General LTI 1.3 documentation: user management

Learning Tool Interoperability (LTI) is a standard to make the workflow of your assignment administration more efficient. One of the purposes of LTI is to automatically provision users in Ans. In other words: you do not have to create accounts manually as the integration will take care of this.

When you use an LTI integration, a link is created between the Learning Management System (LMS) and Ans. When a user clicks on an LTI link, a request is sent to Ans. In this request, Ans receives the following attributes in the backend. Some attributes are visible in the interface, but some of them are not. These are saved in Ans and are used in the backend.

• LTI Integration ID (not visible in Ans)
• LTI User ID (not visible in Ans)
• Given name of the user (visible as first name in Ans)
• Family name (visible as last name in Ans)
• Email (visible as email address in Ans)
• Role (visible as role in Ans, can be either student or staff)
• Person Sourcedid (visible as student number in Ans)
• Optional custom attribute: "student_number" (visible as student number in Ans)

If a user is trying to login to Ans by clicking on an LTI link, Ans is using different steps to check if a user already exists. If the user does not exist, then Ans will provision (create) the user. If the user does exist, the user information will be updated. In the following list of steps, there are multiple moments when Ans tries to create a new account or tries to match information with an existing account. The following two guidelines can be taken into account if this happens:

• If the user role in the LMS is not a student, but for example Instructor, Administrator or any other non-student role, Ans will give the school role 'Staff' to this user. The attribute 'Persons Sourcedid' and the optional custom attribute "student_number" are ignored.
• If any non-numerical values are present in the custom attribute "student_number", they are removed, leaving only numerical values.

Creating a user

Once a user clicks the LTI link, the following process steps are initiated:

1. When an LTI request is made from the LMS to Ans, an encrypted message is sent which contains the course, assignment and user information. If Ans does not receive this encrypted message, an error message stating "Missing platforms' identifier token" will be shown.
2. Based on the LTI Integration ID, Ans attempts to find the correct school. If the correct school is found then Ans will match or create the user in that school. If the school is not found, an error message stating "Forbidden" will be shown. 
3. Ans attempt to decrypt the attributes sent from the LMS containing the course, assignment and user information. If Ans is unable to decrypt the attributes an error message stating "Unable to decrypt message" will be shown. This usually happens when the integration has been incorrectly configured.
4. Ans attempts to match the user with the LTI User ID. The matching is successful if the user has used an LTI link before, as this is the only way the attribute is filled in Ans. If an existing user is found, then the given name, family name and email address are filled or overwritten.
5. If the LTI User ID cannot be found, this means the user has not used an LTI link before. In that case, Ans attempts to find the user based on the student number. Ans will check the optional custom attribute "student_number" first. If that field is not filled, Ans will check the person sourcedid attribute. If this attribute is found, Ans will fill or overwrite the given name, family name and email address. Additionally, Ans will fill the LTI User ID field.
6. If no user is found based on one of the student_number attributes, Ans tries to find a user based on the email. If a user is found, then the given name and family name are overwritten. Additionally, Ans will fill the LTI User ID field.
7. If Ans is unable to find the user based on the LTI User ID, student number or Email, then Ans creates a new user.

After matching or creating an account, the user is redirected to Ans. Students will be directed to the page where they can start the assignment. Staff members are redirected to the page where they can edit the digital test.

Below, you can find a visual of the process including errors that might appear during the process.

Provide a course role for users

As described in the roles article of Ans, there are school roles, course roles and question bank roles. Above, we have described that a user receives the school role 'Student' or 'Staff' in case the user does not exist yet. Ans is using the LTI 1.3 Names and role provisioning service to provide course roles as well. Depending on the role that the user has in the LMS, Ans will provide the course role for that user. Currently, there are two options for users. We first check whether the user has one of the following roles in the LMS: Instructor, Administrator, Content developer, Staff, Faculty or Mentor. If this is the case, the user will be assigned the role Instructor in the course. If the user has another role, they will be assigned the course role Learner.

error_outline At this moment, Ans does not take any settings into account regarding the employee privileges, student privileges or custom roles. The rules mentioned above are always applicable.  

error_outlineProvisioning via LTI can be used to add users to a course and a test. It cannot be used to create groups within a course.