# Role Management

Roles provide sets of permissions that grant access to functionality in the user interface, through the integrations, and when using the REST APIs. Permissions are granted by assigning users or groups to the system roles or at the various levels in the organizational hierarchy: root organization, repository managers, organizations, and applications.

Roles are assigned to individual users or groups managed by your identity managing tools such as SAML or LDAP.

**Authenticated Users Group**

Lifecycle has a built-in group called Authenticated Users that contains any authenticated user.

## Role Hierarchy

The scope of permissions granted to a role is governed by where that role is assigned in the system hierarchy.

In the Lifecycle solution roles are assigned at the following levels:

- **Root Organization** - Grants permissions to all organizations, applications, and repositories.
- **Organization** - Grants permissions to that organization and all organizations and applications under it in the hierarchy.
- **Application** - Grants permissions only to the individual application.

The Repository Firewall solution has additional entities to which roles can be assigned:

- **Repository Managers** - Grant permissions to the configuration for the repository manager and all of the repositories managed there.
- **Repositories** - Grants permissions to specific repository reports.

## Built-in Roles

The built-in roles will meet most common use cases. Custom roles may be created to match your organizational requirements.

**Built-in Admin User**

The built-in `Admin` user account is assigned to both the System Administrator and Policy Administrator roles.

### Administrator Roles

- **System Administrator** \- Manages system configuration and users, which includes LDAP and product license management as well as the ability to assign other users to the System Administrator role, and access to the audit log.
- **Policy Administrator** \- Provides full control over organizations, applications, policies, policy violations, and custom roles.

#### [Administrator Role Permissions](https://help.sonatype.com/en/role-management.html#administrator-role-permissions_body)

| Permissions | System Administrator | Policy Administrator |
| --- | --- | --- |
| **Administrator Permissions** |
| Edit System Configuration and Users |  |  |
| Edit Custom Roles |  |  |
| View All Roles |  |  |
| Access Audit Log |  |  |
| **Lifecycle Permissions** |
| Edit Proprietary Components |  |  |
| Claim Components |  |  |
| Edit IQ Elements |  |  |
| View IQ Elements |  |  |
| Edit Access Control |  |  |
| Evaluate Applications |  |  |
| Evaluate Individual Components |  |  |
| Add Applications |  |  |
| Manage Automatic Application Creation |  |  |
| Manage Automatic Source Control Configuration |  |  |
| ****Remediation Permissions**** |
| Waive Policy Violations |  |  |
| Change Licenses |  |  |
| Change Security Vulnerabilities |  |  |
| Review Legal obligations for component licenses |  |  |

### Organizational Roles

- **Owner** \- Manages assigned organizations, applications, policies, and policy violations.
- **Developer** \- Views all information for their assigned organization or application.
- **Application Evaluator** \- Minimum access to scan the application via the CI integrations. Evaluate applications and view policy violation summary results within the CI.
- **Component Evaluator** \- Provides the Evaluate Applications permission.
- **Legal Reviewer** \- Reviews legal obligations for component licenses.

#### [Organizational Role Permissions](https://help.sonatype.com/en/role-management.html#organizational-role-permissions_body)

| Permissions | Owner | Developer | Application Evaluator | Component Evaluator | Legal Reviewer |
| --- | --- | --- | --- | --- | --- |
| **Administrator Permissions** |
| Edit System Configuration and Users |  |  |  |  |  |
| Edit Custom Roles |  |  |  |  |  |
| View All Roles |  |  |  |  |  |
| **Lifecycle Permissions** |
| Edit Proprietary Components |  |  |  |  |  |
| Claim Components |  |  |  |  |  |
| Edit IQ Elements |  |  |  |  |  |
| View IQ Elements |  |  |  |  |  |
| Edit Access Control |  |  |  |  |  |
| Evaluate Applications |  |  |  |  |  |
| Evaluate Individual Components |  |  |  |  |  |
| Add Applications |  |  |  |  |  |
| Manage Automatic Application Creation |  |  |  |  |  |
| Manage Automatic Source Control Configuration |  |  |  |  |  |
| ****Remediation Permissions**** |
| Waive Policy Violations |  |  |  |  |  |
| Change Licenses |  |  |  |  |  |
| Change Security Vulnerabilities |  |  |  |  |  |
| Review Legal obligations for component releases |  |  |  |  |  |

**Note**

For CI integrations, use a custom organizational role instead of the built-in Application Evaluator role. Include **Evaluate Applications** (`EVALUATE_APPLICATION`) and **View IQ Elements** (`READ`).

