Issue: User Management Widget only showing 1 role ...
# ask-a-descoper
b
Issue: User Management Widget only showing 1 role in dropdown Project ID: `P39pfeabudEFahtlpE1r7JfNKqBD`*Tenant ID:*
05f5000c-0fbf-4fed-b94f-da229833d7a6
*Description:*Multiple tenant-level roles have been created under Authorization, but the User Management Widget role dropdown is only displaying 1 role instead of all available roles. What's been checked: ✅ Roles are tenant-level (not project-level) ✅ Roles are not hidden ✅ No console errors observed • ✅ Correct Tenant ID is being passed to the widget Expected behavior: All tenant-level roles should appear in the widget's role dropdown. Actual behavior: Only 1 role is visible in the dropdown. Could someone help investigate if this is a bug with the User Management Widget? 🙏
✅ 1
d
Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. Issue Overview: This is a known behavior, not a bug. The most likely cause of the issue is the Hidden Role setting. Hidden Roles Are Not Visible in Admin Widgets: When a role is marked as a hidden role, Tenant Admins will not be able to view it in Admin Widgets (including the User Management Widget). This applies to both the role dropdown and any attribute mapping views. Steps to Check Hidden Roles: 1. Go to the Authorization page in the Descope Console. 2. Navigate to the RBAC tab. 3. Review each tenant-level role and check if any are flagged as hidden. 4. If a role is hidden, edit it and uncheck the hidden option to make it visible in the widget. Other Things to Verify: • Confirm the roles are created as tenant-level roles under the correct tenant's Authorization tab — not just as project-level roles. Tenant-level roles are defined by navigating to the specific tenant in the Tenants page → Authorization tab. • Ensure the user accessing the widget has the
Tenant Admin
role assigned, as this is required to use Admin Widgets at all. • Project-level roles are not editable by tenant-level users in the widget, which could affect what's displayed or interactable in the dropdown. For More Information: • Admin Widgets | Descope Documentation • Role-Based Access Control | Descope Documentation
b
Roles are not hidden, version: "user-management-widget": "0.11.12",
d
The roles that shown are according to the user permissions, if the user is missing one of the other roles permissions it won't be shown.
Please share the roles names, ids and permissions. And also share the user roles names, ids and permissions.
b
logged in user is admin-all permissions, role which is not shown is developer having subset of permissions
d
please share the admin user id
I just checked and what you said is not true. Role developer has 3 permissions:
PERM39pfej0KzXewOrqjRFIDLjDkDiW
PERM39pfelnhJCiHCJ17nEx5UDm6OKv
PERM39pfelVni9vpvWhOMDek6hoRKvA
The first 2 are not part of the
Tenant_Admin
permissions.
These are not part of the permissions for role
Tenant_Admin
in tenant
05f5000c-0fbf-4fed-b94f-da229833d7a6
Copy code
sites.*.mcp-servers.VIEW
sites.*.llms.VIEW
If you will add these 2 permissions to the
Tenant_Admin
role the user will be able to view also the
developer
role.
b
tenant_admin has
Copy code
sites.*.mcp-servers.FULL
sites.*.llms.FULL
d
and?
so?
the developer role as 3 permissions
2 of them not part of the tenant admin
permissions are only strings with no meaning for us
the fact that you write the word “FULL” does not mean it has anything.
You need to make sure the tenant admin has all releavnt permissions
The permissions:
Copy code
sites.*.mcp-servers.VIEW
sites.*.llms.VIEW
are not part of the developer role
so we can’t know if the tenant admin entitled to view it
the fact that the word “FULL” is there does not mean the admin can view anything, we are not aware of your internal logic.
b
right, earlier i added all 3 permissions for each resource like
Copy code
sites.*.mcp-servers.FULL
sites.*.mcp-servers.VIEW
sites.*.mcp-servers.EDIT
due to size restriction in jwt, it didn't work, so we were told to use roles and understand permissions in app.
d
for users to be able to view roles the user should have all permissions for that role.
You can create a “Super User” permission and assign it to the tenant admin roles, and users with that permissions will be able to do/view anything.
b
if i add super user to tenant , will be able to see developer role also in widget
since it is a descope role, i need understand it as *, in my app
d
yes
just create a
Super User
permission and assign it to the relevant role