# Changes in Role Management based on Client IDs

## Partner Management Services

In previous versions (1.1.5.x) of our system, we utilized the `mosip-partner-client` for Partner Management Services (PMS). However, starting from version 1.2.0.1 onwards, we have implemented the use of `mosip-pms-client` instead. This transition has led to updates in service account roles, client scopes, and client configurations.

Please find below the details of the changes made to service account roles and client scopes.

#### **Service account roles for Partner-Management-Services**

<table><thead><tr><th width="273">mosip-partner-client (1.1.5.x)</th><th>mosip-pms-client (1.2.0.1)</th></tr></thead><tbody><tr><td>offline access</td><td>CREATE_SHARE</td></tr><tr><td>REGISTRATION_PROCESSOR</td><td>default_roles_mosip</td></tr><tr><td>uma_authorization</td><td>DEVICE_PROVIDER</td></tr><tr><td></td><td>PARTNER</td></tr><tr><td></td><td>PARTNER_ADMIN</td></tr><tr><td></td><td>PMS_ADMIN</td></tr><tr><td></td><td>PMS_USER</td></tr><tr><td></td><td>PUBLISH_APIKEY_APPROVED_GENERAL</td></tr><tr><td></td><td>PUBLISH_APIKEY_UPDATED _GENERAL</td></tr><tr><td></td><td>PUBLISH_CA_CERTIFICATE_UPLOADED_GENERAL</td></tr><tr><td></td><td>PUBLISH_MISP_LICENSE_GENERATED_GENERAL</td></tr><tr><td></td><td>PUBLISH_MISP_LICENSE_UPDATED_GENERAL</td></tr><tr><td></td><td>PUBLISH_OIDC_CLIENT_CREATED_GENERAL</td></tr><tr><td></td><td>PUBLISH_OIDC_CLIENT_UPDATED _GENERAL</td></tr><tr><td></td><td>PUBLISH_PARTNER _UPDATED _GENERAL</td></tr><tr><td></td><td>PUBLISH_POLICY_UPDATED _GENERAL</td></tr><tr><td></td><td>REGISTRATION_PROCESSOR</td></tr><tr><td></td><td>SUBSCRIBE_CA_CERTIFICATE_UPLOADED_GENERAL</td></tr><tr><td></td><td>ZONAL_ADMIN</td></tr></tbody></table>

#### **Client Scopes for Partner-Management-Services:**

| mosip-partner-client (1.1.5.x) | mosip-pms-client (1.2.0.1) |
| ------------------------------ | -------------------------- |
| email                          | add\_oidc\_client          |
| profile                        | email                      |
| roles                          | get\_certificate           |
| web-origins                    | profile                    |
|                                | roles                      |
|                                | send\_binding\_otp         |
|                                | update\_oidc\_client       |
|                                | uploaded\_certificate      |
|                                | wallet\_binding            |
|                                | web\_origins               |

### **Admin-Services**

In version 1.1.5.x, the `mosip-admin-client` was utilized for administrative services. We are also continuing to utilize the same client in version 1.2.0.1. While there have been modifications to the service account roles, the Client scopes have remained unchanged. Please find below the updated service account role adjustments. Additionally, it is worth noting that **MOSIP Commons** is also utilizing this client.

**Service account roles for Admin-Services:**

<table><thead><tr><th width="255">mosip-admin-client (1.1.5.x)</th><th>mosip-admin-client (1.2.0.1)</th></tr></thead><tbody><tr><td>MASTERDATA_ADMIN</td><td>Default-roles-mosip</td></tr><tr><td>offline_access</td><td>ZONAL_ADMIN</td></tr><tr><td>uma_authorization</td><td>offline-access</td></tr><tr><td></td><td>PUBLISH_MASTERDATA_IDAUTHENTICATION_TEMPLATES_GENERAL</td></tr><tr><td></td><td>PUBLISH_MASTERDATA_TITLES_GENERAL</td></tr><tr><td></td><td>PUBLISH_MOSIP_HOTLIST_GENERAL</td></tr><tr><td></td><td>uma_authorization</td></tr></tbody></table>

**Client scopes are the same for mosip-admin-client in 1.2.0.1 & 1.1.5.1**

* email
* profile
* roles
* web-origins

### **Pre-registration**

In version 1.1.5.x, we utilized the 'mosip-prereg-client' for Pre-Registration. This client is also utilized in version 1.2.0.1. There have been modifications in the service account roles, while the client scopes have remained unchanged. Please find below the updated service account roles.

