instructure/canvas-lms · error · Canvas::Migration::Error

Not importing academic benchmark data because user with ID…

Error message

Not importing academic benchmark data because user with ID '#{user.id}' isn't allowed to edit global outcomes

What it means

Canvas::Migration::Error raised by AcademicBenchmark.check_for_import_rights when the resolved user lacks the :manage_global_outcomes right on Account.site_admin. Global outcomes are account-level records, so only site admins with that permission may import academic benchmark data.

Solutions

Grant the user manage_global_outcomes: Account.site_admin.role_overrides or assign a site-admin role with that permission.
Re-run the import as a user who holds the permission.
Check permission state: Account.site_admin.grants_right?(user, :manage_global_outcomes) before launching the import.
If using a role override, ensure it is enabled for the user's role on the site admin account.

Example fix

// before
AcademicBenchmark.import(user_id: current_user.id)
// after
unless Account.site_admin.grants_right?(current_user, :manage_global_outcomes)
  raise ArgumentError, 'user lacks manage_global_outcomes'
end
AcademicBenchmark.import(user_id: current_user.id)

Defensive patterns

Strategy: validation

Validate before calling

return unless Account.site_admin.grants_right?(user, :manage_global_outcomes)

Try / catch

begin
  AcademicBenchmark.import(user_id: user.id)
rescue Canvas::Migration::Error => e
  flash[:error] = I18n.t('You must be a site admin to import global outcomes')
end

Prevention

Hide the import UI unless the user holds manage_global_outcomes.
Use a dedicated service account with the permission for automated imports.
Re-check permissions at job run time, not only at enqueue time.

When it happens

Trigger: Running an academic benchmark import where the content_migration's user is a normal teacher/account admin who does not hold manage_global_outcomes on the site-admin account.

Common situations: Admins importing standards without site-admin role; permission changes removing manage_global_outcomes between job enqueue and execution; misconfigured role overrides.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/780d098dc4bbae01. Report an issue: GitHub.

Appendix: source

Thrown at gems/plugins/academic_benchmark/lib/academic_benchmark.rb:229

    unless uid.present?
      raise Canvas::Migration::Error,
            "Not importing academic benchmark data because no user id set"
    end
    uid
  end

  def self.ensure_real_user(user_id:)
    u = User.find_by(id: user_id)
    unless u
      raise Canvas::Migration::Error,
            "Not importing academic benchmark data because no user found matching id '#{user_id}'"
    end
    u
  end

  def self.check_for_import_rights(user:)
    unless Account.site_admin.grants_right?(user, :manage_global_outcomes)
      raise Canvas::Migration::Error,
            "Not importing academic benchmark data because user with ID " \
            "'#{user.id}' isn't allowed to edit global outcomes"
    end
    user
  end
end

View on GitHub (pinned to 1c9f0bb801)