LTI Sync Roster and Grading

[holl...@longsight.com]

I would like to have my LTI tool sync the course roster and get the "lis_result_sourcedid" for each user in order to grade students who have not loaded the LTI tool. Moodle and Sakai implement the LTI membership extension (http://developers.imsglobal.org/ext_membership.html) which gives me everything I need, but it looks like Canvas does not implement this. After some research, I'm assuming that the only way to get the roster and grade users without a "lis_result_sourcedid" is through the Cavnas API. Is this correct? Is there a way to generate the "lis_result_sourcedid" for users if I grab the roster through the Canvas API or do I have to also grade through the Canvas API instead of the LTI outcomes URL (ext_ims_lis_basic_outcome_url)?

Thanks,

Bryan

[Brad Humphrey]

Canvas does not have the LTI membership extension you referenced.  However, even if it did, it would probably not contain the lis_result_sourcedid that you are looking for because, "this identifier is unique for every combination of resource_link_id / user_id" (http://www.imsglobal.org/lti/ltiv1p2/ltiOMv1p0.html).  It is possible that in the Moodle and Sakai implementations this ID is globally unique for a user, and that uniqueness allows them to return it in this message.

You are also correct that you can get both roster and grading capabilities by using the Canvas API directly using the users, assignments, and submissions apis.  This is partly for security reasons, as a tool should not be able to manage assignments unless they were either associated with that tool during creation or granted elevated permissions via OAuth 2.

It is our intention to add roster and rich outcome capabilities to Canvas as they get adopted into the LTI 2 specification for LTI 2 tools.  However, even with these new services a tool will still only have permission to manage assignments that were created for or by the tool.  If a tool needs a greater scope than that it will still need to somehow be granted elevated permissions.

Brad Humphrey

br...@instructure.com

--

---
You received this message because you are subscribed to the Google Groups "Canvas LMS Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to canvas-lms-use...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Bryan Holladay]

Thanks Brad for the quick response! I've been looking at the user's API and found some strange disconnects between LTI and the Canvas API. For example, both the LTI course and user IDs do not match up with the Canvas IDs:

For the same course, I have two different IDs:
LTI: context_id : 1a8fa4ecdcee851a3a21e818ed5f310758811456
Canvas API course ID: 875827

The closest thing I could find to get the Canvas course ID from the LTI parameters is from the LTI parameter:

lis_result_sourcedid : 61945-875827-3469213-4041918-f23d4f739210d8e9a2010de9310df3ca0651cf05

The 2nd number seems to be the same course ID that Canvas's API expects.

The other disconnect I have with LTI and Canvas's API is the user information:

For the same user, I have two different IDs:

LTI: user_id : 7e3f53c4c518078fa9c50f23ec66a47aee19a1b2
Canvas API:

{

    "id": 4041918,

    "name": "Bryan Holladay",

    "sortable_name": "Holladay, Bryan",

    "short_name": "Bryan Holladay",

    "login_id": "holl...@longsight.com"

  }

I can use the same login_id but that would cause issues if the user would load the LTI tool since it's expecting the LTI user_id.

Am I missing something? Is there a way to use the LTI ID's for both course and user Canvas APIs?

Thanks,
Bryan

--

---
You received this message because you are subscribed to a topic in the Google Groups "Canvas LMS Users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/canvas-lms-users/r9DZqL2HbQM/unsubscribe.
To unsubscribe from this group and all its topics, send an email to canvas-lms-use...@googlegroups.com.

[Becky Kinney]

Bryan,

I have had good success pushing grades to Canvas via the API. The easiest ids to use are custom_canvas_course_id and custom_canvas_user_id. You really can't use the LTI grade pushback if you need to send grades for anyone other than the logged in user, and the endpoints also differ in the scores they expect. The LTI outcomes is looking for a grade between 0 and 1, whereas the submissions endpoint expects points. I have found it best to just use the API for all grades if you need to do anything at all that requires the API. At that point, the only purpose your LTI stuff serves is to provide access to your tool, along with the info contained in the LTI POST vars.

Becky Kinney

Academic Technology Services

Project Blog

[Bryan Holladay]

Becky,

Thanks! I didn't have my LTI App set up for "Public" in the app configuration. When you said that you use those custom parameters, I noticed I didn't have those. So it looks like I'll have to require the tool to be Public in order to get those custom parameters and achieve grading user's who do not log in. It looks like I can use custom_canvas_assignment_id, custom_canvas_user_id and custom_canvas_course_id.

However, I still find it strange that Canvas just doesn't send over those custom ID's as the LTI parameters (userid, context_id, and resource_link_id) since that is what their API's use. There's probably a good reason for it, but from this side of the development, it seems wrong.

-Bryan

[Brad Humphrey]

The LTI standard is not designed to enable access to proprietary APIs, so these custom variables are an extension that Canvas has to facilitate communication with the Canvas API.  Additionally, to protect privacy Canvas sends only what is necessary for a basic LTI launch.  If the tool needs additional data, it can and should be negotiated with the account administrators.  This additional permission is granted and maintained through the tool management process.

Brad Humphrey

br...@instructure.com

[Bryan Holladay]

Brad,

The token access negotiation is the security barrier to the API and it's great. I'm just saying, once you get access to the API, the ID's do not line up with the existing LTI IDs that are already given. I don't see where there is a security issue with using the LTI ID's that are already given instead of the custom_canvas IDs. At a minimum, it'd be nice if the Canvas API returned both ID's so you can sync the LTI roster with the Canvas roster. For example, a call to the Canvas API: "/api/v1/courses/{courseid}/users" returns only the "custom_canvas_user_id" value and not the LTI param "user_id" value:

user_id : 7e3f53c4c518078fa9c50f23ec66a47aee19a1b2
custom_canvas_user_id : 4041918

API Result:

{
    "id": 4041918,
    "name": "Bryan Holladay",
    "sortable_name": "Holladay, Bryan",
    "short_name": "Bryan Holladay",
    "login_id": "holl...@longsight.com"
  }

In cases where the LTI tool is used exclusively for Canvas, this wouldn't be a problem. The issue is when an LTI tool wants to work in several LMS's, then it's just a pain to keep track of two IDs for course, assignments and users. I'll work around this problem. Thanks for all the help on this email thread!

Thanks,

Bryan

[Becky Kinney]

I agree that multiple ids are a mess, and that ideally, we'd be able to develop one LTI tool that would work for all consumers. Certainly that is the goal. However, in cases where what you want to do is outside the LTI specs, you're into developing separately for each API anyway, so having the custom_canvas stuff is okay. 

I realize that for some apps, you could do everything within the LTI specs if only the rostering were supported, so that is a frustration point when developing for Canvas. I'm hopeful that at some point that aggravation is going to go away, but it's not a huge issue for me, because I don't currently have any apps that use the API solely for roster access. Maybe that's just because once I have a token, I tend to start piling on features, but I don't think so.

Becky Kinney

Academic Technology Services

Project Blog