A lot of identity management implementations use roles in addition to groups. How are they different? So far I haven't found a compelling use case for separating the two. All the explanations I've read are vague and hand-wavey.
Can you give a good example where having roles and groups are necessary?
The tendency that we do as application implementation with groups is focusing on the association between groups and the user rather than the actual group. I have seen several implementation (and am guilty of doing so myself early on), that just check the name of the group.
This is obviously a bit problematic, because each application will define its own permissions, resulting in elevating permissions in systems and inconsistency in permissions.
The role has explicit association with role and those will change at a central location. This become more consistent and can be managed by an admin for all applications.
Conceptually the idea of groups and roles can be interchangeable but in implementation this can get difficult to manage
Here are some more info here:
While Designing SAAS , Role, User type is often seen as coinciding with each other.
User - Who works in an organisation [ some cases need not] uses /logs in an applicaiton for some purpose
User if he works in an organisation will have [ Designation - Purely for the Payrol /Hierarchy of leadership perspective] For Designation, he might work in a department, where he plays a role
This is the real world
From an Application Perspective [ Designation - can be treated as Type or Appropriately as per the needs of the applicaiton -user] How do you want him to be seen inside the application for reporting, or addressing him in the UI. can be user type
Role - What all functionalities he needs access or to be seen can be grouped as logical role - this need not match with organisation role always [ However if you can arrive one 2 one ,then nothing like that]
This grouping of services into logical role is purely for Access Perspective.
admin-user
editor
post-approval -financier
auditor
Dont confuse the ROle of RBAC with User Play in an Organisation [ however it can be kept but practically it doesnt happen that way ]
[![enter image description here][2]][2]
