> For the complete documentation index, see [llms.txt](https://ztrust.gitbook.io/ztrust-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ztrust.gitbook.io/ztrust-documentation/user-manual-ztrust-v4.1/4.-admin-manual/4.23-role-specific-attribute-based-access-control-at-client-level.md). # 4.23 Role-Specific Attribute Based Access Control at client level 1. ## Use Case At the role level we have attributes, these role attributes are used to render the few functions in the target applications. 2. Prerequisites * The roles need to be at the client level for requesting the role at registration time. * The role need to have at least one sub role (i.e composite role) * If role attributes are creating, mapper need to create for that attribute, to those attributes in the token * Based upon the role attributes and role, target application need to render * SMTP email configuration need to be configured 3. Configuration 1. Create a client at realm, for example here iventura-chart client is created 2. Client iventura-chart is having few role like below

Fig 4.22.a: Client roles

3. Along with those roles, admin role need to be created. For that role create an attribute adminEmail . If registration is happening at this client level, the configured admin email will get notified.

Fig 4.22.b: Admin Role attribute

4. Then select the roles and create attributes for that role like below. Here attributes are added for the DATA\_ADMIN role.

Fig 4.22.c: Data admin role attributes

5. Create a mapper to add the attributes in the token. For that go for client (iventura-chart) and client scopes -> iventura-chart-dedicated.

Fig 4.22.d: Navigating to Client scopes under client

6. Then click on configure an new mapper as shown below

Fig 4.22.e: Configure a new mapper

7. One model will appear, then select client role attribute from those

Fig 4.22.f: Select mapper to configure

8. Fill ip the fields like below, here Token Claim Name need to configure exactly like here how configured\ ${client\_id}.${role\_name}.attributes.${attribute\_name}

Fig 4.22.g: Mapper configuration

9. How many attributes are there that many mappers need to create like below

Fig 4.22.h: List of custom attributes

10. At last go to the authentication section, then to required actions tab, switch on the client role request like below.

Fig 4.22.i: Navigate to Authentication section in side bar, and required actions

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ztrust.gitbook.io/ztrust-documentation/user-manual-ztrust-v4.1/4.-admin-manual/4.23-role-specific-attribute-based-access-control-at-client-level.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.