diff --git a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/additional-scopes.png b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/additional-scopes.png index 16f0441365..78dc9c72c3 100644 Binary files a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/additional-scopes.png and b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/additional-scopes.png differ diff --git a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/authorize-an-api-resource.png b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/authorize-an-api-resource.png index 8d9115a328..355d6f1fc9 100644 Binary files a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/authorize-an-api-resource.png and b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/authorize-an-api-resource.png differ diff --git a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-api-authorization.png b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-api-authorization.png index aa3d954d27..ccaa5c49b1 100644 Binary files a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-api-authorization.png and b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-api-authorization.png differ diff --git a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-inherited-application-roles.png b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-inherited-application-roles.png deleted file mode 100644 index 52953cd8ca..0000000000 Binary files a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-inherited-application-roles.png and /dev/null differ diff --git a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-inherited-roles.png b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-inherited-roles.png new file mode 100644 index 0000000000..c8a892265d Binary files /dev/null and b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/b2b-inherited-roles.png differ diff --git a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/map-permissions-to-role.png b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/map-permissions-to-role.png index e530b5a339..8452bab605 100644 Binary files a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/map-permissions-to-role.png and b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/map-permissions-to-role.png differ diff --git a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/user-consent-for-developer.png b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/user-consent-for-developer.png index 5e036689bc..2c08d029ee 100644 Binary files a/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/user-consent-for-developer.png and b/en/asgardeo/docs/assets/img/guides/authorization/api-authorization/user-consent-for-developer.png differ diff --git a/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/invited-users.png b/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/invited-users.png new file mode 100644 index 0000000000..13a13c2a42 Binary files /dev/null and b/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/invited-users.png differ diff --git a/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/parent-org-user-invitation-email.png b/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/parent-org-user-invitation-email.png new file mode 100644 index 0000000000..7ca252eeba Binary files /dev/null and b/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/parent-org-user-invitation-email.png differ diff --git a/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/view-invitations.png b/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/view-invitations.png new file mode 100644 index 0000000000..d2a0c67f3a Binary files /dev/null and b/en/asgardeo/docs/assets/img/guides/organization/manage-organizations/view-invitations.png differ diff --git a/en/includes/guides/organization-management/api-authorization-for-b2b.md b/en/includes/guides/organization-management/api-authorization-for-b2b.md index bc503863ed..3f4327b8e7 100644 --- a/en/includes/guides/organization-management/api-authorization-for-b2b.md +++ b/en/includes/guides/organization-management/api-authorization-for-b2b.md @@ -4,7 +4,7 @@ API resources are created and authorized for applications on the organization (root). If the application consuming the API resources is shared with the organization, all application-specific configurations of API resources are inherited by the organization. {% if product_name == "Asgardeo" %} -![The relationship between terms]({{base_path}}/assets/img/guides/api-authorization/b2b-api-authorization.png){: width="700" style="display: block; margin: 0;"} +![The relationship between terms]({{base_path}}/assets/img/guides/authorization/api-authorization/b2b-api-authorization.png){: width="700" style="display: block; margin: 0;"} {% else %} ![The relationship between terms]({{base_path}}/assets/img/guides/authorization/api-authorization/b2b-api-authorization.png){: width="700" style="display: block; margin: 0;"} {% endif %} @@ -16,17 +16,17 @@ You need to configure your API resources on the organization (root) 2. [Authorize the API resource to an app]({{base_path}}/guides/api-authorization/#authorize-the-api-resources-for-an-app) 3. [Create roles and associate to application]({{base_path}}/guides/api-authorization/#associate-roles-to-the-application) -Organizations have the roles associated with their shared applications. Shared roles of organizations inherit the permission assignment to the role from the organization (root). +Organizations have roles associated with their shared applications. Shared roles of organizations inherit the permission assignment to the role from the organization (root). !!! note "Roles of an organization" - The shared roles in organizations will inherit the permission to role assignments from the organization (root). + The shared roles in organizations will inherit the permission to role assignments from the organization (root). Users and group assignment to the roles should be done separately for the organization, as the organization does not inherit the users or groups from the organization (root). {% if product_name == "Asgardeo" %} - ![Roles inherited from the organization (root)]({{base_path}}/assets/img/guides/api-authorization/b2b-inherited-roles.