Understanding Security Profile Group in Sitecore OrderCloud

Hello everyone, In this blog we will try to understand, what is Security Profile in Sitecore OrderCloud. How we can Security Profile in Sitecore OrderCloud.

Let's first understand what is Security Profile.

According to Sitecore OrderCloud definition "Security profiles are groups of roles (permissions), each of which grant users access to specific API endpoints and functionality. This lets you have permission based API calling from applications. If a request is made by a user without sufficient roles, they will receive a 403 Forbidden response"

This come very handy in Ecommerce application where you have role based functionalities. The best example is Buyer User who will having different roles(Ex.MeAddress,Shopper,MeCreditCardAdmin etc.) and Seller User(Ex. FullAccess, OrderAdmin,BuyerAdmin,CatalogAdmin etc.).There are multiple roles in Sitecore OrderCloud which we will see in different blog.

Let's create our first Security Profile in Sitecore OrderCloud

Navigate to MarketPlace Dashboard which we created in your last to last blog and click on API console.Once ApiConsole is open -->Click on SecurityProfile menu link under Authentication and Authorization section.Click on New Security Pofile button. Refer below screenshot for your reference.

Now Give the Name for your security profile and suitable ID for your security profile. Also assign roles from available roles list as shown below. Now click on create new security profile button at the bottom.You can see our new buyer security policy is created successfully.

We can do CRUD operation using Enhanced UI options also. When you click the Enhanced UI options, we get REST api calls options. Below is the screenshot for your reference.

Here you will get all API calls for CRUD operations.If you want to do any updates, you can update your security profile here using PUT PATCH calls.

Now we have to assign the Buyer security Profile to Buyer or Buyer Organization. In this way, which ever user is added to that Buyer Organization will have the define role automatically added to it.You can get the list of all security profiles create in Sitcore OrderCloud using Get Call as shown below.

Now let's assign the security profile to Buyer organization using Post Call to Security Profile Assignment.

Now let's confirm for one of the buyer user that do we have roles automatically assigned to them.

Now when we call token endpoint from application to get access token, we need to pass scope as parameter as shown below

As you have seen above we have created Buyer security profile. Similary we need to create Seller Security profile along with roles. Steps are exactly same.After creating Security profile we need to assign the profile to Seller users. Refer below screenshot.

Hope you understand the concepts. Thanks for reading and Happy Sitecoring!!!

Will be back with more blogs related to Sitecore OrderCloud. Stay Tune.