Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-15632

It is impossible for the administrator to delegate fine-grained system-level responsibilities

    XMLWordPrintable

Details

    • Improvement
    • Status: Closed
    • Minor
    • Resolution: Fixed
    • 1.9.1
    • 1.9.3
    • Roles / Access
    • None
    • MOODLE_19_STABLE
    • MOODLE_19_STABLE

    Description

      In a newly-installed Moodle site, there is a single administrator. Ideally, the administrator should be able to delegate some (but not all) of his System-level responsibilities to one or more assistants. For example, the administrator should be able to delegate responsibilty for managing roles. However giving the assistant moodle/role:manage = Allow in the System context is not enough. The administrator must also give moodle/site:config = Allow. Unfortunately, this gives the assistant excessive permissions (it gives access to most of the functionality in the Site administration block).

      Currently, the only way to accomplish most System-level tasks is either (1) have a single administrator do everything (which doesn't scale) (2) assign the Administrator role to multiple users ("too many cooks"). So this is both a scalability issue and a security issue. We can't scale securely in System.

      In contrast to System, fine-grained delegation is easy to do in the Category/Course/Module and Block contexts. For example, the administrator can delegate all of his category and course management responsibilities to one or more category managers, who can in turn delegate to sub-category managers, and so-on.

      Attachments

        Activity

          People

            timhunt Tim Hunt
            jisner John Isner
            Helen Foster Helen Foster
            Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Ilya Tregubov, Sara Arjona (@sarjona)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:
              15/Oct/08