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} + ![Roles inherited from the organization (root)]({{base_path}}/assets/img/guides/authorization/api-authorization/b2b-inherited-roles.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} {% else %} ![Roles inherited from the organization (root)]({{base_path}}/assets/img/guides/authorization/api-authorization/b2b-inherited-roles.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} {% endif %} - Organization administrators cannot create new roles, modify name or permissions of the shared roles, or delete the shared roles, but you can assign these roles to your organization users and groups. + Organization administrators cannot create new roles, modify the name or permissions of the shared roles, or delete the shared roles, but you can assign these roles to your organization users and groups. ## Assign organization users to roles To assign roles to users of the organization: @@ -36,16 +36,17 @@ To assign roles to users of the organization: 3. Select the role you wish to assign to a user and click **Edit**. 4. Go to Users and click **Assign Users**. 5. Select the user who should be assigned to the selected role. -6. Click **Update** to complete the role to user assignment. +6. Click **Update** to complete the role-to-user assignment. ## Assign organization groups to roles Organizations maintain the following types of groups, and you can assign your application roles to any of these groups. - [Groups](#assign-user-groups-to-roles) - A collection of organization users. -- [Federated IdP Groups](#assign-federated-idp-groups-to-roles) - These groups are federated from connections on the organization. For example, groups federated from the Google connection. +- [Federated IdP Groups](#assign-federated-idp-groups-to-roles) - These groups are federated from connections in the organization. For example, groups federated from the Google connection. ### Assign user groups to roles + To assign roles to user groups of the organization: 1. On the {{ product_name }} Console, [switch to the organization]({{base_path}}/guides/organization-management/manage-organizations/#switch-between-organizations). @@ -56,7 +57,7 @@ To assign roles to user groups of the organization: 6. Click **Update** to complete the role to group assignment. ### Assign federated IdP groups to roles -To assign roles to federated IdP Groups: +To assign roles to federated IdP groups: !!! note "Before you begin" To get started, @@ -82,20 +83,20 @@ To request scopes for the user: 1. Add the new scopes to the `APIScope` parameter of the `config.js` file of the sample application. You need to request these new scopes in addition to the OIDC scopes of your application. - To get the scopes: + To get the scopes: - 1. On the {{ product_name }} Console, log in to the organization(root). - 2. Go to **Applications** and select your application. - 3. Copy the scopes listed at the end of the **API Authorization** section + 1. On the {{ product_name }} Console, log in to the organization(root). + 2. Go to **Applications** and select your application. + 3. Copy the scopes listed at the end of the **API Authorization** section - {% if product_name == "Asgardeo" %} - ![Additional scopes to access the API resource]({{base_path}}/assets/img/guides/api-authorization/additional-scopes.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} - {% else %} - ![Additional scopes to access the API resource]({{base_path}}/assets/img/guides/authorization/api-authorization/additional-scopes.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} - {% endif %} + {% if product_name == "Asgardeo" %} + ![Additional scopes to access the API resource]({{base_path}}/assets/img/guides/authorization/api-authorization/additional-scopes.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} + {% else %} + ![Additional scopes to access the API resource]({{base_path}}/assets/img/guides/authorization/api-authorization/additional-scopes.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} + {% endif %} !!! tip - When you add scopes to the configuration file, add them as comma-separated values. + When you add scopes to the configuration file, add them as comma-separated values. 2. Access the application URL. 3. Try to log in as a user with a group and permission to access the API resource. @@ -106,4 +107,4 @@ To request scopes for the user: 4. You will be able to see the assigned permissions on the `allowedScopes` parameter of the authentication response. !!! note "If you are switching organizations" - If the user switches the organization to another organization, the scopes will be updated according to the roles assigned to the user in the switched organization. + If the user switches organization to another organization, the scopes will be updated according to the roles assigned to the user in the switched organization. diff --git a/en/includes/guides/organization-management/email-domain-based-organization-discovery.md b/en/includes/guides/organization-management/email-domain-based-organization-discovery.md index e89aa81fd3..f245ffa0dd 100644 --- a/en/includes/guides/organization-management/email-domain-based-organization-discovery.md +++ b/en/includes/guides/organization-management/email-domain-based-organization-discovery.md @@ -26,7 +26,7 @@ and user Bob and Ben, with emails `bob@gcmart.com` and `ben@glory.com` should be ### Using the Console -1. Login to the organization (root) from the {{ product_name }} Console. +1. Login to the organization (root) from the {{ product_name }} Console. 