Skip to content

fix: Finally replace awkward one-liner to create system-wide enterprise role assignments #227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pwnage101 merged 1 commit into from
Aug 11, 2026
Merged

fix: Finally replace awkward one-liner to create system-wide enterprise role assignments #227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions enterprise/provision.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,6 @@ docker compose exec -T lms bash -e -c 'source /edx/app/edxapp/edxapp_env && pyth
cat enterprise/worker_permissions.py | docker compose exec -T lms bash -e -c 'source /edx/app/edxapp/edxapp_env && python /edx/app/edxapp/edx-platform/manage.py lms shell --settings=devstack'

docker compose exec -T lms bash -e -c 'source /edx/app/edxapp/edxapp_env && python /edx/app/edxapp/edx-platform/manage.py lms --settings=devstack create_dot_application --grant-type client-credentials --client-id "enterprise-backend-service-key" --client-secret "enterprise-backend-service-secret" enterprise-backend-service enterprise_worker'

# Create system wide enterprise role assignment for the enterprise service worker
docker compose exec -T lms bash -e -c 'source /edx/app/edxapp/edxapp_env && python /edx/app/edxapp/edx-platform/manage.py lms --settings=devstack assign_system_wide_enterprise_role --username enterprise_worker --role enterprise_openedx_operator --all-contexts'
Comment on lines +9 to +11

@pwnage101 pwnage101 Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This assignment seems net new, but you might ask how anybody's devstack ever worked without it.

Best I can tell, everybody eventually followed one wiki doc or another and several of them mention the seed_enterprise_devstack_data management command, so at some point everybody just runs that command. There was no way to get a complete working devstack for enterprise without running both dev.provision.enterprise AND seed_enterprise_devstack_data, and neither in isolation was sufficient.

That's not necessarily a bad thing---we ask developers to run multiple commands in sequence all the time. But the problem was that both commands overlapped in purpose, including the creation of the enterprise_worker user. Worse, they both provisioned the same user differently, so the second one was the winner. This non-determinism is confusing, could lead to difficult to understand devstack bugs, and contributed to dead weight in our codebase.

My recent PR openedx/edx-enterprise#2662 helped draw a clear line between each script: dev.provision.enterprise is just the bare minimum to get the enterprise services to talk, and seed_enterprise_devstack_data was for actually provisioning enterprise customers and enterprise users. No more overlap.

As a result, that created a gap in this file, it was now missing a step to create the assignment for the enterprise service worker. One side-benefit of adding this missing step is that now launching a fresh devstack Codespace instance gets you a fully functioning devstack out of the box with fully communicating enterprise services.

3 changes: 1 addition & 2 deletions provision-enterprise-access.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,7 @@ docker compose exec -T ${name} bash -e -c "echo 'from django.contrib.auth import
./provision-ida-user.sh ${name} ${name} ${port}

# Create system wide enterprise role assignment
# TODO: this is a pretty complex oneline, we should probably eventually convert this to a management command.
echo -e "${GREEN}Creating system wide enterprise user role assignment for ${name}...${NC}"
docker compose exec -T lms bash -e -c "source /edx/app/edxapp/edxapp_env && echo 'from django.contrib.auth import get_user_model; from enterprise.models import SystemWideEnterpriseUserRoleAssignment, SystemWideEnterpriseRole; User = get_user_model(); worker_user = User.objects.get(username=\"${name}_worker\"); operator_role = SystemWideEnterpriseRole.objects.get(name=\"enterprise_openedx_operator\"); assignment = SystemWideEnterpriseUserRoleAssignment.objects.get_or_create(user=worker_user, role=operator_role, applies_to_all_contexts=True);' | /edx/app/edxapp/venvs/edxapp/bin/python /edx/app/edxapp/edx-platform/manage.py lms shell" -- lms
docker compose exec -T lms bash -e -c "source /edx/app/edxapp/edxapp_env && python /edx/app/edxapp/edx-platform/manage.py lms --settings=devstack assign_system_wide_enterprise_role --username ${name}_worker --role enterprise_openedx_operator --all-contexts"
Comment thread
pwnage101 marked this conversation as resolved.

make dev.restart-devserver.enterprise-access
3 changes: 1 addition & 2 deletions provision-enterprise-catalog.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,8 @@ docker compose exec -T ${name} bash -c "echo 'from django.contrib.auth import ge
./provision-ida-user.sh ${name} ${name} ${port}

