# Non-Production Roles

[TOC]

## 📋 Summary

!!! note "External (Okta) Users Only"
    This guide applies to **External authentication (Okta)** role assignment for non-production testing. For Corporate (Entra ID) role assignment, Business Roles are managed via Entra ID security groups — see [Business Roles](../configuration/business-roles.md).

For external-facing applications, user authorization is managed through Okta groups created specifically for securing resources within the application. These groups are assigned to users via an Okta group rule that associates a user's Active Directory business role with the individual application Okta groups.

The AD business roles are the roles defined in the OU `[Domain]\ApplicationSecurity\ApplicationRoles`. These include Divisions and Titles.

For non-production testing purposes, there is an automated Azure DevOps pipeline that maintains a copy of each of these AD business roles in Okta with the suffix **-np-user-role**.

**Example:** AD → `Agency Marketing Technician` = Okta → `agency marketing technician-np-user-role`

For development and testing purposes, it is necessary to place yourself in the business roles specific to your use case. The **it-nporles-shasca-test** pipeline within this repository will add/remove you from these roles.

## 🚀 Instructions

To maintain the list of roles you are currently in:

1. Open `[Repo]/infra/my-roles.yml`
2. Make sure the **Username:** attribute is your mailid
3. Using YAML array syntax, create a list of the business roles you wish to be in for testing
4. Save the file
5. Run the **[projectid]-np-roles pipeline**

## 📝 Example Configuration

Sample `my-roles.yml` file:

```yaml
Username: shasca
Roles:
  - Agency Marketing Specialist
  - Bill Entry Specialist
```