2. On the {{ product_name }} Console, go to **Login & Registration**, and click **Email Domain Discovery** under **Organization Settings**. 3. Turn on the toggle to enable email domain based organization discovery. @@ -69,7 +69,7 @@ You need to: ![Assign Email Domain]({{base_path}}/assets/img/guides/organization/manage-organizations/assign-email-domains.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} 4. Select the organization you want to claim an email domain from the dropdown under **Organization Name**. -5. Type the email domain you want to claim for the selected organization under **Email Domains** and press enter. Here you can add one or more email domains. +5. Type the email domain you want to claim for the selected organization under **Email Domains** and press enter. Here you can add one or more email domains. ![Assign Email Domain for Best Car Mart]({{base_path}}/assets/img/guides/organization/manage-organizations/assign-email-domains-bestcarmart.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} @@ -77,10 +77,10 @@ You need to: !!! note - If the organization has any email domain mapping: - During the onboarding process of a user to an organization, the user's username (which is an email) undergoes a check against the assigned email domains of that organization. + During the onboarding process of a user to an organization, the user's username (which is an email) undergoes a check against the assigned email domains of that organization. If there's a match, the user is successfully onboarded to the organization. However, if there is no match, the user onboarding process will fail. - - While the organization (root) have enabled email domain based organization discovery, it is not compulsory to configure an email domain mapping for every organization in the hierarchy. - If an organization doesn't have an email domain mapping, the user onboarded to that organization can have any email domain other than email domains of organizations in the hierarchy. + - While the organization (root) has enabled email domain based organization discovery, it is not compulsory to configure an email domain mapping for every organization in the hierarchy. + If an organization doesn't have an email domain mapping, the user onboarded to that organization can have any email domain other than the email domains of organizations in the hierarchy. ### Using the API @@ -142,7 +142,7 @@ You need to: ] }' ``` - + ## Try it out 1. Set up the `Guardio-Business-App` as a [B2B application]({{base_path}}/guides/organization-management/try-a-b2b-use-case/#set-up-the-applications). @@ -154,8 +154,8 @@ You need to: - Email Domain: `bcmart.com` 4. [Switch]({{base_path}}/guides/organization-management/manage-organizations/#switch-between-organizations) to the `Best Car Mart` organization on the {{ product_name }} Console. - -5. Onboard a new user to `Best Car Mart` organization with following information. You can either set a password for the user or invite user to set the password. + +5. Onboard a new user to the `Best Car Mart` organization with the following information. You can either set a password for the user or invite the user to set the password. @@ -176,11 +176,11 @@ You need to:
Username and Email
- + 6. Try to log in to the `Guardio-Business-App` by selecting `Sign In With SSO`. -7. Input the username (which is an email) of `Alice` in `Best Car Mart` organization. - +7. Input the email address associated with the username for "Alice" within the "Best Car Mart" organization. + ![Email input for SSO login]({{base_path}}/assets/img/guides/organization/manage-organizations/email-input-for-sso-login.png){: width="500" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} 8. After resolving the organization from the email, Alice will be redirected to the authentication option of `Best Car Mart`. diff --git a/en/includes/guides/organization-management/manage-b2b-administration.md b/en/includes/guides/organization-management/manage-b2b-administration.md index 494d36ec31..994ff88473 100644 --- a/en/includes/guides/organization-management/manage-b2b-administration.md +++ b/en/includes/guides/organization-management/manage-b2b-administration.md @@ -53,7 +53,7 @@ Explore the [organization APIs]({{base_path}}/apis/organization-apis/) of {{ pro ## Use Console as the administration portal of organizations -You can use the {{ product_name }} Console as the administration portal of your B2B application. +You can use the {{ product_name }} Console as the administration portal of your B2B application. Each customer/partner organization can access their space in the {{ product_name }} Console by accessing the URL `https://:/t//o//console`. ### How to copy the URL of the organization space in the {{ product_name }} Console @@ -72,7 +72,7 @@ However, the following limitations apply when using the {{ product_name }} Conso 1. The {{ product_name }} Console is a generic administration portal that is not tailored to the specific needs of your B2B application. You cannot customize the given feature set for different organizations. 