Roles & Access Control

[parthlawate]

Hi,

Where can i find documentation about how to add new custom roles & permissions in Sunbird ED ?

[vishaldeltech]

Hi @parthlawate, I have the same question. How do we manage custom roles and permissions for such roles?

[parthlawate]

@Krishnaj20 Can you help on this ?

[Krishnaj20]

@parthlawate - can you let us know in which workflows you would like to create these custom roles?

@rhwarrier - can you share the links to Lern microsite which has details about course & batch specific roles please?
@luckynvdu - can you share the links to coKreat microsite which has details about creation roles please?

[luckynvdu]

Please find the details about the creations roles here https://project-sunbird.atlassian.net/wiki/spaces/SingleSource/pages/1960574996/User+Roles

@pallakartheekreddy

[pallakartheekreddy]

@Krishnaj20 above use roles that @luckynvdu shared for the creation portal(Sourcing Portal). are you referring creation roles for workspace in ed ?

[Krishnaj20]

@pallakartheekreddy - The current SAAS needs are more aligned to workspace type of creation - in house creation than crowd sourcing. It will be good if you can share for both workspace and creation portal as well. Thanks

[rhwarrier]

Please see if the following thread helps : Sunbird-Lern/Community#46

@reshmi-nair pls add details on custom role creation as necessary.

[parthlawate]

Seems a lot of the creation related things are being pointed to coKreat ?

However since we support Creation workflows within Sunbird ED independently without needing coKreat, we should also address them in that context.

When Creation needs to happen at Scale where you have multiple sourcing orgs involved and complex crowdsourcing workflows we need CoKreat.. But for a lot of usecases that are not national/state scale.. We do not need that..

[reshmi-nair]

@parthlawate To find more on currently supported roles and other details please refer toRoles page.

Custom roles are not possible to create as of now. But each role has a scope field which can be used to extend/limit the scope of a role to specific areas. Currently only organisation is in role scope, so the user will be restricted to that specific org.

API level access control is maintained using OPA and Envoy as sidecars in backend microservices.

[parthlawate]

thanks @reshmi-nair from a SAAS & wider use case perspective this will be critical & hygiene. Request that this be prioritised. I've posted some real world use cases below..

[parthlawate]

The current Use cases We have seen are as below :

A. Consumption Side

1. Restrict Access to a Set of Courses based on Role/ Department of User : Eg users of the Marketing Department will only see a certain set of courses/ certain course categories; Finance & Leadership will see different ones

2. Control on Actions that can be done on a course based on Role in context of a course (For instance as a Student of a course, I can enrol, consume content, add comments ; As a Teacher/ Mentor - I can access Student consumption reports, Assign the course to specific students, View Student Answer sheets , As a Mentor i can do everything a teacher can do but for my Mentees

3. Ability to configure workflows based on Access roles - Who can enrol without Approval, Who needs approval for enrolment

B. Reporting Side
Reporting Side access roles can be a function of global Roles like Super Admin/ Learning Manager OR be a function of a Cohort/ Department ..

As a Super Admin I should be able to access Reports of Users across the system including access to PII information request
As a Department Manager I should be able to access reports of users in my department
As a People Manager/ Mentor I should be able to access Completion Reports of my direct & indirect reportees

C. Creation Side
Ability to define various consumption side roles like Creator, Reviewer, Publisher etc on the basis of Subject matter expertise/ Content Categories/ Departments

For Instance
Creator 1 should only be allowed to create content under the Categories Finance, Accounting
Creator 2 should only be allowed to create content under the Categories Sales Skills
Reviewer 1 can review content of Finance & Sales skills

and so on..

[rhwarrier]

@Krishnaj20 @rajeevsathish @swayangjit reshmi-nair @sharathkashyap
please see which BBs this will impact, in terms of changes required/ approach to enable this.

@Krishnaj20 we should consider consolidating Course related changes and putting together a design doc that elaborates all of this together. This should include requirements and suggestions from adoption efforts as well as the SaaS project.

There have been prerequisites needs called out around courses from snehal0904 as well (https://github.com/orgs/Sunbird-Ed/discussions/262)

@parthlawate @coolbung

@SanthoshVasabhaktula and @rayulu - pls note.

[rhwarrier]

Adding the link to the confluence doc where the adopter needs around Courses are being consolidated :

https://project-sunbird.atlassian.net/wiki/spaces/PRD/pages/3254976513/Courses+Functionality+Re-design+Dec+2022