Skip to content

Verify platform-level glob scope in AuthZ and openedx-platform #366

Closed
Closed
Verify platform-level glob scope in AuthZ and openedx-platform#366
Assignees
efortish
Labels
willowReleased in Willow

Description

@BryanttV
BryanttV
opened on Jul 21, 2026

Background / Context

The authorization architecture utilizes platform-level glob scopes restricted to specific resource types—specifically, course and library (e.g., course-v1:* and lib:*). This allows designated actors to have platform-wide access to all courses or all libraries without granting overarching administrative access to the entire system. We need to conduct an audit to ensure that these resource-specific platform scopes are correctly applied, respected, and enforced across AuthZ and openedx-platform.

Objective

Audit and verify that the course and library glob scopes are correctly enforced, ensuring they grant the expected platform-wide access to their respective resources without leaking permissions into other scopes or compromising granular access controls.

Scope of Work

  1. Identification:

    • Identify the zones and endpoints within openedx-authz and openedx-platform (e.g., LMS, Studio) that interact with course and library resources and should support these platform-level glob scopes.

  2. Audit & Verification:

    • Verify that the AuthZ configuration correctly parses and evaluates course-v1:* and lib:* scopes.
    • Inspect the authorization decorators/middleware in openedx-platform to confirm they accurately respect these scopes for platform-wide resource access.

Acceptance Criteria

  • The endpoints and zones requiring course and library platform-level access are identified and documented.
  • AuthZ and openedx-platform are confirmed to correctly enforce the course-v1:* and lib:* scopes.
  • Any missing authorization checks or misconfigured discovered during the audit are documented for resolution.
  • The necessary corrections are applied to the repositories.

Activity

  1. BryanttV
    added
    willowReleased in Willow
    on Jul 21, 2026
  2. BryanttV
    added this to RBAC AuthZ Boardon Jul 21, 2026
  3. BryanttV
    moved this to In Progress in RBAC AuthZ Boardon Jul 21, 2026
  4. BryanttV
    self-assigned this
    on Jul 21, 2026
  5. BryanttV
    added a parent issue on Jul 28, 2026

  6. efortish commented on Aug 3, 2026

    @efortish
    efortish
    on Aug 3, 2026
    Contributor

    Gap: RoleCache legacy compatibility layer ignores platform-wide glob scopes

    Summary

    The AuthZ → legacy compatibility layer currently has two gaps for platform-wide glob scopes:

    1. authz_get_all_course_assignments_for_user() does not request PlatformCourseOverviewGlobData.
    2. _get_org_and_course_id_from_authz_scope() does not know how to represent a platform-wide scope in the legacy (org, course_id) model.

    As a result, platform-wide role assignments are invisible to RoleCache and can cause legacy access checks to incorrectly deny access.

    While auditing #38660 for platform-wide glob (course-v1:*) coverage, I found a related gap in the AuthZ → legacy compatibility layer in common/djangoapps/student/roles.py.

    Root Cause

    authz_get_all_course_assignments_for_user() (roles.py:184) only requests two scope types:

    scope_types=(CourseOverviewData, OrgCourseOverviewGlobData)

    PlatformCourseOverviewGlobData is therefore never included in the assignments fetched for RoleCache / BulkRoleCache.

    Even if PlatformCourseOverviewGlobData were included, _get_org_and_course_id_from_authz_scope() (roles.py:163) currently has no branch to handle it. The method only supports:

    • CourseOverviewData → (org, course_id)
    • OrgCourseOverviewGlobData → (org, None)

    A platform-wide glob does not map cleanly to this (org, course_id) representation because it applies to all organizations and courses.

    Impact

    This means a user whose only role assignment is a platform-wide glob, such as:

    course-v1:*

    will not have that role represented in the legacy RoleCache.

    Consequently, legacy access checks such as:

    • RoleCache.has_role(role, course_id, org)
    • has_access()
    • CourseRole.has_user()

    can report that the user does not have the required role, even though the corresponding AuthZ assignment exists.

    This is inconsistent with newer AuthZ-native checks, which correctly recognize platform-wide assignments through IS_PLATFORM_GLOB.

    What do you think @BryanttV

  7. efortish commented on Aug 3, 2026

    @efortish
    efortish
    on Aug 3, 2026
    Contributor

    I also found this gap:

    RoleBase._authz_get_orgs_for_user() (roles.py:641) reads assignment.scope.org for every assignment.

    However, PlatformGlobData / PlatformCourseOverviewGlobData (the course-v1:* / lib:* platform-wide scopes) do not have an .org attribute at all.

    As a result, any user with a platform-wide role causes get_orgs_for_user() / has_org_for_user() to fail with an AttributeError.

    The compatibility layer assumes that every AuthZ scope has an org attribute:

    orgs = {assignment.scope.org for assignment in assignments}

    This assumption is not valid for platform-wide glob scopes.

    Unlike organization-scoped globs, platform-wide scopes do not contain an organization because they apply to every organization.

    Fix

    Handle platform-wide grants explicitly before accessing assignment.scope.org:

    def _authz_get_orgs_for_user(self, user) -> list[str]:
    """
    Returns a list of org short names for the user with given role.
    AuthZ compatibility layer
    """
    role = get_authz_role_from_legacy_role(self._role_name)
    assignments = authz_api.get_user_role_assignments_filtered(
        user_external_key=user.username,
        role_external_key=role,
    )

    # A platform-wide grant (course-v1:*, lib:*) covers every org, not just
    # the ones with a concrete assignment. Platform-glob scopes have no .org
    # attribute at all (unlike org-glob/course/library scopes, where it's a
    # real field that can be None).
    if any(assignment.scope.IS_PLATFORM_GLOB for assignment in assignments):
        return [org["short_name"] for org in get_organizations()]

    orgs = {
        assignment.scope.org
        for assignment in assignments
        if assignment.scope.org is not None
    }
    return list(orgs)

    This prevents get_orgs_for_user() / has_org_for_user() from crashing when a user has a platform-wide role while preserving the existing behavior for organization-scoped assignments.

    What do you think @BryanttV ?

  8. BryanttV
    assigned
    efortish
    and unassigned
    BryanttV
    on Aug 3, 2026

  9. BryanttV commented on Aug 3, 2026

    @BryanttV
    BryanttV
    on Aug 3, 2026
    ContributorAuthor

    Hi @efortish, thanks for the validation!

    We definitely have these two gaps related to the platform-global scope that need to be addressed. I agree with your suggestion regarding the second gap: a user with a platform-level assignment should have access to all organizations.

    Regarding the first gap, do you have any proposals on how we could solve it? Also, please create an issue to address both of these gaps.

  10. efortish commented on Aug 4, 2026

    @efortish
    efortish
    on Aug 4, 2026
    Contributor

    Hello @BryanttV

    I created these two issues:

    IMO both issues could be attached in one single issue due the relation between them but I decided to split it as you requested.

    Please let me know if the issues are correctly flagged out.

  11. BryanttV commented on Aug 4, 2026

    @BryanttV
    BryanttV
    on Aug 4, 2026
    ContributorAuthor

    @efortish Let's treat these as separate issues. Thanks for creating them. Could you start working on them?

    I'll mark this issue as closed since the platform-level glob scope verification has been completed and the corresponding tasks have been created.

  12. BryanttV
    closed this as completedon Aug 4, 2026
  13. github-project-automation
    moved this from In Progress to Done in RBAC AuthZ Boardon Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

willowReleased in Willow

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions