What's the difference between groups and roles?

Question

A lot of identity management implementations use roles in addition to groups. How are they different? So far I haven't found a compelling use case for separating the two. All the explanations I've read are vague and hand-wavey.

Can you give a good example where having roles and groups are necessary?

Answer 1

Roles are groups of rights

Groups are groups of people

Imagine you have 2 groups of people (G1, G2) using an application (A1) for which you have two types of users: administrators and read only users.

You can create a role of admin on A1, define its rights and give G1 this role If G2 also needs these rights, you don't have to grant them one by one, you can simply give G2 the same role you created for G1

Answer 2

Person - Group - Roles

• A person is a member of one or more groups.
• A group is assigned multiple roles.

Example:

• Two roles exist in a system stock_purchaser, timecard_supervisor.
• Two groups exist in a system shift_supervisor, regional_manager.
• regional_manager has the stock_purchaser and timecard_supervisor role.
• shift_supervisor has the timecard_supervisor role.

In the event a new role (e.g. review_leave_requests) is created - this can be added to all those groups who require this role. In a system only having roles it may be a laborious task adding the role to all people that require it.