This article explains how to add Azure AD app roles to an EloView enterprise application and receive them in the token

Please see below for how to add Azure AD app roles to your EloView enterprise application and receive them in the token.

App Roles vs. Groups

Examples of custom EloView security roles

Create custom security roles in EloView

1. For help on this topic, please review the how-to guide on creating custom roles
   • https://elosupport.elotouch.com/hc/en-us/articles/31648962910487-What-are-the-Available-User-Roles-in-EloView-3-EV3 

Creating app roles

1. Sign in to the Azure portal.
2. Search for and select Azure Active Directory.
3. Under Manage, select App registrations and then select your EloView application to define app roles.

4. Select App roles, and then select Create app role.

5. In the Create app role pane, enter the settings for the role. Use the example table above to set each setting and its parameters.
   • The Display name can continue spaces and does not need to match the Value field.
   • The Value can’t contain spaces.

6. Select Apply to save your changes.

Assign users and groups to roles

1. Sign in to the Azure portal.
2. Search for and select Enterprise applications.
3. Under Manage, select All applications, and then select your EloView application to define app roles.

4. Under Manage, select Users and groups, and then select Add user/group.

5. Under Users and groups, select a user or group.
6. Under select a role, select one of the newly created app roles.

7. Click Select and then Assign.
8. Repeat steps 4-7 to add the remaining roles.

Configuring the EloView application claims

1. Sign in to the Azure portal.
2. Search for and select Enterprise applications.
3. Under Manage, select All applications, and then select your EloView application to define app roles.
4. Under Manage, select Single sign-on.
5. In the section Attributes & Claims, click Edit.

6. Click Add new claim.
7. In the Manage claim pane, enter the value for Name as “roles” and choose from the drop-down menu “user.assignedroles” value for the Source. The name is case-sensitive and should be lowercase.

Test single sign-on with your EloView application

1. In this example using the Azure AD enterprise app SAML settings test, we verify the EloView Admin user assigned to the EloView_Admins group included its role in the token as roles = EloView_Admins.

2. Next, we log into the EloView portal to verify the user has been assigned the  (SAMLUser)EloView_Admins role. If the settings were not properly configured or the instructions have changed, the user will be assigned the default (SAMLUser)Viewer role.
   • For additional assistance, please reach out to technical support.