diff --git a/en/asgardeo/docs/assets/img/guides/authorization/b2b-inherited-application-roles.png b/en/asgardeo/docs/assets/img/guides/authorization/b2b-inherited-application-roles.png
deleted file mode 100644
index 52953cd8ca..0000000000
Binary files a/en/asgardeo/docs/assets/img/guides/authorization/b2b-inherited-application-roles.png and /dev/null differ
diff --git a/en/includes/guides/organization-management/api-authorization-for-b2b.md b/en/includes/guides/organization-management/api-authorization-for-b2b.md
index b5406f2198..3f4327b8e7 100644
--- a/en/includes/guides/organization-management/api-authorization-for-b2b.md
+++ b/en/includes/guides/organization-management/api-authorization-for-b2b.md
@@ -4,7 +4,7 @@
API resources are created and authorized for applications on the organization (root). If the application consuming the API resources is shared with the organization, all application-specific configurations of API resources are inherited by the organization.
{% if product_name == "Asgardeo" %}
-![The relationship between terms]({{base_path}}/assets/img/guides/api-authorization/b2b-api-authorization.png){: width="700" style="display: block; margin: 0;"}
+![The relationship between terms]({{base_path}}/assets/img/guides/authorization/api-authorization/b2b-api-authorization.png){: width="700" style="display: block; margin: 0;"}
{% else %}
![The relationship between terms]({{base_path}}/assets/img/guides/authorization/api-authorization/b2b-api-authorization.png){: width="700" style="display: block; margin: 0;"}
{% endif %}
@@ -16,17 +16,17 @@ You need to configure your API resources on the organization (root)
2. [Authorize the API resource to an app]({{base_path}}/guides/api-authorization/#authorize-the-api-resources-for-an-app)
3. [Create roles and associate to application]({{base_path}}/guides/api-authorization/#associate-roles-to-the-application)
-Organizations have the roles associated with their shared applications. Shared roles of organizations inherit the permission assignment to the role from the organization (root).
+Organizations have roles associated with their shared applications. Shared roles of organizations inherit the permission assignment to the role from the organization (root).
!!! note "Roles of an organization"
The shared roles in organizations will inherit the permission to role assignments from the organization (root).
Users and group assignment to the roles should be done separately for the organization, as the organization does not inherit the users or groups from the organization (root).
{% if product_name == "Asgardeo" %}
- ![Roles inherited from the organization (root)]({{base_path}}/assets/img/guides/api-authorization/b2b-inherited-roles.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
+ ![Roles inherited from the organization (root)]({{base_path}}/assets/img/guides/authorization/api-authorization/b2b-inherited-roles.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
{% else %}
![Roles inherited from the organization (root)]({{base_path}}/assets/img/guides/authorization/api-authorization/b2b-inherited-roles.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
{% endif %}
- Organization administrators cannot create new roles, modify name or permissions of the shared roles, or delete the shared roles, but you can assign these roles to your organization users and groups.
+ Organization administrators cannot create new roles, modify the name or permissions of the shared roles, or delete the shared roles, but you can assign these roles to your organization users and groups.
## Assign organization users to roles
To assign roles to users of the organization:
@@ -36,16 +36,17 @@ To assign roles to users of the organization:
3. Select the role you wish to assign to a user and click **Edit**.
4. Go to Users and click **Assign Users**.
5. Select the user who should be assigned to the selected role.
-6. Click **Update** to complete the role to user assignment.
+6. Click **Update** to complete the role-to-user assignment.
## Assign organization groups to roles
Organizations maintain the following types of groups, and you can assign your application roles to any of these groups.
- [Groups](#assign-user-groups-to-roles) - A collection of organization users.
-- [Federated IdP Groups](#assign-federated-idp-groups-to-roles) - These groups are federated from connections on the organization. For example, groups federated from the Google connection.
+- [Federated IdP Groups](#assign-federated-idp-groups-to-roles) - These groups are federated from connections in the organization. For example, groups federated from the Google connection.
