Juniper update for: Pluggable access control

[omar (Omar Al-Ithawi - Founder @ ZeitLabs.com)]

I’ve posted earlier a proposal for pluggable access control on Open edX. As we’re upgrading to Juniper we’ve got a Bridgekeeper as a replacement for the has_access method.

When we released the Access Control Backends back in November 19th, we needed it to work with Hawthorn as we weren’t ready to upgrade for Juniper/Ironwood. So we ended up with having an incompatible implementation that couldn’t be pushed upstream.

At the moment there’s no clear path on how it would be migrated, but the plan is to come up with such migration plan. Which we’ll attempt to address in this release.

I’ll share more as I go in this thread, once the write up is complete.

A reminder of what the Access Control Backends looks like:

@omar

Hypothetically, if we’d like to make the enrollment in the course-v1:Uni+Demo+2020 course
to be exclusive for users with @example.edu email we’d use the following configuration:

# my-configs/server-vars.yml
ACCESS_CONTROL_BACKENDS:
    course_enroll:
      NAME: 'my_access_plugins.backends.domain_based_course_enrollment'
      OPTIONS:
        enforce_domain_name_check: true
    course_load:
      NAME: 'my_access_plugins.backends.domain_based_course_enrollment'

And the backend would look like this:

# my_access_plugins/backends.py
def domain_based_course_enrollment(user, courselike, default_access, options):
    if courselike.id == 'course-v1:Uni+Demo+2020' and not user.email.endswith('@example.edu'):
        return False

    if options.get('enforce_domain_name_check', False):
       # Check the DNS records for such email.
       pass

    return default_access

Show me the code

I’ve opened a provisional pull request for Access Control Backends that cherry-picks what we’ve done on our fork.

Next steps

Please check out the code and let’s discuss what’s needed to get it merged. This is a big piece of work that we’d like to contribute so the platform can become a bit more lightweight allowing operators to use richer plugins such as the Course Access Groups app.