2. The branding configured in your B2B vendor organization or the overridden branding customizations of each customer/partner organization is not reflected in the {{ product_name }} Console portal. -3. Even if the customer/partner organization change the login flow of the B2B business application, the organization level {{ product_name }} Console login flow will remain the same. +3. Even if the customer/partner organization change the login flow of the B2B business application, the organization level {{ product_name }} Console login flow will remain the same. If the organization level Console login flow needs to be customized, navigate to the **Login Flow** tab of **Console Settings** in the organization space and configure as required. 4. The Console application is managed via roles defined specifically for the {{ product_name }} Console application. Therefore, the roles of the {{ product_name }} Console are not directly linked to the roles of your B2B application. As the B2B SaaS provider, you need to manage the roles of your B2B application separately. diff --git a/en/includes/guides/organization-management/onboard-sub-org-admins.md b/en/includes/guides/organization-management/onboard-sub-org-admins.md index 16d7ac98d8..ed9b215e68 100644 --- a/en/includes/guides/organization-management/onboard-sub-org-admins.md +++ b/en/includes/guides/organization-management/onboard-sub-org-admins.md @@ -14,12 +14,12 @@ Follow the steps below to onboard organization administrators using the {{ produ ### Prerequisites You need to: - - register your B2B application in the organization (root). - - create an administrator role required for your B2B application and associate it to the application. - - [create an organization]({{base_path}}/guides/organization-management/manage-organizations/#create-an-organization) and switch to the created organization. - - [share the B2B application]({{base_path}}/guides/organization-management/share-applications/) with required organizations. + - register your B2B application in the organization (root). + - create an administrator role required for your B2B application and associate it to the application. + - [create an organization]({{base_path}}/guides/organization-management/manage-organizations/#create-an-organization) and switch to the created organization. + - [share the B2B application]({{base_path}}/guides/organization-management/share-applications/) with required organizations. -!!! note +!!! note The organization creator, invited parent organization users who have user management and role management permissions can onboard administrators for the organization switching to the organization on the {{ product_name }} Console. ### Step 1: Create a user @@ -70,10 +70,11 @@ Using the self-service approach, the organization users can maintain their admin You can create the user in the organization (root) if the same user can manage multiple organizations. ### Prerequisites + You need to: - - register your B2B application in the organization (root). - - create an administrator role required for your B2B application and associate it to the application. + - register your B2B application in the organization (root). + - create an administrator role required for your B2B application and associate it to the application. ### Initial setup: Get access tokens @@ -82,70 +83,71 @@ Before creating admins using the APIs, you need to obtain the required access to 1. If your B2B application is OAuth2.0/OpenID Connect supported web application, you can use the same application. Otherwise, create a [standard based application]({{base_path}}/guides/applications/register-standard-based-app/) selecting OAuth2.0/OpenID Connect as the protocol. 2. Share the application with all organizations by enabling `share with all organizations`. 3. Go to the **Protocol** tab of the application and enable the following grant types, and click **Update**. + - Client Credential - Organization Switch - + !!! note Take note of the application's **Client ID** and **Client Secret**, as it will be required in the next steps. 4. Go to the **API Authorization** tab of the application and authorize the following APIs including the mentioned scopes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
API CategoryAPIScopes
Management APIOrganization Management API
- /api/server/v1/organizations		 - - Create Organizations
- - View Organizations
-
Organization APISCIM2 Roles API
- /o/scim2/Roles		 - - Update Role
- - View Role
-
Organization APIApplication Management API
- /o/api/server/v1/applications		 - - View Application -
Organization APISCIM2 Users API
- /o/scim2/Users
- (If you want to manage the user at the created organization level) - 		- - Create User
- - List Users
-
Management APISCIM2 Users API
- /scim2/Users
- (If you want to manage the user at the root organization) - 		- - Create User
- - View User
-
API CategoryAPIScopes
Management APIOrganization Management API
+ /api/server/v1/organizations		 + - Create Organizations
+ - View Organizations
+
Organization APISCIM2 Roles API
+ /o/scim2/Roles		 + - Update Role
+ - View Role
+
Organization APIApplication Management API
+ /o/api/server/v1/applications		 + - View Application +
Organization APISCIM2 Users API
+ /o/scim2/Users
+ (If you want to manage the user at the created organization level) + 		+ - Create User
+ - List Users
+
Management APISCIM2 Users API
+ /scim2/Users
+ (If you want to manage the user at the root organization) + 		+ - Create User
+ - View User
+
- + 5. Get an access token for the created application using the following cURL. ``` curl @@ -156,7 +158,7 @@ Before creating admins using the APIs, you need to obtain the required access to -d 'grant_type=client_credentials&scope=internal_org_role_mgt_view internal_org_role_mgt_update internal_org_user_mgt_create internal_org_user_mgt_list internal_org_application_mgt_view internal_organization_view internal_organization_create internal_user_mgt_view internal_user_mgt_create' ``` - The access token expiration time is set to `3600` seconds by default. If you wish to modify this duration, you can do so via the console. Go to the application's protocol section and update the **User access token expiry time**. + The access token expiration time is set to `3600` seconds by default. If you wish to modify this duration, you can do so via the console. Go to the application's protocol section and update the **User access token expiry time**. ### Maintain admins in the organization This approach is suitable when you want organizations to govern themselves with minimal interaction from the organization (root). Additionally, if you have a B2C user, this approach will help you to separate them from B2B users easily. @@ -167,6 +169,7 @@ This approach is suitable when you want organizations to govern themselves with To create and maintain admins in the organization: 1. Use the following cURL to check if the name of the organization you wish to create is available. + ``` curl curl --location 'https://{{ host_name }}/api/server/v1/organizations/check-name' \ --header 'Authorization: Bearer { access token }' @@ -232,7 +235,7 @@ To create and maintain admins in the organization: 5. Use the following cURL to obtain the `id` of the administrator role defined for your B2B application. - !!!note + !!!note Share the B2B application in organization(root) enabling `share with all organizations` or share the application to the created organization before the role operation. The roles associated to the B2B application will be shared with the organization only if the application is shared to the organization. @@ -290,6 +293,7 @@ This approach is particularly suitable when an organization user prefers to main To create and maintain admins in the organization (root): 1. Create a user in the organization (root) using {{ product_name }}'s SCIM APIs. + ``` curl curl --location 'https://{{ host_name }}/scim2/Users' \ --header 'Content-Type: application/json' \ @@ -330,6 +334,7 @@ To create and maintain admins in the organization (root): If the organization name is available for use, the response will be `"available": true`, else it will be `"available": false`. 3. If the required organization name is available for use, use the following cURL to create the organization and assign the user created in step 1 as the organization's admin. + ``` curl curl --location 'https://{{ host_name }}/api/server/v1/organizations' \ --header 'Authorization: Bearer { access token }' \ @@ -348,7 +353,7 @@ To create and maintain admins in the organization (root): ] }' ``` - + 4. Get an access token for the created organization by exchanging the access token obtained for the root organization. Use credentials of the shared oauth2 application to execute the cURL. ``` curl @@ -358,7 +363,7 @@ To create and maintain admins in the organization (root): -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'grant_type=organization_switch&token=&switching_organization=&scope=internal_org_role_mgt_view internal_org_role_mgt_update internal_org_user_mgt_create internal_org_user_mgt_list internal_org_application_mgt_view' ``` - + 5. A shadow user account should have been created in the new organization for the organization creator in the organization (root). Get the shadow account's user id using the following cURL. ``` curl @@ -366,8 +371,8 @@ To create and maintain admins in the organization (root): --header 'Authorization: Bearer {access-token-obtained-for-the-organization}' \ --header 'Content-Type: application/json' ``` - -6. Use the following cURL to obtain the `id` of the administrator role defined for your B2B application. + +6. Use the following cURL to obtain the `id` of the administrator role defined for your B2B application. !!!note Share the B2B application in organization(root) enabling `share with all organizations` or share the application to the created organization before the role operation. @@ -416,4 +421,4 @@ To create and maintain admins in the organization (root): } ] }' - ``` \ No newline at end of file + ``` diff --git a/en/includes/guides/organization-management/try-a-b2b-use-case.md b/en/includes/guides/organization-management/try-a-b2b-use-case.md index ab5a8908eb..c989eef59e 100644 --- a/en/includes/guides/organization-management/try-a-b2b-use-case.md +++ b/en/includes/guides/organization-management/try-a-b2b-use-case.md @@ -6,13 +6,11 @@ The following guide is a complete end-to-end use case on how to manage B2B (Busi You are an administrator of **Guardio Insurance**, which is a company that provides its services to other business organizations. -**Best Car Mart** has a partnership with Guardio Insurance to provide life insurance policies to its employees. Guardio Insurance exposes its services to Best Car Mart's employees through -its **Guardio Insurance Business App** and **Guardio Insurance Administrative App**. +**Best Car Mart** has a partnership with Guardio Insurance to provide life insurance policies to its employees. Guardio Insurance exposes its services to Best Car Mart's employees through its **Guardio Insurance Business App** and **Guardio Insurance Administrative App**. - - **Guardio Insurance Administrative App** - Application that provides administrative capabilities to administrators of **Guardio** customer/partner organizations. - The provided administrative capabilities are managing users, assigning roles, configuring an identity provider for the organization, and customize the login flow of **Guardio Insurance Business App** business application for their organizations. + - **Guardio Insurance Administrative App** - Application that provides administrative capabilities to administrators of **Guardio** customer/partner organizations. The provided administrative capabilities are managing users, assigning roles, configuring an identity provider for the organization, and customizing the login flow of **Guardio Insurance Business App** business application for their organizations. - - **Guardio Insurance Business App** - Application that provides insurance and claims settlement capabilities for other + - **Guardio Insurance Business App** - Application that provides insurance and claims settlement capabilities for other businesses, so that those businesses can use the software for internal requirements. The employees of Best Car Mart should be able to log in to the Guardio Insurance applications to consume its services. The administrators of Best Car Mart will manage the users of its organization and also determine the login experience that their users should have. @@ -22,7 +20,7 @@ The employees of Best Car Mart should be able to log in to the Guardio Insurance {% if product_name == "Asgardeo" %} ## Prerequisites -You should [create a root organization]({{base_path}}/guides/{{root_org_description_path}}). For this example we have created a root organization named `Guardio Insurance`. +You should [create a root organization]({{base_path}}/guides/{{root_org_description_path}}). For this example, we have created a root organization named `Guardio Insurance`. {% endif %} ## Set up the applications @@ -37,59 +35,59 @@ Follow the steps given below to register the Guardio Insurance applications with 1. Login into the organization(root). 2. [Register Traditional Web Applications]({{base_path}}/guides/applications/register-oidc-web-app/) in your organization (root) with the following settings: - - Register **Guardio Insurance Business App** - - - - - - - - - - - - - - -
Application NameAdd a name for the application.
- Guardio-Business-App -
ProtocolThe authentication protocol to use.
- OpenID Connect -
Authorized redirect URLsThe URLs to which the authorization code is sent to upon authentication and where the user is redirected to upon logout.
- http://localhost:3000/api/auth/callback/wso2is - http://localhost:3000 -
- - - Register **Guardio Insurance Administrative App** - - - - - - - - - - - - - - -
Application NameAdd a name for the application.
- Guardio-Admin-App -
ProtocolThe authentication protocol to use.
- OpenID Connect -
Authorized redirect URLsThe URLs to which the authorization code is sent to upon authentication and where the user is redirected to upon logout.
- http://localhost:3001/api/auth/callback/wso2isAdmin - http://localhost:3001 -
+ - Register **Guardio Insurance Business App** + + + + + + + + + + + + + + +
Application NameAdd a name for the application.
+ Guardio-Business-App +
ProtocolThe authentication protocol to use.
+ OpenID Connect +
Authorized redirect URLsThe URLs to which the authorization code is sent upon authentication and where the user is redirected upon logout.
+ http://localhost:3000/api/auth/callback/wso2is + http://localhost:3000 +
+ + - Register **Guardio Insurance Administrative App** + + + + + + + + + + + + + + +
Application NameAdd a name for the application.
+ Guardio-Admin-App +
ProtocolThe authentication protocol to use.
+ OpenID Connect +
Authorized redirect URLsThe URLs to which the authorization code is sent upon authentication and where the user is redirected upon logout.
+ http://localhost:3001/api/auth/callback/wso2isAdmin + http://localhost:3001 +
### Step 2: Share the applications with organizations Share the Guardio-Business-App and Guardio-Admin-App with your organizations. See instructions on how to [share applications with organizations]({{base_path}}/guides/organization-management/share-applications/). -When the application is shared to at least one organization, **Sign In with SSO** will be added as a login option in the application login screen, which organization users can use to log in. +When the application is shared with at least one organization, **Sign In with SSO** will be added as a login option in the application login screen, which organization users can use to log in. ### Step 3: Configure the applications on {{ product_name }} To configure the registered application on {{ product_name }}: @@ -98,14 +96,14 @@ On the {{ product_name }} Console, go to **Applications** and select the applica **Protocol Configurations** -1. Go to the **Protocol** tab of the application, configure the following values. +1. Go to the **Protocol** tab of the application, and configure the following values. - !!!note - If you have selected `Traditional Web Application` template for application creation, the following values should have already set properly. + !!!note + If you have selected the `Traditional Web Application` template for application creation, the following values should have already been set properly. Otherwise, verify and update the values. - For **Guardio Insurance Business App** - + @@ -117,7 +115,7 @@ On the {{ product_name }} Console, go to **Applications** and select the applica -
Allowed Grant Types
Authorization Redirect URLsThe URLs to which the authorization code is sent to upon authentication and where the user is redirected to upon logout.