## [Permission Details](https://help.sonatype.com/en/role-management.html#permission-details_body)

### Edit Proprietary Components

Proprietary components are those that are unique to your organization. Lifecycle will flag them as "Unknown" components. This permission allows you to configure these components to change the match state to "Exact" during the next scan or re-evaluation.

### Claim Components

This permission allows you to alter the match state of the component from the Application Composition Report.

### Edit IQ Elements

_Edit IQ Elements_ is a wide-reaching permission that enables most add/edit/delete operations that are not governed by a more specific permission for the following items:

- organizations
- applications, except adding them
- application categories
- policies
- continuous monitoring
- policy violation grandfathering (As part of our inclusive language initiatives, we have renamed this feature to _Legacy Violations_ starting with release 167.)
- license threat groups
- component labels
- data retention policies
- quarantined repository components
- repositories
- source control entries

### View IQ Elements

_View IQ Elements_ grants read-only access to most properties of a respective organization/application/repository to view the current configuration and policy evaluation state.

_View IQ Elements_ is the minimum permission required for users to be able to browse organization/application/repository-related web pages, including application composition reports.

### Edit Access Control

This permission allows you to manage access control for applications, organizations, and repositories only. For managing all other access controls, use _Edit IQ Elements_ permission. All roles that have _Edit IQ Elements_ permission also have the '_Edit Access Control'_ permission.

### Evaluate Applications

This permission lets users evaluate or scan applications. Users also need this permission to the target application.

**Note**

Importing an SBOM (scanning a file) in SBOM Manager requires write permissions for the target application in addition to the Evaluate Applications permission.

### Evaluate Individual Components

This permission lets users evaluate individual components. It's intended for use with our IDE integrations such as Intellij or Eclipse. This permission is also required to evaluate components processed by Sonatype Repository Firewall at the repository level.

### Add Applications

This permission allows users to create or import applications (using _Automatic Source Control Configuration feature_) within the scope of an organization.

### Manage Automatic Source Control Configuration

This permission allows users to enable or disable automatic source control configuration using the _Automatic Source Control Configuration_ system preference.

### Waive Policy Violations

This permission allows users to:

1. Release quarantined components by waiving policy violations
2. Unblock components to go ahead with a build or release
3. Lower violation counts to reduce noise

### Change Licenses

This permission allows users to override the effective license at the component level and set its status to _open_ (default), _acknowledged_, _overridden_, _selected_ or _confirmed._

### Change Security Vulnerabilities

This permission allows users to change the status of a security vulnerability to _open, acknowledged, applicable or confirmed_, at the component level.

### Review Legal Obligations for Component Releases

This permission allows users to review licenses at the application/component level.

### Access Audit Log

This permission allows users to view and retrieve audit log events generated by the Lifecycle system.

Users with this permission can access audit log data using the [Audit Log REST API](https://help.sonatype.com/en/audit-log-rest-api.html#audit-log-rest-api), which returns audit events such as system configuration changes, role and permission updates, authentication activity, and other administrative actions.

This permission is required to access the [Audit Log REST API](https://help.sonatype.com/en/audit-log-rest-api.html#audit-log-rest-api).

**Note**

The _Access Audit Log_ permission is effective only when the role containing it is assigned to an organization. To grant audit log access across the entire system, assign the role at the Root Organization level.

## Viewing Roles

Users need to be assigned to the `System Administrator` role to manage roles.

