Identity Provider Role Assignment
How Identity Provider Role Assignment works in Paycux, what it is for, and the smallest setup that gets it running.
Introduction
Identity Provider Role Assignment is part of the Paycux platform. This page explains what it does, when to reach for it, and the smallest working setup you can ship.
Everything below applies to both environments. Build and test in staging, then promote the same configuration to production without changing your code — only the API key and client ID differ.
Directory group role assignment
Assign the users and groups who should have access. Anyone outside the assignment is rejected at the provider, before the request reaches Paycux.
Group names sync as-is. If you use groups to drive roles in your application, map them once in the dashboard under Authorization rather than branching on group names in code.
Sample scenario
Sample scenario is handled by Identity Provider Role Assignment rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Multiple roles
Roles are defined once per project and assigned per organization membership, so the same person can be an admin in one organization and a viewer in another.
Check permissions on the server, in the request path, using the permission slug rather than the role name. Role names change; slugs are stable.
Role assignment in Admin Portal
Role assignment in Admin Portal applies specifically to Identity Provider Role Assignment. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.
If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.
Other forms of role assignment
Other forms of role assignment applies specifically to Identity Provider Role Assignment. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.
If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.
SSO group role assignment
SSO group role assignment applies specifically to Identity Provider Role Assignment. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.
If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.
Attribute-based role
Paycux normalizes incoming attributes into a fixed profile shape, so your application reads the same fields no matter which provider the user came from.
| Paycux field | Typical source |
|---|---|
| NameID, email, or mail | |
| first_name | givenName or first_name |
| last_name | surname, sn, or last_name |
| idp_id | The provider's stable user identifier |
Anything the provider sends beyond these fields is kept verbatim under raw_attributes, so you can map custom claims without waiting on us.