+ 		The URLs to which the authorization code is sent upon authentication and where the user is redirected upon logout.
  • http://localhost:3000/api/auth/callback/wso2is
  • http://localhost:3000
    • @@ -133,7 +131,7 @@ On the {{ product_name }} Console, go to **Applications** and select the applica
- For **Guardio Insurance Administrative App** - + @@ -145,7 +143,7 @@ On the {{ product_name }} Console, go to **Applications** and select the applica -
Allowed Grant Types
Authorization Redirect URLsThe URLs to which the authorization code is sent to upon authentication and where the user is redirected to upon logout.
+ 		The URLs to which the authorization code is sent upon authentication and where the user is redirected upon logout.
  • http://localhost:3001/api/auth/callback/wso2isAdmin
  • http://localhost:3001
    • @@ -159,7 +157,7 @@ On the {{ product_name }} Console, go to **Applications** and select the applica
- + Take note of the `client_id` and `client_secret` generated for your applications. 2. Click **Update** to save your configurations. @@ -174,69 +172,69 @@ On the {{ product_name }} Console, go to **Applications** and select the applica **API Authorization** -1. Go to the **API Authorization** tab and authorize the APIs as follows. +Go to the **API Authorization** tab and authorize the APIs as follows. - - For **Guardio Insurance Business App** - - - No API authorization is required. +- For **Guardio Insurance Business App** + + - No API authorization is required. + +- For **Guardio Insurance Administrative App** + + - Select the following APIs under **SYSTEM_ORG** category (organization level APIs). + + + + + + + + + + + + + + + + + + + + + + +
SCIM2 Users APIScopes: +
    +
  • View User
    • +
  • List User
    • +
  • Create User
    • +
  • Update User
    • +
  • Delete User
    • +
+
SCIM2 Roles APIScopes:
+
    +
  • View Role
    • +
  • Update Role
    • +
+
SCIM2 Groups APIScopes:
+
    +
  • View Group
    • +
  • Update Group
    • +
+
Application Management APIScopes:
+
    +
  • View Application
    • +
  • Update Application
    • +
+
Identity Provider Management APIScopes:
+
    +
  • View Identity Provider
    • +
  • Create Identity Provider
    • +
  • Update Identity Provider
    • +
  • Delete Identity Provider
    • +
+
- - For **Guardio Insurance Administrative App** - - - Select the following APIs under **SYSTEM_ORG** category (organization level APIs). - - - - - - - - - - - - - - - - - - - - - - -
SCIM2 Users APIScopes: -
    -
  • View User
    • -
  • List User
    • -
  • Create User
    • -
  • Update User
    • -
  • Delete User
    • -
-
SCIM2 Roles APIScopes:
-
    -
  • View Role
    • -
  • Update Role
    • -
-
SCIM2 Groups APIScopes:
-
    -
  • View Group
    • -
  • Update Group
    • -
-
Application Management APIScopes:
-
    -
  • View Application
    • -
  • Update Application
    • -
-
Identity Provider Management APIScopes:
-
    -
  • View Identity Provider
    • -
  • Create Identity Provider
    • -
  • Update Identity Provider
    • -
  • Delete Identity Provider
    • -
-
- **Role Configurations** 1. Go to the **Roles** tab. @@ -244,9 +242,9 @@ On the {{ product_name }} Console, go to **Applications** and select the applica 3. Click **+ Create Role** and create roles with following values - For **Guardio Insurance Business App** - + - No roles required. - + - For **Guardio Insurance Administrative App** @@ -267,7 +265,7 @@ On the {{ product_name }} Console, go to **Applications** and select the applica
- + 4. Click **Create**. ### Step 4: Set up the client applications @@ -315,7 +313,7 @@ To set up the client applications: BusinessAppConfig.ApplicationConfig.Branding.tag - A branding tag line for your application. + A branding tagline for your application. Anytime . Anywhere @@ -356,32 +354,32 @@ To set up the client applications: BusinessAdminAppConfig.ApplicationConfig.Branding.tag - A branding tag line for your application. + A branding tagline for your application. Administrator Application -2. To start the **Guardio Insurance Business App**, open a terminal, navigate to the `b2b-sample` folder and execute the following commands: +2. To start the **Guardio Insurance Business App**, open a terminal, navigate to the `b2b-sample` folder, and execute the following commands: !!! note Ensure that your system meets the specified minimum requirements: - - Node version >= v16.16.0 - - NPM version >= 8.11.0 + - Node version >= v16.16.0 + - NPM version >= 8.11.0 ```bash npm install ``` - + ```bash npx nx serve business-app ``` - -3. To start the **Guardio Insurance Administrative App**, open a terminal, navigate to the `b2b-sample` folder and execute the following commands: + +3. To start the **Guardio Insurance Administrative App**, open