Assign One Identity manager Application Role to a Business Role

Question

Hi All, 
 
 I couldn't find a similar question on the forum or OID documentation. 
 I've created a permission group in the designer and assigned it to a Custom/new One Identity Manager Application Role. 
 Next step I would like to assign the One Identity manager application role (AERole) to a Business Role (ORG) which is not possible in the manager. 
 Also tried to assign to a system role, failed. 
 Any advice? 
 Thanks

Markus Weiss-Ehlers · Answer

You cannot assign business roles (Org) to an application role (AERole): But you can create a dynamic role for the application role that assigns any person assigned to the business role to the application role.

Markus Weiss-Ehlers · Answer

Your assumption is correct. You cannot assign an application role to a business role. 
 But what you can do is the following. 
 1. Create a dynamic group for the AERole that is based on some extended attribute assigned to the Business Role (ObjectHasExtendedAttribute). The extended attribute needs to be created first of course (Table ExtendedAttribute). 
 2. The customer team user then uses the task "Assign extended attribute" to assign the attribute to the business role. The dynamic role will then put all members of the business role into the application role.