### Assign user groups to roles
+
To assign roles to user groups of the organization:
1. On the {{ product_name }} Console, [switch to the organization]({{base_path}}/guides/organization-management/manage-organizations/#switch-between-organizations).
@@ -56,7 +57,7 @@ To assign roles to user groups of the organization:
6. Click **Update** to complete the role to group assignment.
### Assign federated IdP groups to roles
-To assign roles to federated IdP Groups:
+To assign roles to federated IdP groups:
!!! note "Before you begin"
To get started,
@@ -82,20 +83,20 @@ To request scopes for the user:
1. Add the new scopes to the `APIScope` parameter of the `config.js` file of the sample application. You need to request these new scopes in addition to the OIDC scopes of your application.
- To get the scopes:
+ To get the scopes:
- 1. On the {{ product_name }} Console, log in to the organization(root).
- 2. Go to **Applications** and select your application.
- 3. Copy the scopes listed at the end of the **API Authorization** section
+ 1. On the {{ product_name }} Console, log in to the organization(root).
+ 2. Go to **Applications** and select your application.
+ 3. Copy the scopes listed at the end of the **API Authorization** section
- {% if product_name == "Asgardeo" %}
- ![Additional scopes to access the API resource]({{base_path}}/assets/img/guides/api-authorization/additional-scopes.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
- {% else %}
- ![Additional scopes to access the API resource]({{base_path}}/assets/img/guides/authorization/api-authorization/additional-scopes.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
- {% endif %}
+ {% if product_name == "Asgardeo" %}
+ ![Additional scopes to access the API resource]({{base_path}}/assets/img/guides/authorization/api-authorization/additional-scopes.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
+ {% else %}
+ ![Additional scopes to access the API resource]({{base_path}}/assets/img/guides/authorization/api-authorization/additional-scopes.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
+ {% endif %}
!!! tip
- When you add scopes to the configuration file, add them as comma-separated values.
+ When you add scopes to the configuration file, add them as comma-separated values.
2. Access the application URL.
3. Try to log in as a user with a group and permission to access the API resource.
@@ -106,4 +107,4 @@ To request scopes for the user:
4. You will be able to see the assigned permissions on the `allowedScopes` parameter of the authentication response.
!!! note "If you are switching organizations"
- If the user switches the organization to another organization, the scopes will be updated according to the roles assigned to the user in the switched organization.
+ If the user switches organization to another organization, the scopes will be updated according to the roles assigned to the user in the switched organization.
diff --git a/en/includes/guides/organization-management/email-domain-based-organization-discovery.md b/en/includes/guides/organization-management/email-domain-based-organization-discovery.md
index e89aa81fd3..f245ffa0dd 100644
--- a/en/includes/guides/organization-management/email-domain-based-organization-discovery.md
+++ b/en/includes/guides/organization-management/email-domain-based-organization-discovery.md
@@ -26,7 +26,7 @@ and user Bob and Ben, with emails `bob@gcmart.com` and `ben@glory.com` should be
### Using the Console
-1. Login to the organization (root) from the {{ product_name }} Console.
+1. Login to the organization (root) from the {{ product_name }} Console.
2. On the {{ product_name }} Console, go to **Login & Registration**, and click **Email Domain Discovery** under **Organization Settings**.
3. Turn on the toggle to enable email domain based organization discovery.
@@ -69,7 +69,7 @@ You need to:
![Assign Email Domain]({{base_path}}/assets/img/guides/organization/manage-organizations/assign-email-domains.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
4. Select the organization you want to claim an email domain from the dropdown under **Organization Name**.
-5. Type the email domain you want to claim for the selected organization under **Email Domains** and press enter. Here you can add one or more email domains.
+5. Type the email domain you want to claim for the selected organization under **Email Domains** and press enter. Here you can add one or more email domains.
![Assign Email Domain for Best Car Mart]({{base_path}}/assets/img/guides/organization/manage-organizations/assign-email-domains-bestcarmart.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
@@ -77,10 +77,10 @@ You need to:
!!! note
- If the organization has any email domain mapping:
- During the onboarding process of a user to an organization, the user's username (which is an email) undergoes a check against the assigned email domains of that organization.
+ During the onboarding process of a user to an organization, the user's username (which is an email) undergoes a check against the assigned email domains of that organization.
If there's a match, the user is successfully onboarded to the organization. However, if there is no match, the user onboarding process will fail.
- - While the organization (root) have enabled email domain based organization discovery, it is not compulsory to configure an email domain mapping for every organization in the hierarchy.
- If an organization doesn't have an email domain mapping, the user onboarded to that organization can have any email domain other than email domains of organizations in the hierarchy.
+ - While the organization (root) has enabled email domain based organization discovery, it is not compulsory to configure an email domain mapping for every organization in the hierarchy.
+ If an organization doesn't have an email domain mapping, the user onboarded to that organization can have any email domain other than the email domains of organizations in the hierarchy.
### Using the API
@@ -142,7 +142,7 @@ You need to:
]
}'
```
-
+
## Try it out
1. Set up the `Guardio-Business-App` as a [B2B application]({{base_path}}/guides/organization-management/try-a-b2b-use-case/#set-up-the-applications).
@@ -154,8 +154,8 @@ You need to:
- Email Domain: `bcmart.com`
4. [Switch]({{base_path}}/guides/organization-management/manage-organizations/#switch-between-organizations) to the `Best Car Mart` organization on the {{ product_name }} Console.
-
-5. Onboard a new user to `Best Car Mart` organization with following information. You can either set a password for the user or invite user to set the password.
+
+5. Onboard a new user to the `Best Car Mart` organization with the following information. You can either set a password for the user or invite the user to set the password.
Username and Email |
@@ -176,11 +176,11 @@ You need to:
-
+
6. Try to log in to the `Guardio-Business-App` by selecting `Sign In With SSO`.
-7. Input the username (which is an email) of `Alice` in `Best Car Mart` organization.
-
+7. Input the email address associated with the username for "Alice" within the "Best Car Mart" organization.
+
![Email input for SSO login]({{base_path}}/assets/img/guides/organization/manage-organizations/email-input-for-sso-login.png){: width="500" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
8. After resolving the organization from the email, Alice will be redirected to the authentication option of `Best Car Mart`.
diff --git a/en/includes/guides/organization-management/manage-b2b-administration.md b/en/includes/guides/organization-management/manage-b2b-administration.md
index 494d36ec31..994ff88473 100644
--- a/en/includes/guides/organization-management/manage-b2b-administration.md
+++ b/en/includes/guides/organization-management/manage-b2b-administration.md
@@ -53,7 +53,7 @@ Explore the [organization APIs]({{base_path}}/apis/organization-apis/) of {{ pro
## Use Console as the administration portal of organizations
-You can use the {{ product_name }} Console as the administration portal of your B2B application.
+You can use the {{ product_name }} Console as the administration portal of your B2B application.
Each customer/partner organization can access their space in the {{ product_name }} Console by accessing the URL `https://:/t//o//console`.
### How to copy the URL of the organization space in the {{ product_name }} Console
@@ -72,7 +72,7 @@ However, the following limitations apply when using the {{ product_name }} Conso
1. The {{ product_name }} Console is a generic administration portal that is not tailored to the specific needs of your B2B application. You cannot customize the given feature set for different organizations.
2. The branding configured in your B2B vendor organization or the overridden branding customizations of each customer/partner organization is not reflected in the {{ product_name }} Console portal.
-3. Even if the customer/partner organization change the login flow of the B2B business application, the organization level {{ product_name }} Console login flow will remain the same.
+3. Even if the customer/partner organization change the login flow of the B2B business application, the organization level {{ product_name }} Console login flow will remain the same.
If the organization level Console login flow needs to be customized, navigate to the **Login Flow** tab of **Console Settings** in the organization space and configure as required.
4. The Console application is managed via roles defined specifically for the {{ product_name }} Console application. Therefore, the roles of the {{ product_name }} Console are not directly linked to the roles of your B2B application.
