Granting "Permissions - Manage" - Is that the only programmatic way to get an Admin user role?

[ward_michael]

From my other post:
https://community.canvaslms.com/t5/Canvas-Question-Forum/Granting-Admin-Permissions-to-Third-Party-I...

I want to check to see if there is any other way for a third-party integration (Dev Key / LTI 1.3 / Access Token / custom JavaScript) to be able to retrieve the logged in user's role if that user has an account admin role?  Does the "Permissions - Manage" permission have to be granted if the tool is using an admin level Access Token to be able to read end user Admin roles?  The tool vendor says they need that permission since their tool has different functionality for Admin users.

As a Canvas Admin, I am not comfortable granting such a high level permission which would essentially allow modifying any of our roles or creating new ones and giving FULL COMPLETE ADMIN access.  Seems highly insecure and against security best practices.  I understand the vendor's need but without a separation of "View" versus "Manage" on Permissions then I may have to reject this tool unless there is some other programmatic way the vendor could read account admin role without needing that permission.

Thank you for any suggestions regarding this!

[chriscas]

Hi @ward_michael,

This may depend a bit on what exactly the tool is looking for.  An LTI 1.3 launch payload should pass along that a user is an admin in the institution roles.  This may look something like the following:

Because this is part of the institution roles for Canvas, that generally means that the user is an admin somewhere in the system, but not necessarily where the LTI launch is coming from (notice how the screenshot has student, instructor, and administrator, as my user account has all of those roles in various places in Canvas.  You'll also notice that the information is just "administrator" not a specified admin role, so if you have full admin roles and more limited ones defined in your Canvas instance, they would all be treated the same in an LTI launch.  So with this in mind, it is theoretically possible to get some limited admin info via an LTI launch.

If the tool needs to know about all admins in your Canvas system for whatever reason, or needs to know the info before a certain user performs a launch of the tool themselves to pass the role info from Canvas, or needs to remove admins in an automated way if they are removed form Canvas, the LTI launch method won't really work.  They'd need to do lookups via API, and I believe at this time that does require the permissions-manage permission.  I really wish that permission was separated into a view and an edit, for the same reasons you probably do.  It's probably not going to be something that will get quick attention by Instructure at this point (but you never know).

At this point, it may come down to how much you trust the vendor, and what kind of contractual language you have in place with them (if any).  For anything requiring this kind of permission, we'd definitely require one of our full legal data protection agreements be signed by the vendor, and I'd be doing some of the same questioning that you are... Is this really needed? What happens if you don't grant this access?  Do you trust the vendor?  Do they have a decent verifiable track record of security practices, etc...  

We do have a couple vendors who we have granted this permission to at my institution after asking some of the questions above.

I hope this info helps a bit.  I didn't want to make too long of a first reply, so there may be some details I left out.  Others may have differing opinions or more info that I do, so you may see some additional replies too, especially if I've gotten any info explicitly wrong here.

-Chris