# Create system wide enterprise role assignment
# TODO: this is a pretty complex oneline, we should probably eventually convert this to a management command.
echo -e "${GREEN}Creating system wide enterprise user role assignment for ${name}...${NC}"
docker compose exec -T lms bash -e -c "source /edx/app/edxapp/edxapp_env && echo 'from django.contrib.auth import get_user_model; from enterprise.models import SystemWideEnterpriseUserRoleAssignment, SystemWideEnterpriseRole; User = get_user_model(); worker_user = User.objects.get(username=\"${name}_worker\"); operator_role = SystemWideEnterpriseRole.objects.get(name=\"enterprise_openedx_operator\"); assignment = SystemWideEnterpriseUserRoleAssignment.objects.get_or_create(user=worker_user, role=operator_role, applies_to_all_contexts=True);' | /edx/app/edxapp/venvs/edxapp/bin/python /edx/app/edxapp/edx-platform/manage.py lms shell" -- lms
docker compose exec -T lms bash -e -c "source /edx/app/edxapp/edxapp_env && python /edx/app/edxapp/edx-platform/manage.py lms --settings=devstack assign_system_wide_enterprise_role --username ${name}_worker --role enterprise_openedx_operator --all-contexts"
Comment thread
pwnage101 marked this conversation as resolved.

# Restart enterprise.catalog app and worker containers
docker compose restart enterprise-catalog enterprise-catalog-worker
3 changes: 1 addition & 2 deletions provision-enterprise-subsidy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,7 @@ echo -e "${GREEN}Provisioning ${name}_worker in LMS...${NC}"
./provision-ida-user.sh ${name} ${name} ${port}

# Create system wide enterprise role assignment
# TODO: this is a pretty complex oneline, we should probably eventually convert this to a management command.
echo -e "${GREEN}Creating system wide enterprise user role assignment for ${name}...${NC}"
docker compose exec -T lms bash -e -c "source /edx/app/edxapp/edxapp_env && echo 'from django.contrib.auth import get_user_model; from enterprise.models import SystemWideEnterpriseUserRoleAssignment, SystemWideEnterpriseRole; User = get_user_model(); worker_user = User.objects.get(username=\"${name}_worker\"); operator_role = SystemWideEnterpriseRole.objects.get(name=\"enterprise_openedx_operator\"); assignment = SystemWideEnterpriseUserRoleAssignment.objects.get_or_create(user=worker_user, role=operator_role, applies_to_all_contexts=True);' | /edx/app/edxapp/venvs/edxapp/bin/python /edx/app/edxapp/edx-platform/manage.py lms shell" -- lms
docker compose exec -T lms bash -e -c "source /edx/app/edxapp/edxapp_env && python /edx/app/edxapp/edx-platform/manage.py lms --settings=devstack assign_system_wide_enterprise_role --username ${name}_worker --role enterprise_openedx_operator --all-contexts"
Comment thread
pwnage101 marked this conversation as resolved.

make dev.restart-devserver.enterprise-subsidy
3 changes: 1 addition & 2 deletions provision-license-manager.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,7 @@ docker compose exec -T ${name} bash -e -c "echo 'from django.contrib.auth import
./provision-ida-user.sh ${name} ${name} $port

# Create system wide enterprise role assignment
# TODO: this is a pretty complex oneline, we should probably eventually convert this to a management command.
echo -e "${GREEN}Creating system wide enterprise user role assignment for ${name}...${NC}"
docker compose exec -T lms bash -e -c "source /edx/app/edxapp/edxapp_env && echo 'from django.contrib.auth import get_user_model; from enterprise.models import SystemWideEnterpriseUserRoleAssignment, SystemWideEnterpriseRole; User = get_user_model(); worker_user = User.objects.get(username=\"${name}_worker\"); operator_role = SystemWideEnterpriseRole.objects.get(name=\"enterprise_openedx_operator\"); assignment = SystemWideEnterpriseUserRoleAssignment.objects.get_or_create(user=worker_user, role=operator_role, applies_to_all_contexts=True);' | /edx/app/edxapp/venvs/edxapp/bin/python /edx/app/edxapp/edx-platform/manage.py lms shell" -- lms
docker compose exec -T lms bash -e -c "source /edx/app/edxapp/edxapp_env && python /edx/app/edxapp/edx-platform/manage.py lms --settings=devstack assign_system_wide_enterprise_role --username ${name}_worker --role enterprise_openedx_operator --all-contexts"
Comment thread
pwnage101 marked this conversation as resolved.

make dev.restart-devserver.license-manager
Loading