# Roles

Roles aggregate privileges into a related context and can, in turn, be grouped to create more complex roles.

- To create and manage roles, navigate to _Settings_ → _Security_ → _Roles_.
- You must have the _nx-roles_ or _nx-all_ privilege to access the _Roles_ screen.
- To create, edit, or delete roles, you must have the _nx-privilege-read_ or _nx-all_ privilege.

Nexus Repository ships with defined admin and anonymous roles which may not be edited or deleted.

## Creating Roles

To create a new role, take the following steps:

1. Select the _Create role_ button in the _Roles_ page.
2. Select the appropriate option from the _Role Type_ drop-down menu; typically, this will be _Nexus role_ for any role you are creating manually.
3. In the _Role Setup_ form, provide a _Role ID_ and _Role Name_. Optionally, provide a description for the role.
4. In _Applied Privileges_, select the _Modify Applied Privileges_ to manage the role's applied privileges.
5. A modal appears where you can select and de-select privileges given to this role. You can also use a filter to search for privileges to apply. You can see all the selected privileges by sorting by the checkbox _Select_ column. After selecting privileges to apply to this role, select the _Confirm_ button.
6. If you wish to apply an existing role to this new role, select the _Modify Applied Roles_ button in the _Applied Roles_ section. A modal appears where you can select and de-select other roles to apply to this new role. You can also use a filter to search for other roles to apply.
7. After selecting roles to apply to this role, select the _Confirm_ button.
8. Select the _Save_ button to save the new role.

## Managing Roles

To manage an existing role, take the following steps:

1. Select the role you wish to edit from the list on the main _Roles_ page.
2. You may edit the _Role Name_ and description; however, you will not be able to modify the _Role ID_.
3. In _Applied Privileges_, select the _Modify Applied Privileges_ to manage the role's applied privileges. A modal appears where you can select and de-select privileges given to this role. You can also use a filter to search for privileges to apply.
4. After making changes to applied privileges, select the _Confirm_ button.
5. If you wish to modify which other roles are applied to this role, select the _Modify Applied Roles_ button in the _Applied Roles_ section. A modal appears where you can select and de-select other roles to apply to this new role. You can also use a filter to search for other roles to apply.
6. After selecting roles to apply to this role, select the _Confirm_ button.
7. Select the _Save_ button to save the changes you've made to this role.

## Deleting Roles

To delete a role, take the following steps:

1. Select the role you wish to delete from the list on the main _Roles_ page.
2. At the bottom of the form, select the _Delete_ button. A modal appears asking you to confirm that you wish to delete the role.
3. Select _Confirm_ to confirm deletion.

## Mapping External Groups to Nexus Repository Roles

The `Create role` button allows creating `External role mapping` to an external authorization system such as an identity provider (IdP). Use this to grant members of an externally managed group from your IdP privileges in the repository manager.

**Note**

Nexus Repository matches user groups to your IDP groups with the same name automatically.

### Prerequisites

- Configure the Nexus Repository Realms to include your IdP's realm
- Create an IdP connection with user and group configuration set
- Test the connection by selecting the `Verify connection` button on the configuration screen
To test the user and group settings, use the `Verify user mapping` button
- Search for an external user and make sure the user groups are displayed

1. In the Settings menu under Security, select Users
2. Change the source to the IdP
3. Search for a known user identifier from the IdP
4. Select the user and verify the `External Roles` are populated with the IdP's group the user belongs

**Note**

Check the user and group configuration when you do not see groups listed for the user.

#### Create an LDAP External Role Mapping

Use the following steps to create a role mapping:

1. Select `Roles` from the Settings menu under `Security`
2. Select the `Create role` button and `External Role Mapping` for your IdP
3. The `Mapped Role` drop-down is populated with groups in your IdP domain. Choose the group to map
4. Provide a name for the role
5. Assign roles and privileges
6. Select `Create` role

#### Troubleshooting

Switch on debug logging to obtain more information about the source of IdP-related problems.

1. Select `Logging` from the Settings menu under `Support`.
2. Locate the logger for your IdP under org.sonatype.nexus.<IdP> and set the logging level to `DEBUG`.

These logs contain more information about the cause of a problem. When opening support tickets, setting this logging after reproducing the problem but before generating a support zip, helps track down the issue.