Roles/Permissions assignment not working

I had similar issues when I started back then with a way lower version.

I created my own solution, bypassing any PSU automation.

An app page in my PRIV app that let admins define group-ids or email addresses matching roles,

and some code that needs go into the roles.ps1 for each role you have that assigns the proper roles for a user.

The roles code is here: (redacted, hopefully still readable, worked robust so far)

New-PSURole -Name "Local Common" -Policy {
    param(
        [Security.ClaimsPrincipal]$User
    )
    # policy file for roles
    # v1.5
    $localRole = "COMMON"
    #           ^^ set role here 

    $allowedFile = "allowed_$($localRole).txt"
    $syslog = @()
    $allowed = @( #dummy entries
        "mail@mail",
        "12345678-aaaa-bbbb-cccc-ffffffffffff"
    )
    $allowed += (Get-Content (Join-Path $repository $allowedFile) | ? { $_ -notmatch "^\s*#|^\s*$" }).trim()

    $mails = ($allowed | ? { $_ -match "@" }).trim()
    #                                    a6699aa7  -0XXb       -XXb8       -81XX       -31eXXXXXaae8
    $groups = $allowed | ? { $_ -match "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}" }
    $claimsGroups = ($User.Claims | ? { $_.type -match "identity/claims/groups" }).value

    $syslog += "$($user.identity.name)"

    $flag = $false
    if ($user.identity.name -in $mails) {
        $flag = $true
        $syslog += "$($flag): $($user.identity.name)"
    }

    $trueGroups = Compare-Object -ReferenceObject $groups -DifferenceObject $claimsGroups -IncludeEqual -ExcludeDifferent
    $outcome = ($trueGroups.sideindicator | Sort-Object -Unique)
    if ( $outcome -eq "==") {
        $flag = $true
        $syslog += "$($flag): $($trueGroups.inputobject -join ',')"
    }

    if ( $flag ) {
        Write-PSULog -Feature "Roles" -Resource "Local $($localRole)" -Message $($syslog -join "|")
    }
    
    # return flag, true for role granted
    $flag
} 

Hello thomaslanger,

Thank you for the detailed explanation and screenshots. I also noted the additional report in this thread describing similar behavior in an older PSU version. At this point, however, I would like to confirm whether both reports have the same underlying cause before treating them as the same issue.

The first step is to separate role assignment from the permissions applied to the script.

Could you please provide the following?

* Your exact PowerShell Universal version and build.

* Does this behavior affect every member of the AD group mapped to the `execute` role, or only certain users?

* For one affected user, can you confirm which PSU roles are effectively assigned after Windows SSO authentication?

* After changing the role assignment, does signing out completely and signing back in change the result?

As an additional test, if possible, please temporarily assign the same `execute` role directly to a test Identity in PSU rather than obtaining it through the Windows SSO group mapping. Then sign out, sign back in, and check whether the assigned script becomes visible in the Portal.

This will help us determine whether the issue is related to the AD group / role evaluation or to the Portal and script permission configuration itself.

If you can also share the relevant sanitized definitions for the broad role and the `execute` role, that would help. We do not need the complete configuration.

Because this is a public forum, please sanitize all evidence before posting. Remove credentials, tokens, license keys, cookies, private keys, full connection strings, email addresses, usernames, customer data, tenant or account identifiers, internal domains, hostnames, IP addresses, and private URLs. Please do not upload unredacted HAR files, memory dumps, database backups, or complete configuration files to this public thread.

References:

https://docs.devolutions.net/powershell-universal/security/authorization

https://docs.devolutions.net/powershell-universal/security/enterprise-security/permissions

https://docs.devolutions.net/powershell-universal/security/enterprise-security/windows-sso

Best regards,

Ruben Tapia