[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Managing apps (SSO) > OIDC apps > Setting up access to the application

# Setting up access to an OIDC app in Yandex Identity Hub


To grant access to an [OIDC app](../../concepts/applications.md#oidc), assign [roles](../../../iam/concepts/access-control/roles.md) to subjects. [Learn](../../security/index.md#roles-list) what roles the service has and assign the required ones.

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, click ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select your app.
  1. Navigate to the **Access bindings** tab.
  1. Click **Assign roles**.
  1. In the window that opens, select the group, user, or service account to which you want to give access to the app.
  1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select a role. Add other roles as needed.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

   1. See the description of the CLI command for assigning roles to OIDC app users:

      ```bash
      yc organization-manager idp application oauth application set-access-bindings --help
      ```

   1. Get a list of OIDC apps and their IDs:

      ```bash
      yc organization-manager idp application oauth application list --organization-id <organization_ID>
      ```

      Where `--organization-id` is the [ID of the organization](../organization-get-id.md) you need the list of OIDC apps for.

   1. Get the [ID of the user](../users-get.md), [service account](../../../iam/operations/sa/get-id.md), or user group you are assigning roles to.

   1. Using the `yc organization-manager idp application oauth application set-access-bindings` command, assign the following roles:
      
      * To a Yandex account user or local user:

         ```bash
         yc organization-manager idp application oauth application set-access-bindings \
           --id <app_ID> \
           --access-binding role=<role>,user-account-id=<user_ID>
         ```

      * To all users of a federation:

         ```bash
         yc organization-manager idp application oauth application set-access-bindings \
           --id <app_ID> \
           --access-binding role=<role>,federation-users=<federation_ID>
         ```

      * To all users of an organization:
        
         ```bash
         yc organization-manager idp application oauth application set-access-bindings \
           --id <app_ID> \
           --access-binding role=<role>,organization-users=<organization_ID>
         ```

      * To a service account:

         ```bash
         yc organization-manager idp application oauth application set-access-bindings \
           --id <app_ID> \
           --access-binding role=<role>,service-account-id=<service_account_ID>
         ```

      * To a user group:

         ```bash
         yc organization-manager idp application oauth application set-access-bindings \
           --id <app_ID> \
           --access-binding role=<role>,subject=group:<group_ID>
         ```

      * To all authenticated users (the `All authenticated users` [public group](../../../iam/concepts/access-control/public-group.md)):

         ```bash
         yc organization-manager idp application oauth application set-access-bindings \
           --id <app_ID> \
           --access-binding role=<role>,all-authenticated-users
         ```

      Provide a separate `--access-binding` parameter for each role. Here is an example:

      ```bash
      yc organization-manager idp application oauth application set-access-bindings \
        --id <app_ID> \
        --access-binding role=<role1>,service-account-id=<service_account_ID> \
        --access-binding role=<role2>,service-account-id=<service_account_ID> \
        --access-binding role=<role3>,service-account-id=<service_account_ID>
      ```

- API {#api}

  Use the [Application.SetAccessBindings](../../idp/application/oauth/api-ref/Application/setAccessBindings.md) REST API method for the [Application](../../idp/application/oauth/api-ref/Application/index.md) resource or the [ApplicationService/SetAccessBindings](../../idp/application/oauth/api-ref/grpc/Application/setAccessBindings.md) gRPC API call.

{% endlist %}