> For the complete documentation index, see [llms.txt](https://ztrust.gitbook.io/ztrust-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ztrust.gitbook.io/ztrust-documentation/user-manual-ztrust-v4.2/4.-admin-manual/4.23-role-specific-attribute-based-access-control-at-client-level.md). # 4.23 Role-Specific Attribute Based Access Control at client level 1. ## Use Case At the role level we have attributes, these role attributes are used to render the few functions in the target applications. 2. Prerequisites * The roles need to be at the client level for requesting the role at registration time. * The role need to have at least one sub role (i.e composite role) * If role attributes are creating, mapper need to create for that attribute, to those attributes in the token * Based upon the role attributes and role, target application need to render * SMTP email configuration need to be configured 3. Configuration 1. Create a client at realm, for example here iventura-chart client is created 2. Client iventura-chart is having few role like below

Fig 4.22.a: Client roles

3. Along with those roles, admin role need to be created. For that role create an attribute adminEmail . If registration is happening at this client level, the configured admin email will get notified.

Fig 4.22.b: Admin Role attribute

4. Then select the roles and create attributes for that role like below. Here attributes are added for the DATA\_ADMIN role.

Fig 4.22.c: Data admin role attributes

5. Create a mapper to add the attributes in the token. For that go for client (iventura-chart) and client scopes -> iventura-chart-dedicated.

Fig 4.22.d: Navigating to Client scopes under client

6. Then click on configure an new mapper as shown below

Fig 4.22.e: Configure a new mapper

7. One model will appear, then select client role attribute from those

Fig 4.22.f: Select mapper to configure

8. Fill ip the fields like below, here Token Claim Name need to configure exactly like here how configured\ ${client\_id}.${role\_name}.attributes.${attribute\_name}

Fig 4.22.g: Mapper configuration

9. How many attributes are there that many mappers need to create like below

Fig 4.22.h: List of custom attributes

10. At last go to the authentication section, then to required actions tab, switch on the client role request like below.

Fig 4.22.i: Navigate to Authentication section in side bar, and required actions