted to Service applications and the required built-in role assignments.

Examples:

  • Which built-in roles have the okta.users.read permission? (Read-Only Admins, Help Desk Admins etc.)
  • Which built-in roles have the okta.appGrants.read permission? (Apparently only Super Admins, but it is undocumented.)

The Administrator roles and permissions documentation is incomplete and does not contain any mappings onto the OAuth scopes.

This problem does not affect custom roles, which expose the exact list of assigned scopes through the management API. I would appreciate having a similar feature available for the built-in roles.

2

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.