Documentation does not mention Role-Group Bind is not performed in IS 7.1 KM setups when the scopes are created for shared secondary userstores.

Current Limitation

Hi Team,

We noticed the following behavior in the APIM 4.x + IS 7.x KM setup and the documentation does not mention this limitation.

Consider an APIM 4.x + IS 7.x KM setup

1. In the APIM side, create a scope that can be obtained by a role in the secondary userstore (Group according to the IS 7.1 concepts) let's call this role/group as IS-LDAP/new_publisher_group_two
2. Then We can see this scope and the corresponding role is created in the IS side.
3. However, this system_is-ldap_new_publisher_group_two role and the IS-LDAP/new_publisher_group_two group do not have an association in the IS 7.1. This means. Users who are in the LDAP/new_publisher_group_two group cannot really get this scope.

Suggested Improvement

As this seems to be the expected behavior and it is required to perform this mapping manually. It would be great if this is documented in the official docs [1]

https://apim.docs.wso2.com/en/4.4.0/administer/key-managers/configure-wso2is7-connector/#role-creation-in-wso2-identity-server-7x

Version

No response

Start with the linked Role Creation in WSO2 Identity Server 7.x documentation page and review its explanation of scopes, roles, and groups. Confirm the shared secondary-userstore limitation described in the issue, then update that section to state that the Role-Group Bind is not performed and the mapping must be created manually; done means the limitation and required manual step are clear.