I found the Identity UI for orchestration at http://hostname:8088/identity. I had no idea it was located there!
I still don’t fully understand how to assign roles, but at least I feel like I’ve reached the starting line.
Thanks for the advice! I’ll close this for now.