Documentation base URLs use placeholder https://{your-tenant}.sso.id. Log in to show your tenant or custom domain.
Log in for Your Tenant URL
Chapter 5 — Fine-Grained Role-Based Access Control (RBAC)

Role Management: Menu CRUD Matrix & API Permissions

Stop hardcoding if (user.role === 'admin') across hundreds of UI components and backend controllers. In SSO.ID v2 ( /role-management), a single Role governs both Frontend Navigation Menus (view, add, update, delete) AND Backend Application API Endpoints (GET, POST, PUT, DELETE).

The RBAC Story 1. Dual-Layer RBAC Model 2. Hierarchical Menu CRUD Matrix 3. Backend API Endpoint Access 4. Role APIs & AI Prompt
Engineering Story: Customizing Permissions Without Redeploying Code

How CloudPulse Created a "Junior Billing Auditor" Role in 45 Seconds

A customer asked CloudPulse for a custom Junior Billing Auditor role that could view the Invoices and Refunds menus in the web app, create credit notes, but never delete an invoice or call DELETE /v1/invoices/{id} on the backend API.

In a traditional codebase, that request requires a frontend PR, a backend PR, QA regression testing, and a production deployment. With SSO.ID v2, CloudPulse's product manager opened /role-management, created the Junior Billing Auditor role, checked View on the Invoices menu node (PUT /api/roles/{roleId}/applications/{appId}/menu-access), and unchecked DELETE /v1/invoices/{id} in the API Permissions tab (PUT /api/roles/{roleId}/applications/{appId}/api-access). Both the Angular UI and .NET API enforced the new rule immediately.

1. The SSO.ID v2 Dual-Layer RBAC Architecture

Layer 1: UI Menu CRUD Permissions (menu-access)

Controls what the user sees and clicks in the frontend application. Every hierarchical page defined in App Pages (/api/applications/{id}/menus) exposes four boolean permission flags per Role: canView, canAdd, canUpdate, and canDelete.

Layer 2: Backend API Route Permissions (api-access)

Controls what the user's JWT can execute on the server. Every backend API endpoint registered under /api/applications/{id}/apis can be toggled ON or OFF per Role (PUT /api/roles/{roleId}/applications/{appId}/api-access).

Flow Diagram Dual-Layer RBAC Enforcement Flow
flowchart LR ROLE["Role Definition (POST /api/roles)"] --> L1["Layer 1: Menu CRUD (View, Add, Update, Delete)"] ROLE --> L2["Layer 2: API Endpoints (GET, POST, PUT, DELETE)"] L1 --> JWT["Signed JWT Claims (menus: [...], roles: [...])"] L2 --> JWT JWT --> FE["SPA Frontend: Dynamic Menu Tree"] JWT --> BE["API Gateway: Endpoint Authorization"]
Roles define frontend Menu CRUD bitmasks and backend API endpoints, delivering both UI navigation and API permission claims in signed JWTs.
https://cloudpulse.us.beta.sso.id/role-management Click to zoom
Role Management console at /role-management for configuring application RBAC roles and CRUD matrices.
Role Management console at /role-management for configuring application RBAC roles and CRUD matrices.

3. Configuring Backend API Access & Assigning Users

  • API Permissions Tab (GET / PUT /api/roles/{roleId}/applications/{appId}/api-access): View all registered backend endpoints for the selected Application (with HTTP method badges GET, POST, PUT, DELETE) and toggle which APIs this Role is authorized to call.
  • Assigned Users Tab (GET / POST / DELETE /api/roles/{roleId}/applications/{appId}/users): Search directory users and assign or remove them from this Role within the selected Application context.

4. Role Management REST API Reference

Method Endpoint Description
GET / POST https://{your-tenant}.sso.id/api/roles Lists all roles in the tenant or creates a new role (PUT / DELETE /api/roles/{id}).
GET https://{your-tenant}.sso.id/api/roles/applications/{applicationId} Lists all roles associated with a specific Application.
GET / PUT https://{your-tenant}.sso.id/api/roles/{roleId}/applications/{appId}/menu-access Gets or updates the hierarchical App Menu CRUD permission matrix (view, add, update, delete) for a Role.
GET / PUT https://{your-tenant}.sso.id/api/roles/{roleId}/applications/{appId}/api-access Gets or updates the allowed backend Application API endpoints for a Role.
GET / POST / DELETE https://{your-tenant}.sso.id/api/roles/{roleId}/applications/{appId}/users Lists, assigns, or removes (DELETE .../users/{userId}) users for a Role in an Application.
AI Agent Prompt Implement Dynamic Frontend Menu Guards & Backend API RBAC Enforcement 
You are a full-stack security architect. Implement **Dynamic Menu CRUD Guards (Frontend) and API Route Authorization (Backend)** powered by **SSO.ID v2 Role Management** (`https://{your-tenant}.sso.id/api/roles`).

### 1. Frontend Dynamic Sidebar & Action Button Directive
- Fetch the user's assigned roles and menu permissions from `/api/roles/{roleId}/applications/{appId}/menu-access`.
- Build a navigation sidebar that renders only menu nodes where `canView === true` (preserving parent-child hierarchy).
- Create a reusable UI permission directive/component `` that conditionally hides or disables Create, Edit, and Delete buttons.

### 2. Backend API Route Authorization Middleware
- Validate the incoming Bearer JWT against `https://{your-tenant}.sso.id/auth/.well-known/jwks.json?appId={appId}`.
- Extract the user's `roles` claim and verify against cached `/api/roles/{roleId}/applications/{appId}/api-access` rules that the user's role is permitted to invoke the current HTTP method and route path.