Assigning permissions

The role of each user account controls what that user can do with their company's Shutterstock account. Each customer has one or more of these roles:

Users with the browse-only role cannot have any other role. Users can have both the subscription-debitor-license and the subscription-debitor-comp roles if they need to be able to download both comps and licensed media.

Prerequisites

Before you can assign a role to a user, you must ensure that the user has an organization or that your account has a default organization. See Assigning organizations.

Assigning roles to users

To assign roles to users or change users' roles, add the roles as a custom attribute in the SAML assertion that your identity provider (IdP) sends to Shutterstock. This attribute is named roles and includes one or more value tags with the roles for the user. Check your identity provider's documentation for information about how to configure the SAML assertion.

The attribute looks like this example, which assigns the user both the subscription-debitor-license and the subscription-debitor-comp roles:

<saml2:Attribute Name="roles" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
  <saml2:AttributeValue
    xmlns:xs="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">subscription-debitor-comp
  </saml2:AttributeValue>
  <saml2:AttributeValue
    xmlns:xs="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">subscription-debitor-license
  </saml2:AttributeValue>
</saml2:Attribute>

To verify that your SAML assertion is set up correctly, compare it with the example in Next steps.

Now when the user accesses Shutterstock, that user is assigned to the specified roles. To change users' roles, send different roles in the SAML assertion the next time that the user logs in.

Assigning roles (Okta)

Here are instructions for setting up role provisioning if you are using Okta:

Changing roles

To change the role that a user has, send the new role or roles in the SAML assertion. For example, to remove a user's permission to license media, set their role to browse-only.

Verifying a user's role

To see what roles a user is assigned, log in to shutterstock.com as that user, expand the user's information at the top right-hand corner of the page, and click Team. The Permission field shows whether the user can license images, download comps, or only search and browse media.