Grant CD2 access to non account admin users

[MikeRichards]

With Canvas Data 1 we could give specific users access to the data. This would allow us to have users that can use Canvas Data, but not have admin access to anything outside of that. We have data professionals in other departments who are allowed access to the data but they do not have any permission to have administrative access to Canvas.

With Canvas Data 2 we need a way to grant access to only Canvas Data 2 data without having to expand permissions into other administrative areas in Canvas.

Typically we like to be able to give this access to a local account for each department that needs Canvas Data access. A separate issue is that it seems there is no way to allow a local account access to Canvas Data 2, if your main authentication method is something else.

Edit:

• With the maximum duration of 1 year per key, it is even more important for this access to be delegated out without having to have each and every key refresh come through our account admins.
• The local account issue can be worked around using multiple tabs and logging in to your "name.instrcture.com" and not the vanity URL.

[bliszewski]

Is the Key generated at identity.instructure.com meant to be associated with a specific user? Can you manage which tables are available based on the user that generates the key?

If I'm following the relationship between and api-gateway.instructure.com here, it seem like the idea is that only Account Admins have access to identity.instructure.com in order to create and manage API Keys, which can be distributed to other users, partners, and services to connect to api-gateway.instructure.com. This ensures that not just anybody can set up a new data extract.

But this does seem somewhat challenged that Key in identity.instructure.com seem to only be visible to the user that created them, so other admins can't even revoke an active Key created by someone who's not available. And that's pretty concerning.