Admin Groups Claims Value Provider

The Admin Groups claims value provider retrieves administrative group membership information for administrators authenticated to the Curity Identity Server. This provider enables tokens to include claims about which administrative groups the authenticated administrator belongs to, allowing for role-based access control and authorization decisions.

The Admin Groups claims provider returns group membership data for administrators based on their authentication within the Curity Identity Server‘s administrative interface. This allows downstream systems to make authorization decisions based on administrative roles and permissions.

Use Cases#

The Admin Groups claims value provider enables administrative authorization and access control scenarios within the Curity Identity Server ecosystem.

Common use cases include:

  • Administrative Authorization: Include administrator group membership in tokens to enable fine-grained access control for administrative APIs and tools
  • Role-Based Access Control: Provide administrative role information to downstream systems that need to enforce permissions based on admin group membership
  • Audit and Compliance: Include group membership claims in tokens for audit trails that track which administrative groups performed specific actions
  • Multi-Tenant Administration: Differentiate administrative access across multiple tenants or organizational units based on group membership
  • Delegated Administration: Enable partial administrative capabilities by issuing tokens with specific admin group claims for delegated administrators

Getting Started#

To create an Admin Groups claims value provider, sign in to the Admin UI and navigate to Profiles → Token Service → Scopes → Claims Providers.

Claims value providers in Admin UI
Claims value providers in Admin UI. (Admin UI version: 10.6)

Select + New Claims Value Provider, give the provider a unique identifier and choose the Admin Groups type.

New Admin Groups Claims Value Provider configuration in Admin UI
New claims value provider for admin groups in Admin UI. (Admin UI version: 10.6)

The provider retrieves group membership information for the authenticated administrator when tokens are issued.

Available Attributes#

The Admin Groups claims value provider returns:

  • Administrative group names and identifiers that the authenticated administrator belongs to
  • Group membership information from the Identity Server’s administrative user store

The Admin Groups claims value provider is specifically designed for administrative tokens and requires the subject to be authenticated as an administrator within the Identity Server. It does not return group information for end users or application users.

Was this helpful?