Add course-level & account-level permissions for LTI installation

[stevenwilliams]

  This idea has been developed and deployed to Canvas

         

  Idea open for vote Wed. August 3, 2016 - Wed. November 2, 2016  Learn more about voting...

Currently, all users with editing access to a course site (via the course-level and account-level "Manage all other course content" permission) have the ability to install a third-party LTI tool within a course. This setting bundles together Modules, Collaborations, LTI, Home Page, Chat, Attendance into a single permission.

Unlike all the other content types included in this permission, which are all native to Canvas, LTI tools have the ability pass through a great deal of student data to a third-party site. This can create legal risks around FERPA and other laws related to student records and privacy.

Currently, some universities use Javascript in order to suppress the options to add an external app when a page is rendered within Canvas. However, this does not have any impact on a user's ability to add an LTI tool, and they can still do so via workarounds including importing a course archive that already has the tool enabled.

Adding granularity to this permission would allow institutions to better fulfill their obligations to protect the privacy of student data, and make decisions locally about who should have the ability to install tools that pass student information outside of Canvas.

  Comments from Instructure

For more information, please read through the Canvas Production Release Notes (2016-11-19)

[cward]

I love this idea, and am totally on board with this. However, the team has no capacity to take on additional work in the next 6-9 months. We'll be moving this to Product Radar. Thanks for taking the time to suggest on vote on this idea!

[Renee_Carney]

  This idea has been developed and is On Canvas Beta How do I access the Canvas beta environment?

For more information, please read through the Canvas Beta Release Notes (2016-11-07)

We also encourage you to take a few minutes to join the Beta Release (2016-11-07) Collaborative Chat and learn with your community!

[Renee_Carney]

 @stevenwilliams ​

Would you please take a look at the Release Notes > Permissions​.  We're pretty confident that this new release only addresses part of your idea, but we want to check with you.  Does this meet your needs, or do you want to submit a new idea for the remainder of your needs?

[stevenwilliams]

Hi  @Renee_Carney ​ -- this looks like it fulfills my request! I'll post a new feature request and refer back to this one if we uncover anything that's missing as we look into implementation of this new permission.

[Renee_Carney]

Awesome!  Thank you, Steven!

[Renee_Carney]

  This idea has been developed and deployed to Canvas

For more information, please read through the Canvas Production Release Notes (2016-11-19)

[Renee_Carney]

Thank you to  @stevenwilliams  for submitting this idea, as well as, stefaniesanders​,  @mark_b_jones ​,  @kmeeusen ​,  @dsheryn ​,  @brent_shaw ​,  @tbunag ​, chriscas​,  @John_Lowe ​,  @ronmarx ​, &  @mary_speight  for your contributions. Your investment in this idea helped refine a feature which is now part of Canvas!

[mary_speight]

I've disabled the "LTI add and edit" permission for all users except account admins, however they still can add "apps" to their individual courses. It didn't really seem to do much. I would have preferred to have that option removed completely.