sync auth roles updated

README.rst

@@ -126,6 +126,10 @@ To add the default dashboards to the new user, add the ``--bootstrap-dashboards`
 
     tutor local do cairn-createuser --course-id='course-v1:edX+DemoX+Demo_Course' YOURUSERNAME YOURUSERNAME@YOUREMAIL.COM
 
+By default, AUTH_ROLES_SYNC_AT_LOGIN is False which means admin can customize the permissions associated to a user. To disable this behaviour, modify the ``CAIRN_AUTH_ROLES_SYNC_AT_LOGIN`` setting::
+
+    tutor config save --set CAIRN_AUTH_ROLES_SYNC_AT_LOGIN=True
+    tutor local restart
 
 Refreshing course block data
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

tutorcairn/plugin.py

@@ -55,6 +55,8 @@ hooks.Filters.CONFIG_DEFAULTS.add_items(
         # https://hub.docker.com/r/timberio/vector/tags
         # https://github.com/vectordotdev/vector/releases
         ("CAIRN_VECTOR_DOCKER_IMAGE", "docker.io/timberio/vector:0.25.1-alpine"),
+        #Auto sync user roles
+        ("CAIRN_AUTH_ROLES_SYNC_AT_LOGIN", False),
     ]
 )
 

tutorcairn/templates/cairn/apps/superset/superset_config.py

@@ -106,7 +106,7 @@ OAUTH_PROVIDERS = [
 CUSTOM_SECURITY_MANAGER = cairn_sso.OpenEdxSsoSecurityManager
 # Update roles on login: this will cause all roles (except those that are preserved) to
 # be ovewritten.
-AUTH_ROLES_SYNC_AT_LOGIN = True
+AUTH_ROLES_SYNC_AT_LOGIN = {{ CAIRN_AUTH_ROLES_SYNC_AT_LOGIN }}
 # Login will create user
 AUTH_USER_REGISTRATION = True
 {% endif %}