Admin portal chain and store level access

Scope admin portal permissions to a chain or to individual stores.

Extension of the Admin Portal’s standard RBAC to support restricting access to the Promotion Platform and Loyalty Membership products for specific stores or chains.

To restrict store managers’ access to data relevant only to their stores, each manager must have a store ID assigned in their Azure AD user profile. Since store ID is a custom claim, we use Azure AD extension properties to define and embed it in the authorization token. This allows the Lobyco Portal App to retrieve the store ID on login and enforce store-level data access.

There are three access scenarios:

• Full Access: The admin user can view data across all chains and stores. To grant this level of access, set either chain_ids or store_ids to ’*’. If a new chain or store is added, the user automatically gains access without requiring any changes to their permissions.
• Chain manager: The admin user has access to data for a specific chain/chains.
• Store manager: The admin user has access to data for a specific store/stores.

Chain or store-level access is implemented in three steps:

1. Extension app creation

   To create new AD app navigate to ‘App registrations’ section of your Microsoft Entra ID (Active Directory) and click on ‘New registration’ link.

   

   Created AD app should be:

   • Recommended name: lobycoportal-extensions-{environment}
   • Supported account types: Accounts in this organizational directory only (Single tenant)

   Then press ‘Register’ button.

   

   There are no strict requirements for the Description field or the Expires dropdown. Select values that best suit your needs. Once the client secret is generated, make sure to save it securely, as it will be required in the following steps.

   

   Assign permissions

   Next navigate to ‘API permissions’ and create an ‘Application’ level User.ReadWrite.All MS Graph permission. It is needed for this AD app to be able to assign (write) custom claim (storeId) to users (store administrators) profiles:

   

   Modify manifest

   Next navigate to ‘Manifest’ section in your app and change acceptMappedClaims property to true and accessTokenAcceptedVersion property to 2

   

   Add extension properties

   Add chain_ids, store_ids extension properties to the created extension app.

   First get the token with permissions by navigating in Azure AD Users section and pressing Refresh link and then grabbing it from the $batch request headers.

   

   Url: POST https://graph.microsoft.com/v1.0/applications/{extension app object id}/extensionProperties

   Request headers:

   Content-Type: application/json 
   Authorization: Bearer {token received from step above}
   

   Body:

   {
    "name": "store_ids",
    "dataType": "string",
    "isMultiValued": true,
    "targetObjects": ["User"]
   }
   
2. Configure Lobyco Portal enterprise application to map custom claims

   Click on Enterprise application menu item and search for the service principal: {client_name}-lobycoportal-{environment}. Navigate to ‘Single sign-on’ tab.

   

   Press ‘Edit’ button and then ‘Add new claim’ button.

   

   Make sure both chain_ids and store_ids claims are added and saved.

3. Assign values to Azure AD users

   Go to Microsoft Entra ID -> All users . Type user email and navigate to user profile to extract User Object ID. Later it will be used get/assign user attributes via Postman.

   

   1. Copy the collection JSON from the Postman collection page and save it as a .json file.
   2. Open Postman and import the saved collection.
   3. Navigate to the collection’s Variables tab and provide values for the following variables. After entering the values, make sure to press the Save button.

   Variable name	Description
   tenant_id	Tenant ID where store managers’ user profiles are located
   extension_app_id	Client ID of the previously created extension app
   extension_app_id_without_hyphens	The same ID as above, but with hyphens removed
   extension_app_secret	Secret for the extension app
   user_object_id	Object ID of the user to whom store or chain IDs will be assigned

   4. Call imported collection endpoint in specified sequence:

      • Step 1: Get extension app token: Retrieves an access token using the extension app’s credentials, this step is a technical prerequisite for Steps 2 and 3, as the token is required to authenticate both requests.
      • Step 2: Get user attributes: Fetches the attributes of the target user to verify the user object and claim structure.
      • Step 3: Assign custom claim to the user: Sends a PATCH request to assign store_ids or chain_ids to the specified user. Important: The values used for store_ids and chain_ids must exactly match the IDs already imported into the Store Service. Example: providing access to single store with ID ‘12’
      

   Payload example to provide access to single chain with ID ‘1’:

   {
       "extension_{{extension_app_id_without_hyphens}}_chain_ids": ["1"]
   }
   

   Payload example to provide access to multiple stores:

   {
       "extension_{{extension_app_id_without_hyphens}}_store_ids": ["12", "13"]
   }
   

   If access is later required for an additional store (for example, store ID 14), all store IDs must be specified in the list, not only the new one.

   {
       "extension_{{extension_app_id_without_hyphens}}_store_ids": ["12", "13", "14"]
   }
   

   To remove access from a specific store, its ID must simply be omitted from the list while all remaining store IDs are retained.

   • Step 4: Get user attributes again: Repeat Step 2 to verify that the custom claims were successfully assigned.

     

   Important: After assigning new claims to the user, they must re-login for the changes to be reflected in the token.

   If a user logs into the Lobyco Portal but does not see any store-related data, inspect the authorization token.

   Verify that the expected claim (store_ids or chain_ids) is present and correctly populated. If the claim is missing, review the steps above to ensure it was assigned properly.