Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can:
Given multiple applications (service providers, SP), each application/SP has its own list of 'roles' or 'resources' (admin, app_role_1, app/myurllink/two, app_role_2, purposefully mixing to support both).
What solution(s) best support the simple scenario of --
SP registers to the central security manager the list of roles/resources (i.e. the SP does this work, not someone independently copying into an xml/json config file locally to the IAM/IDM).
IAM/IDM tool has UI in place to select a user, select a service, then allow access to role/resource (from the list the SP has registered).
Application/SP delegates authentication to SSO and gets the tokens for authorization, gets approved roles(plural) for that service, service allows access and gets the subject/identity profile for visualization/auditing purposes.
Application/SP are primarily desktop web applications, mixing java and dotnet.
<security-role><role-name>role1</role-name></security-role>, @DeclareRoles(...) standard role definitions.
It sounds too simple...yet impossible to find how to pull it off...