As the B2B SaaS provider, you need to manage the roles of your B2B application separately.
diff --git a/en/includes/guides/organization-management/onboard-sub-org-admins.md b/en/includes/guides/organization-management/onboard-sub-org-admins.md
index 16d7ac98d8..ed9b215e68 100644
--- a/en/includes/guides/organization-management/onboard-sub-org-admins.md
+++ b/en/includes/guides/organization-management/onboard-sub-org-admins.md
@@ -14,12 +14,12 @@ Follow the steps below to onboard organization administrators using the {{ produ
### Prerequisites
You need to:
- - register your B2B application in the organization (root).
- - create an administrator role required for your B2B application and associate it to the application.
- - [create an organization]({{base_path}}/guides/organization-management/manage-organizations/#create-an-organization) and switch to the created organization.
- - [share the B2B application]({{base_path}}/guides/organization-management/share-applications/) with required organizations.
+ - register your B2B application in the organization (root).
+ - create an administrator role required for your B2B application and associate it to the application.
+ - [create an organization]({{base_path}}/guides/organization-management/manage-organizations/#create-an-organization) and switch to the created organization.
+ - [share the B2B application]({{base_path}}/guides/organization-management/share-applications/) with required organizations.
-!!! note
+!!! note
The organization creator, invited parent organization users who have user management and role management permissions can onboard administrators for the organization switching to the organization on the {{ product_name }} Console.
### Step 1: Create a user
@@ -70,10 +70,11 @@ Using the self-service approach, the organization users can maintain their admin
You can create the user in the organization (root) if the same user can manage multiple organizations.
### Prerequisites
+
You need to:
- - register your B2B application in the organization (root).
- - create an administrator role required for your B2B application and associate it to the application.
+ - register your B2B application in the organization (root).
+ - create an administrator role required for your B2B application and associate it to the application.
### Initial setup: Get access tokens
@@ -82,70 +83,71 @@ Before creating admins using the APIs, you need to obtain the required access to
1. If your B2B application is OAuth2.0/OpenID Connect supported web application, you can use the same application. Otherwise, create a [standard based application]({{base_path}}/guides/applications/register-standard-based-app/) selecting OAuth2.0/OpenID Connect as the protocol.
2. Share the application with all organizations by enabling `share with all organizations`.
3. Go to the **Protocol** tab of the application and enable the following grant types, and click **Update**.
+
- Client Credential
- Organization Switch
-
+
!!! note
Take note of the application's **Client ID** and **Client Secret**, as it will be required in the next steps.
4. Go to the **API Authorization** tab of the application and authorize the following APIs including the mentioned scopes.
-
- API Category |
- API |
- Scopes |
-
-
- Management API |
- Organization Management API
- /api/server/v1/organizations |
-
- - Create Organizations
- - View Organizations
- |
-
-
- Organization API |
- SCIM2 Roles API
- /o/scim2/Roles |
-
- - Update Role
- - View Role
- |
-
-
- Organization API |
- Application Management API
- /o/api/server/v1/applications |
-
- - View Application
- |
-
-
- Organization API |
- SCIM2 Users API
- /o/scim2/Users
- (If you want to manage the user at the created organization level)
- |
-
- - Create User
- - List Users
- |
-
-
- Management API |
- SCIM2 Users API
- /scim2/Users
- (If you want to manage the user at the root organization)
- |
-
- - Create User
- - View User
- |
-
+
+ API Category |
+ API |
+ Scopes |
+
+
+ Management API |
+ Organization Management API
+ /api/server/v1/organizations |
+
+ - Create Organizations
+ - View Organizations
+ |
+
+
+ Organization API |
+ SCIM2 Roles API
+ /o/scim2/Roles |
+
+ - Update Role
+ - View Role
+ |
+
+
+ Organization API |
+ Application Management API
+ /o/api/server/v1/applications |
+
+ - View Application
+ |
+
+
+ Organization API |
+ SCIM2 Users API
+ /o/scim2/Users
+ (If you want to manage the user at the created organization level)
+ |
+
+ - Create User
+ - List Users
+ |
+
+
+ Management API |
+ SCIM2 Users API
+ /scim2/Users
+ (If you want to manage the user at the root organization)