**Service account roles for Pre-Registration:**

| mosip-prereg-client in 1.1.5.x                                                                                                                                  | mosip-prereg-client in 1.2.0.1                                                                                          |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| <ul><li>INDIVIDUAL</li><li>offline\_access</li><li>PRE\_REGISTRATION\_ADMIN</li><li>PREREG</li><li>REGISTRATION\_PROCESSOR</li><li>uma\_authorization</li></ul> | <ul><li>default\_roles\_mosip</li><li>PRE\_REGISTRATION\_ADMIN</li><li>PREREG</li><li>REGISTRATION\_PROCESSOR</li></ul> |

**Note**: Prior to proceeding with the upgrade, please ensure that the `INDIVIDUAL` role has been removed.

**Client scopes are the same for mosip-prereg-client in 1.2.0.1 & 1.1.5.1**

* email
* profile
* roles
* web-origins

### ID Authentication

In the previous version 1.1.5.x, the `mosip-ida-client` module was responsible for handling ID authentication. However, starting from version 1.2.0.1, we have switched to using `mpartner-default-auth` for this purpose. This transition has brought about several changes, including modifications to service account roles, client scopes, and client configurations. Below is an overview of the changes in service account roles and client scopes.

**Service account roles for id-authentication:**

<table><thead><tr><th width="269">mosip-ida-client in (1.1.5.x)</th><th>mpartner-default-auth (1.2.0.1)</th></tr></thead><tbody><tr><td><ul><li>AUTH</li><li>AUTH_PARTNER</li><li>ID_AUTHENTICATION</li><li>offline_access</li><li>uma_authorization</li></ul></td><td><ul><li>CREDENTIAL_REQUEST</li><li>default_roles_mosip</li><li>ID_AUTHENTICATION</li><li>offline_access</li><li>PUBLISH_ANONYMOUS_PROFILE_GENERAL</li><li>PUBLISH_AUTH_TYPE_STATUS_UPDATE_ACK_GENERAL</li><li>PUBLISH_AUTHENTICATION_TRANSACTION_STATUS_GENERAL</li><li>PUBLISH_CREDENTIAL_STATUS_UPDATE_GENERAL</li><li>PUBLISH_IDA_FRAUD_ANALYTICS_GENERAL</li><li>SUBSCRIBE_ACTIVATE_ID_INDIVIDUAL</li><li>SUBSCRIBE_APIKEY _APPROVED_GENERAL</li><li>SUBSCRIBE_APIKEY _UPDATED _GENERAL</li><li>SUBSCRIBE_AUTH_TYPE_STATUS_UPDATE_ACK_GENERAL</li><li>SUBSCRIBE_AUTH_TYPE_STATUS_UPDATE_INDIVIDUAL</li><li>SUBSCRIBE_CA_CERTIFICATE_UPLOADED_GENERAL</li><li>SUBSCRIBE_CREDENTIAL_ISSUED_INDIVIDUAL</li><li>SUBSCRIBE_DEACTIVATE_ID_INDIVIDUAL</li><li>SUBSCRIBE_MASTERDATA_IDAUTHENTICATION_TEMPLATES_GENERAL</li><li>SUBSCRIBE_MASTERDATA_TITLES_GENERAL</li><li>SUBSCRIBE_MISP_LICENSE_GENERATED_GENERAL</li><li>SUBSCRIBE_MISP_LICENSE_UPDATED_GENERAL</li><li>SUBSCRIBE_MOSIP_HOTLIST_GENERAL</li><li>SUBSCRIBE_OIDC_CLIENT_CREATED_GENERAL</li><li>SUBSCRIBE_OIDC_CLIENT_UPDATED_GENERAL</li><li>SUBSCRIBE_PARTNER_UPDATED_GENERAL</li><li>SUBSCRIBE_POLICY _UPDATED_GENERAL</li><li>SUBSCRIBE_REMOVE _ID_INDIVIDUAL</li><li>uma_authorization</li></ul></td></tr></tbody></table>

**Client Scopes for id-authentication:**

| mosip-ida-client (1.1.5.x)                                                | mpartner-default-auth (1.2.0.1)                                                                                                  |
| ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| <ul><li>email</li><li>profile</li><li>roles</li><li>web-origins</li></ul> | <ul><li>add\_oidc\_client</li><li>email</li><li>profile</li><li>roles</li><li>update\_oidc\_client</li><li>web-origins</li></ul> |

### Digital-card-service

In the previous version, 1.1.5.x, we did not employ any clients for our digital card service. However, in the latest version, 1.2.0.1, we have implemented the use of the `mpartner-default-digitalcard` client. Please find below the service account roles and client scopes associated with the `mpartner-default-digitalcard` client.

**Service account roles assigned to \_mpartner-default-digitalcard**\_\*\* in 1.2.0.1\*\*

* CREATE\_SHARE
* CREDENTIAL\_REQUEST
* default\_roles\_mosip
* PRINT\_PARTNER
* PUBLISH\_CREDENTIAL\_STATUS\_UPDATE\_GENERAL
* SUBSCRIBE\_ CREDENTIAL\_ISSUED\_INDIVIDUAL
* SUBSCRIBE\_IDENTITY\_CREATED\_GENERAL
* SUBSCRIBE\_IDENTITY\_UPDATED \_GENERAL

**Client scopes assigned to \_mpartner-default-digitalcard**\_\*\* in 1.2.0.1\*\*

* email
* profile
* roles
* web-origins

### Print

In version 1.1.5.x, we do not employ any clients for printing. However, beginning from version 1.2.0.1, we utilize the `mpartner-default-prin`t client. Please find below the service account roles and client scopes associated with the `mpartner-default-print` client.

**Service account roles assigned to \_mpartner-default-print**\_\*\* in 1.2.0.1\*\*

* CREATE\_SHARE
* default\_roles\_mosip
* PUBLISH\_CREDENTIAL\_STATUS\_UPDTAE\_GENERAL
* SUBSCRIBE\_ CREDENTIAL\_ISSUED\_INDIVIDUAL

**Client scopes assigned to \_mpartner-default-print**\_\*\* in 1.2.0.1\*\*

* email
* profile
* roles
* web-origins

### ID Repository

In version 1.1.5.x, we utilized the `mosip-regproc-client` for id-repository. Starting from version 1.2.0.1, we have transitioned to using `mosip-idrepo-client`. This switch has led to modifications in service account roles, client scopes, and client settings. Below are the details of the changes in service account roles and client scopes.

**Client Scopes for id-repository:**

<table><thead><tr><th width="282">mosip-regproc-client (1.1.5.x)</th><th>mosip-idrepo-client (1.2.0.1)</th></tr></thead><tbody><tr><td><ul><li>email</li><li>profile</li><li>roles</li><li>web-origins</li></ul></td><td><ul><li>email</li><li>profile</li><li>roles</li><li>web-origins</li></ul></td></tr></tbody></table>

