# Support SCIM Roles / Entitlements for Role-Based Authorization (Beyond Groups)

**URL:** <https://discuss.liferay.com/t/support-scim-roles-entitlements-for-role-based-authorization-beyond-groups/577>\
**Category:** Product Ideas\
**Tags:** security\
**Created:** [May 5, 2026, 1:11am UTC](https://discuss.liferay.com/t/support-scim-roles-entitlements-for-role-based-authorization-beyond-groups/577 "2026-05-05T01:11:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmaaz](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@mmaaz](https://discuss.liferay.com/u/mmaaz)\
**Post date:** [May 5, 2026, 1:11am UTC](https://discuss.liferay.com/t/support-scim-roles-entitlements-for-role-based-authorization-beyond-groups/577/1 "2026-05-05T01:11:33Z")

</div>

**Problem Statement**

Liferay’s current SCIM implementation focuses on provisioning **Users and Groups** , which works well for identity synchronization.  
However, in many IAM implementations (including ours), **authorization is not group-based**. Instead, access is driven by **application roles or entitlements**.

Because of this, teams are forced to:

- Introduce IAM-managed groups purely as a workaround for authorization, or

- Rely on custom role-mapping logic outside of SCIM

Both approaches add operational complexity and reduce alignment with modern IAM models.

**Proposed Enhancement**

Add support for **SCIM Roles and/or Entitlements** to enable **role-based authorization provisioning** in Liferay without relying on group-to-role mappings.

Ideally, this would support:

- Consuming `roles` and/or `entitlements` attributes from SCIM (per the SCIM core schema and Roles & Entitlements extension)

- Mapping SCIM roles/entitlements directly to **Liferay Roles**

- Allowing customers to configure this mapping declaratively (similar to how group mappings are handled today)

* * *

**Why This Matters**

- Many enterprises use **roles/entitlements as first-class authorization constructs**

- Reduces the need for “IAM-only” groups that don’t reflect true authorization intent

- Aligns Liferay SCIM capabilities with modern IAM platforms (Okta, Entra ID, Ping, etc.)

- Enables cleaner, more maintainable **role-based access control (RBAC)** models

- Improves interoperability with standards-based SCIM implementations

* * *

**Expected Outcome**

With this enhancement, customers could:

- Use SCIM as a single source of truth for **both identity and authorization**

- Provision Liferay access using **roles/entitlements** , not just groups

- Avoid overloading group concepts when they are not part of the IAM authorization model

* * *

**References**

- [Liferay SCIM documentation (Users & Groups)](https://learn.liferay.com/w/dxp/security-and-administration/security/system-for-cross-domain-identity-management-scim)

- [SCIM Roles and Entitlements Extension](https://www.ietf.org/archive/id/draft-ietf-scim-roles-entitlements-01.html)

---

<div class="post-metadata">

**Author:** ![turnstok](https://dub1.discourse-cdn.com/flex014/user_avatar/discuss.liferay.com/turnstok/32/18_2.png) [@turnstok](https://discuss.liferay.com/u/turnstok)\
**Post date:** [May 5, 2026, 1:12am UTC](https://discuss.liferay.com/t/support-scim-roles-entitlements-for-role-based-authorization-beyond-groups/577/2 "2026-05-05T01:12:47Z")

</div>

@mmaaz - I moved your post over here to Product Ideas as this is where our Product team checks for this sort of suggestion. Cheers!