1. Select the _System Preferences_ icon on the Lifecycle toolbar.
2. Select _Roles_

|     |
| --- |
|  |

### Built-in Role Permissions

To view permissions assigned to built-in roles:

1. Click the _System Preferences_ icon on the Lifecycle toolbar.
2. Click _Roles_ on the System Preferences submenu. A list of roles is displayed.
3. Click the arrow next to a specific role to view its details and permissions.
4. The built-in roles have the permissions shown below.

### Built-in Role Audit Log Access

The following built-in role includes the _Access Audit Log_ permission by default:

- System Administrator

Other built-in roles do not include audit log access by default. To grant audit log access to additional users, create a custom role that includes the _Access Audit Log_ permission and assign it at the appropriate level.

## Managing Administrator Roles

To manage administrator roles, you must authenticate as a user assigned to the System Administrator role.

### Viewing Administrator Roles

1. Click the System Preferences icon.
2. Click _Administrators_. A list of administrator roles and assigned members is displayed.

### Assigning Users to Administrator Roles

1. Click the System Preferences icon.
2. Click _Administrators_. The administrator's view is displayed.
3. Click the _row_ for the role to which you want to add users. The administrator's view is updated to display the role and its members.
4. Search for a user you want to add to the role by entering a full name or part of a name with an asterisk into the search box, the search list will be updated automatically as you type in. You can use an asterisk as a wildcard at the beginning or end of a character string. For example, isa\*, \*mov, and \*asi\* will all match the name, "Isaac Asimov." Any matching names are displayed in the Available list.
5. To add a user to the role, click a user’s name in the dropdown menu with the results of the search, the name will be added to the Members Added list.
6. To remove a user from a role, click a user’s name in the Members Added.
7. You can filter the list of Added Members with the filter field, the list will be updated automatically as you type in.
8. If you have LDAP configured, and you don't have set the _Group Search Enabled_ option, you can add groups by name without fetching them in the search field, just type in the name of the group in the _Associate Group_ field and click add.
9. Click _Submit_ to save the role assignment(s).

|     |
| --- |
|  |

|     |
| --- |
|  |

|     |
| --- |
|  |

## Managing Organizational Roles

To manage organizational roles, you must log in to Lifecycle as a user assigned to the Policy Administrator role, Owner role, or a custom role that has the Edit Access Control permission. By default, the built-in Admin user account is assigned to the Policy Administrator role.

### Viewing Organizational Role Assignments

To view organizational role assignments:

1. Click the Organization & Policies icon.
2. Select an entity (organization, application, or Repository) in the sidebar.
3. Click _Access_ in the menu bar at the top of the page to scroll to the Access section. Assigned roles are grouped as follows:

1. Local - Role assignments with a scope that’s specific to the selected organization or application.
2. Inherited - Role assignments derived from an organization that’s higher in the system hierarchy than the currently selected organization or application.

### Assigning Users to Organizational Roles

To assign a user to an organizational role:

1. Click the Organization & Policies icon.
2. Select an entity (organization, application, or Repositories) in the sidebar.
3. Click _Access_ in the menu bar at the top of the page to scroll to the Access section.
4. Click the _Add Role_ button. The Access editor is displayed.
5. In the _Role_ box, select a user role.
6. In the _Search Users_ box, search for a user by entering a full name or part of name with an asterisk, then click **Search**. You can use an asterisk as a wildcard at the beginning or end of a character string. For example, isa\*, \*mov, and \*asi\* will all match the name, "Isaac Asimov." Any matching names are displayed below in the Associated Users list.
7. In the _Associated Users_ list, select a user in the _Available_ column on the left, then click the right arrow button to move the user to the Associated column on the right. If you accidentally add a wrong user, select the user in the Associated column, then click the left arrow to return the user to the Available column.
8. Click _Add_.

**Note**

If you integrated an LDAP server with Lifecycle, the LDAP users and groups are also displayed in the search results. If you hover over a list item, the LDAP realm and email address are displayed when available.

**Tip**

If you want to continue adding role assignments for the selected organization, application or Repositories, click Add Role in the sidebar.

### Editing Organizational Role Assignments

To edit an organizational role assignment:

1. Click the Organization & Policies icon.
2. In the sidebar, select the entity (organization, application or Repositories) in which the role is assigned.
3. Click _Access_ in the menu bar at the top of the page to scroll to the Access section.
4. Click a listed role (or the chevron next to its name) to display the _Access_ editor.
5. In the _Search Users_ box, search for a user by entering a full name or part of name with an asterisk, then click **Search**. You can use an asterisk as a wildcard at the beginning or end of a character string. For example, isa\*, \*mov, and \*asi\* will all match the name, "Isaac Asimov." Any matching names are displayed below in the _Associated Users_ list.
6. In the _Associated Users_ list, you can add a user to a role by selecting the user in the Available column on the left and clicking the right arrow button to move the user to the Associated column. To remove a user from a role, select the user in the Associated column, then click the left arrow to return the user to the Available column.
7. Click **Update**.

**Note**

**Tip**

If you want to continue adding role assignments for the selected organization, application or Repositories, click Add Role in the sidebar.

### Removing Organizational Role Assignments

To remove organizational role assignments:

1. Click the Organization & Policies icon.
2. In the sidebar, select the entity (organization, application or Repositories) in which the role is assigned.
3. Click _Access_ in the menu bar at the top of the page to scroll to the Access section.
4. Click a listed role (or the chevron next to its name) to display the _Access_ editor.
5. Click the _Remove Role_ button, then click _Continue_ to remove the role or click _Cancel_ to keep the role.

**Note**

This is the equivalent of removing or disassociating all users from a role.

## Custom Roles

Custom roles allow you to fine-tune security permissions for different users. You must have permission to Edit Custom Roles if you want to create a custom role.

The following permissions are available for custom roles:

### Administrator Roles:

- View All Roles
- Edit Proprietary Components
- Access Audit Log

### Organizational Roles:

- Claim Components
- Edit IQ Elements
- View IQ Elements
- Edit Access Control
- Evaluate Applications
- Evaluate Individual Components
- Add Applications
- Manage Automatic Application Creation
- Manage Automatic Source Control Configuration
- Waive Policy Violations
- Change Licenses
- Change Security Vulnerabilities
- Review Legal obligations for components licenses

**Tip**

To achieve desired behavior in the user interface, you may need to assign View IQ Elements along with other permissions. For example, to allow a user to create applications in an organization but not edit the organization, you should add View IQ Elements and Add Applications to the role.

To create a custom role:

1. Click the System Preferences icon and then click _Roles_.
2. Click the _Create Role_ button.
3. Enter a name and description for the role.
4. Click the _Can/Cannot_ slider to enable or disable permissions as desired.
5. Click the _Save_ button.

**Note**

Whenever a user assigned to a custom role with Add Applications permission creates an application, that user is automatically assigned to the Owner role for that application.

## Assigning Groups to Roles without Searching

If you have an LDAP configuration that uses dynamic groups and disabled group search, then the Access editor will have an additional section called Associate Group. You can use this section to enter manually a group name and add it to a role.

To assign groups to roles without searching:

1. Click the Organization & Policies icon.
2. In the sidebar, select an entity (organization, application or Repositories).
3. Click _Access_ in the menu bar at the top of the page to scroll to the _Access_ section.
4. Open the Access editor by clicking _Add Role_ or the chevron next to an existing role.
5. In the _Associate Group_ box, enter the group name. The text must be an exact match.
6. Click _Add_. The group name is added to the _Associated_ column without performing a search of users and groups.

## Role Assignments

To view role assignments:

1. Click the Organization & Policies icon.
2. Select an organization or application in the sidebar. A page of customizable settings is displayed.
3. Click _Access_ in the menu bar at the top of the page to scroll to the Access section. Users are displayed by their assigned roles for the selected entity (i.e. organization or application). The information is grouped by where the role assignments were made: locally in the current entity or inherited from an entity higher in the system hierarchy.