This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.

Users and Roles

Owned by Former user (Deleted)
Last updated: Sept 03, 2012Version comment
2 min read

WSO2 Identity Server allows the managing of users and their roles. A user is associated with one or more roles (generally specified upon user creation), and each role is associated with zero or more permissions (also generally specified upon user creation). Therefore, the set of permissions owned by a user is determined by the roles assigned to that user. If a user has several assigned roles, their permissions are added together.

By default, Identity Server comes with the following roles:

  • Admin - Provides full access to all features and controls in the ESB. By default, the user "admin" is assigned to both the "Admin" and the "Everyone" roles.
  • Everyone - Every new user is assigned to this role by default. It does not include any permissions.
  • System - This role is not visible in the Management Console.

Note

The Identity Server UI does not allow the configuring of permissions assigned to the "Admin" role.

The permission model of WSO2 Identity Server is hierarchical. Permissions can be assigned to a role in a fine-grained or a coarse-grained manner.

"Read/Write" and "Read Only" Modes

The User Management of the WSO2 Carbon allows you to facilitate user accounts and roles at different levels.

The User Store of Carbon products can be configured to operate in one of the following modes, which determine the functionality.

Modes of operation:

  • Read/write - This mode allows the user to modify the User Store.
  • Read only - This mode prevents the user from changing any data in the User Store.

If the User Store is operating in "Read/Write" mode, the user can:

  • Add, modify, or remove user accounts
  • Reset user passwords
  • Manage user roles
  • Build "import users" from other User Stores

If the User Store is operating in "Read Only" mode, the user can:

  • View user accounts

Note

WSO2 Carbon maintains roles and permissions in the Carbon database, but it can also read users/roles from the configured User Store.

For the detailed information on configuring users, roles, and permissions, see the following pages:

  • Adding a New User — Instructions on how to add new users and assign roles to them.
  • Changing a User's Current Password — Instructions on how to change a user's current password in the WSO2 Identity Server.
  • Managing User Profiles — Instructions on how to manage a user's profile in the WSO2 Identity Server.
  • Deleting Users — Instructions on how to delete a user from the WSO2 Identity Server Management Console.
  • Creating User Roles — Instructions on how to create and add a new user role in the WSO2 Identity Server.
  • Editing User Roles — Instructions on how to rename a role, change role permissions, and assign new users to a role in the WSO2 Identity Server.
  • Defining User Roles — Instructions on how to define roles for a user in the WSO2 Identity Server.
  • Deleting Roles — Instructions on how to delete roles from the WSO2 Identity Server Management Console.