Skip to content
CCS Chat Docs

Permission sets for standalone use

Goal

Section titled “Goal”

Pick Chat permission sets for a workspace that uses Chat Standalone: people sign in at chat.centralcodestation.com and start their own conversations. The sets below are examples. Combine and trim them to fit your workspace.

Prerequisites

Section titled “Prerequisites”
Chat permission: administration.manage
  • You are the tenant owner, or an admin whose role holds administration.manage.
  • The roles you want to map exist in the Identity Server. Chat creates no roles.

Start from nothing

Section titled “Start from nothing”

Being a member of the workspace gives no Chat permissions. Every role starts with none, in every context, and tenant_admin is no exception. tenant_owner always holds everything and is shown locked. A user with only tenant_user cannot look up users, start conversations, or create groups and channels until you grant them.

A person can hold several roles. Their Chat permissions are the union of what all their roles grant.

Example sets

Section titled “Example sets”

The role names are examples. tenant_user and tenant_admin are system roles; chat_manager is a custom role you create in the Identity Server.

Role Chat permissions What people with it can do
tenant_user conversations.read, messages.read, messages.send, messages.update Read and reply in conversations they are in and in PUBLIC channels. They cannot start any.
tenant_user, everyday chat the four above, plus users.lookup, conversations.create Also find colleagues and start DIRECT conversations.
chat_manager users.lookup, conversations.create, groups.create, groups.manage, channels.create, channels.manage Create and manage groups and channels for the workspace.
tenant_admin administration.read, administration.manage, plus whatever it should do in Chat Open and change Chat Administration. Grant these in the Tenant-wide (administration) context.

Give your managers the read-and-reply set as well, by also assigning them tenant_user.

Keep the permissions separate

Section titled “Keep the permissions separate”

The permissions are separate on purpose, so you can build in-between configurations:

  • users.lookup without conversations.create: people can find each other but cannot start a conversation.
  • messages.send without conversations.create: people can reply in conversations that others start.

Do not hand out the whole directory by accident. users.lookup searches members Chat already knows. users.lookup.directory searches the whole tenant directory at the Identity Server. Grant it only to roles that need it.

Steps

Section titled “Steps”

  1. Open Administration, then Roles & permissions. See Roles and permissions for the screen.

  2. In Where, choose Chat inside your application for application permissions, or Tenant-wide (administration) for administration.*.

  3. Tick the permissions of the set, and select Save on the role.

Verify

Section titled “Verify”

Sign in as a user who holds the role and try the action: with users.lookup and conversations.create the user can search for a person and start a conversation. Without a permission, Chat answers the call with 403 missing_capability. The API lists a user’s permissions at GET /tenants/{tenant_id}/applications/{application_id}/me/capabilities.

Troubleshooting

Section titled “Troubleshooting”
Symptom Cause and fix
A user cannot find anyone The role lacks users.lookup, or the person has never been seen by Chat.
A user cannot start a conversation The role lacks conversations.create. Groups also need groups.create, channels channels.create.
A user cannot see an existing conversation The role lacks conversations.read, or they are not a member of it.
Nothing changed after saving Changes apply within about a minute. Check Where: each context is its own mapping.
Section titled “Related”