Vendor User Bearer Token Endpoint Security

[czehner1]

Hi,

Bringing an interesting topic to the table. Our institution is quite new to Canvas, and are figuring out a lot of things as we go. We have quite a few vendors that request API access and most go through the channels of setting up a developer key and securely passing on that key to them.

This is the way we would prefer.

However, a few vendors are requesting to use user-generated bearer tokens instead. We would like to keep things secure and only give them access to what they need, so we generally do not want to generate a token from our Account Admin account and give them full access.

To combat this, we ask them to give us a list of permissions they would need to accomplish this, and set up a Role, that we tie with a user, to which is given an admin with that restricted role. (Doing so also requires that we generate a unique alias email since Canvas doesn't like users sharing emails.) Then we log in as that user, generate the token, and send it over to the vendor.

The issue is, the vendors don't really know what permissions are needed to create that role in Canvas, so they end up just sending out the API endpoints that they need. I don't know exactly which permissions grant those APIs, if there's any dependency needed from certain permissions. Are we setting ourselves up to overcrowd the amount of permissions in Canvas?

You can imagine the headache this is already starting to generate.

My question is, how do other schools handle these requests? Are we taking too cautious of an approach?

Any help is appreciated.

[zcalderon]

Hello,

How did you solved this issue? I am facing a similar situation and was wondering how you handled the problem? Your insights and experience would be greatly appreciated.

[adam_c_voyton]

This is a challenge for sure. When possible, having the vendor’s product integrate with your Canvas environment via an LTI (preferably one running version 1.3) is a great solution. Sometimes, that’s not an option, so it’s necessary to instead set up a user account with admin privileges, and then set enforce scope on the developer key that aligns with the specific needs of their app. Sometimes, testing is simply required to drill down to which permissions they need access to, if they don’t know. It’s worth informing vendors that they can set up an instance of Canvas to do testing, but they usually are not open to doing that. 

[zcalderon]

@adam_c_voyton  thank you for your response. For vendors that require admin level access do you have a policy or expectations that you give to them? Or how do you handle to securing your student data. 

[adam_c_voyton]

Denying requests that do not meet minimal security requirements is the simplest approach. Otherwise, require they integrate securely, which sometimes involves them updating how their integration works with Canvas.