+ |
+
+ - Create User
+ - View User
+ |
+
-
+
5. Get an access token for the created application using the following cURL.
``` curl
@@ -156,7 +158,7 @@ Before creating admins using the APIs, you need to obtain the required access to
-d 'grant_type=client_credentials&scope=internal_org_role_mgt_view internal_org_role_mgt_update internal_org_user_mgt_create internal_org_user_mgt_list internal_org_application_mgt_view internal_organization_view internal_organization_create internal_user_mgt_view internal_user_mgt_create'
```
- The access token expiration time is set to `3600` seconds by default. If you wish to modify this duration, you can do so via the console. Go to the application's protocol section and update the **User access token expiry time**.
+ The access token expiration time is set to `3600` seconds by default. If you wish to modify this duration, you can do so via the console. Go to the application's protocol section and update the **User access token expiry time**.
### Maintain admins in the organization
This approach is suitable when you want organizations to govern themselves with minimal interaction from the organization (root). Additionally, if you have a B2C user, this approach will help you to separate them from B2B users easily.
@@ -167,6 +169,7 @@ This approach is suitable when you want organizations to govern themselves with
To create and maintain admins in the organization:
1. Use the following cURL to check if the name of the organization you wish to create is available.
+
``` curl
curl --location 'https://{{ host_name }}/api/server/v1/organizations/check-name' \
--header 'Authorization: Bearer { access token }'
@@ -232,7 +235,7 @@ To create and maintain admins in the organization:
5. Use the following cURL to obtain the `id` of the administrator role defined for your B2B application.
- !!!note
+ !!!note
Share the B2B application in organization(root) enabling `share with all organizations` or share the application to the created organization before the role operation.
The roles associated to the B2B application will be shared with the organization only if the application is shared to the organization.
@@ -290,6 +293,7 @@ This approach is particularly suitable when an organization user prefers to main
To create and maintain admins in the organization (root):
1. Create a user in the organization (root) using {{ product_name }}'s SCIM APIs.
+
``` curl
curl --location 'https://{{ host_name }}/scim2/Users' \
--header 'Content-Type: application/json' \
@@ -330,6 +334,7 @@ To create and maintain admins in the organization (root):
If the organization name is available for use, the response will be `"available": true`, else it will be `"available": false`.
3. If the required organization name is available for use, use the following cURL to create the organization and assign the user created in step 1 as the organization's admin.
+
``` curl
curl --location 'https://{{ host_name }}/api/server/v1/organizations' \
--header 'Authorization: Bearer { access token }' \
@@ -348,7 +353,7 @@ To create and maintain admins in the organization (root):
]
}'
```
-
+
4. Get an access token for the created organization by exchanging the access token obtained for the root organization. Use credentials of the shared oauth2 application to execute the cURL.
``` curl
@@ -358,7 +363,7 @@ To create and maintain admins in the organization (root):
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=organization_switch&token=&switching_organization=&scope=internal_org_role_mgt_view internal_org_role_mgt_update internal_org_user_mgt_create internal_org_user_mgt_list internal_org_application_mgt_view'
```
-
+
5. A shadow user account should have been created in the new organization for the organization creator in the organization (root). Get the shadow account's user id using the following cURL.
``` curl
@@ -366,8 +371,8 @@ To create and maintain admins in the organization (root):
--header 'Authorization: Bearer {access-token-obtained-for-the-organization}' \
--header 'Content-Type: application/json'
```
-
-6. Use the following cURL to obtain the `id` of the administrator role defined for your B2B application.
+
+6. Use the following cURL to obtain the `id` of the administrator role defined for your B2B application.
!!!note
Share the B2B application in organization(root) enabling `share with all organizations` or share the application to the created organization before the role operation.
@@ -416,4 +421,4 @@ To create and maintain admins in the organization (root):
}
]
}'
- ```
\ No newline at end of file
+ ```