MB-R100

Admin role assignments are valid

C02 Admin Hardening High

Every active Magento Admin user must be assigned to a valid, active authorization role, and role relationships must not reference missing users, missing parent roles, or otherwise orphaned records. Validate the relationships across admin_user, authorization_role, and authorization_rule so administrative access is explicit, reviewable, and consistently enforced. Unassigned users and broken role relationships can create unpredictable access behavior or conceal stale privileged accounts. If the required database evidence is unavailable, the automated check must return UNKNOWN rather than assuming the configuration is secure.

Why it Matters

Admin users without valid role assignments are hard to review and can hide stale privileged access. Broken relationships between admin_user, authorization_role, and authorization_rule make authorization behavior unpredictable and weaken accountability.

Every active admin account should map cleanly to an active, intentional role so access remains explicit and auditable.

Verification Steps

Database relationship review

Review active admin users and role assignments
Expected: every active admin user has a valid active parent role
Check for orphaned authorization_role records or missing parent roles

Evidence handling

If database evidence is unavailable
Expected: UNKNOWN, not PASS

Remediation / Fix Guidance

Assign every active admin user to an approved role.
Remove stale admin users that no longer require access.
Repair or remove orphaned authorization_role records.
Document role ownership and review it on a regular cadence.
Treat missing evidence as a review item instead of assuming the state is safe.

Examples

Fail Example

Active admin user exists with no valid assigned role
# Access state is unclear → FAIL

Pass Example

Every active admin user maps to an approved active role
# Role assignment is explicit and reviewable → PASS