a terminal, navigate to the `b2b-sample` folder, and execute the following commands: ```bash npm install ``` - + ```bash npx nx serve business-admin-app ``` @@ -398,8 +396,8 @@ As the administrator of **Guardio Insurance**, next you need to set up an organi [Onboard an administrator]({{base_path}}/guides/organization-management/onboard-sub-org-admins/#sales-led-approach) to the Best Car Mart organization using the values given below. -1. Create the user with following values. - +1. Create the user with the following values. + {{ user_details }} 2. Assign the created user to the **Guardio Administrator** role of the shared **Guardio-Admin-App** application. @@ -407,7 +405,7 @@ As the administrator of **Guardio Insurance**, next you need to set up an organi ## Try it out The following guides explain how an organization user who has admin privileges of **Guardio Insurance Administrative App** login and use the administration portal. -Also, this guide explain how other organization users consume the **Guardio Insurance Business App**. +Also, this guide explains how other organization users consume the **Guardio Insurance Business App**. ### Try out Sign In with SSO @@ -415,7 +413,7 @@ Follow the steps below to see how organization login works for a user in the **B 1. Open the application by copying the following URL to your browser: `http://localhost:3001/` - ![Guardio Admin Application Login]({{base_path}}/assets/img/guides/organization/manage-organizations/guardio-admin-app-login.png){: style="display: block; margin: 0; border: 0.3px solid lightgrey;"} + ![Guardio Admin Application Login]({{base_path}}/assets/img/guides/organization/manage-organizations/guardio-admin-app-login.png){: width="700" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} 2. Click **Sign In** and see that you are diverted to the {{ product_name }} login screen. @@ -425,7 +423,7 @@ Follow the steps below to see how organization login works for a user in the **B ![Sign in with SSO]({{base_path}}/assets/img/guides/organization/manage-organizations/sign-in-with-sso.png){: width="400" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} -5. Enter the username and password of a user who you have onboarded to Best Car Mart. +5. Enter the username and password of a user whom you have onboarded to Best Car Mart. 6. Click **Sign in** and grant permission for the application to use. @@ -436,7 +434,7 @@ Follow the steps below to see how organization login works for a user in the **B !!! note Learn how to build an administration portal for your B2B application in the [implement an administration portal]({{base_path}}/guides/organization-management/manage-b2b-administration/#implement-an-administration-portal) section. -**Best Car Mart** needs to manage its employees through an external IdP. As the administrator of Best Car Mart, Alex, is tasked with enabling login from the external IdP for Best Car Mart employees. +**Best Car Mart** needs to manage its employees through an external IdP. As the administrator of Best Car Mart, Alex is tasked with enabling login from the external IdP for Best Car Mart employees. To configure an identity provider for **Guardio Insurance Business App**: @@ -449,16 +447,16 @@ To configure an identity provider for **Guardio Insurance Business App**: 3. Select **Google** if you are onboarding a Google IdP or **Enterprise** if you are onboarding an enterprise IdP. ![Select Identity Provider method]({{base_path}}/assets/img/guides/organization/manage-organizations/select-idp-method.png){: width="600" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} - + !!!note - Make sure that the configured IdP will share `Email`, `First Name`, `Last Name`, and `Username` attributes of the authenticating user with {{ product_name }}. + Make sure that the configured IdP will share the `Email`, `First Name`, `Last Name`, and `Username` attributes of the authenticating user with {{ product_name }}. 4. Provide the details specific to your IdP and click **Create**. 5. Click **Add to login flow** to enable this IdP as the login option for Best Car Mart users in the application. 6. Open the **Guardio Insurance Business App** by copying the following URL to your browser: `http://localhost:3000/`. - + ![Guardio Business Application Login]({{base_path}}/assets/img/guides/organization/manage-organizations/guardio-app-login.png){: style="display: block; margin: 0; border: 0.3px solid lightgrey;"} -7. [Log in to the business application through SSO option](#try-out-sign-in-with-sso). Now, the users in the configured external IdP can be logged into the application. +7. [Log in to the business application through the SSO option](#try-out-sign-in-with-sso). Now, the users in the configured external IdP can be logged into the application.