Security: Role in IdM UI

Dear all,

Which attributes do I have to use to give security in teh IdM UI for different tasks?

1. User: Selfservice for reset his own oassword

2. Service Desk: This group should reset all password, without members of the admin group

3. Authority manager: This group should assign security roles to users without changing the other user attributes.

Please advise.

Best regards,

Hans