**Service account roles for id-repository:**

| mosip-regproc-client (1.1.5.x)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | mosip-idrepo-client (1.2.0.1)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <ul><li>ABIS\_PARTNER</li><li>CENTRAL\_ADMIN</li><li>CENTRAL\_APPROVER</li><li>CREDENTIAL\_INSURANCE</li><li>CREDETIAL\_PARTNER</li><li>Default</li><li>DEVICE\_PROVIDER</li><li>DIGITAL\_CARD</li><li>FTM\_PROVIDER</li><li>GLOBAL\_ADMIN</li><li>INDIVIDUAL</li><li>KEY\_MAKER</li><li>MASTERDATA\_ADMIN</li><li>MISP</li><li>MISP\_PARTNER</li><li>ONLINE\_VERIFICATION\_PARTNER</li><li>POLICYMANAGER</li><li>PRE\_REGISTRATION</li><li>PRE\_REGISTRATION\_ADMIN</li><li>PREREG</li><li>REGISTRATION\_ADMIN</li><li>REGISTRATION\_OFFICER</li><li>REGISTRATION\_OPERATOR</li><li>REGISTRATION\_SUPERVISOR</li><li>ZONAL\_ADMIN</li><li>ZONAL\_APPROVER</li></ul> | <ul><li>default\_roles\_mosip</li><li>ID\_REPOSITORY</li><li>offline\_access</li><li>PUBLISH\_ACTIVATE\_ID\_ALL\_INDIVIDUAL</li><li>PUBLISH\_AUTH\_TYPE\_STATUS\_UPDATE\_ALL\_INDIVIDUAL</li><li>PUBLISH\_AUTHENTICATION\_TRANSACTION\_STATUS\_GENERAL</li><li>PUBLISH\_DEACTIVATE\_ID\_ALL\_INDIVIDUAL</li><li>PUBLISH\_IDENTITY\_CREATED\_GENERAL</li><li>PUBLISH\_IDENTITY\_UPDATED \_GENERAL</li><li>PUBLISH\_REMOVE \_ID\_ALL\_INDIVIDUAL</li><li>PUBLISH\_VID\_CRED\_STATUS\_UPDATE\_GENERAL</li><li>SUBSCRIBE\_VID\_CRED\_STATUS\_UPDATE\_GENERAL</li><li>uma\_authorization</li></ul> |

### Resident Services

In version 1.1.5.x, we utilized the `mosip-resident-client` for Resident Services. This client is also employed in version 1.2.0.1. Although there were modifications in service account roles, the client scopes remain unchanged. Below the details of the alterations made in service account roles.

**Service account roles for Resident-Services:**

| mosip-resident-client (1.1.5.x)                                                                                                        | mosip-resident-client (1.2.0.1)                                                                                                                                                                                                                                                                                            |
| -------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <ul><li>CREDENTIAL\_ISSUANCE</li><li>CREDENTIAL\_REQUEST</li><li>offline\_access</li><li>RESIDENT</li><li>uma\_authorization</li></ul> | <ul><li>CREDENTIAL\_REQUEST</li><li>default\_roles\_mosip</li><li>offline\_access</li><li>RESIDENT</li><li>SUBSCRIBE\_AUTH\_TYPE\_STATUS\_UPDATE\_ACK\_GENERAL</li><li>SUBSCRIBE\_AUTHENTICATION\_TRANSACTION\_STATUS\_GENERAL</li><li>SUBSCRIBE\_CREDENTIAL\_STATUS\_UPDATE\_GENERAL</li><li>uma\_authorization</li></ul> |

**Client Scopes for Resident-Services:**

| mosip-resident -client (1.1.5.x)                                          | mosip- resident -client (1.2.0.1)                                                                                   |
| ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| <ul><li>email</li><li>profile</li><li>roles</li><li>web-origins</li></ul> | <ul><li>email</li><li>ida\_token</li><li>individual\_id</li><li>profile</li><li>roles</li><li>web-origins</li></ul> |

### **Compliance-Tool-Kit**

In previous iterations (1.1.5.x) of our system, we did not employ any clients for the compliance toolkit. However, beginning with version 1.2.0.1, we have implemented the use of `mosip_toolkit_clien`t. The following information outlines the service account roles and client scopes associated with `mosip_toolkit_client`.

**Service account roles assigned to \_mosip\_toolkit\_client**\_\*\* in 1.2.0.1\*\*

* default\_roles\_mosip

**Client scopes assigned to \_mosip\_toolkit\_client**\_\*\* in 1.2.0.1\*\*

* email
* profile
* roles
* web-origins


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.mosip.io/1.2.0/setup/upgrade/upgrade-runbook/mock-services/upgrade-changes-in-role-management.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.