Bb Ally with Canvas--permissions and known issues

[james_umphres1]

Hi everyone,

I've had Ally installed in my instance of Canvas for about one year but only recently enabled it for all courses. Last week I noticed that it had been mysteriously disabled. Which lead me to the realization that all low-level subaccount administrators have access to the main Ally Configuration. My school has about 150 subaccounts and 40 subaccount admins who have ability to search courses in their account and do some simple admin tasks. I searched each one of those users' access logs for evidence of Ally-fiddling but found nothing. I'm quite certain I was looking for the right activity.

So I have two questions:

Has anyone experienced a spontaneous disabling of Ally in canvas?

Do you have any recommendations about permissions? I can't see a way to restrict access to Ally Config... Perhaps editing javascript to hide the link from those roles. Otherwise the admin permissions are too broad.

Thanks for any insight

[mlewis23]

We just found this issue out as well. Appears that any account level user can turn Ally on/off for all courses. Have you found any solution yet?

The 'Turnitin Admin Settings' lti has similar issues.

We are exploring the javascript options. But honestly, that's a bad solution and a last resort since it is only hides it from the browser and doesn't address the real issue of access.

Looked into the xml config settings, but have only found a way to limit to 'admin' which is what it already is doing of course.

[kfullman]

I also just noticed this. All of our subaccount admins now have access to the Ally configuration tab. This is an issue for us because we have around 40 admins with limited permissions who could easily disable or enable courses in Ally.

[rkahn]

I now see the same issue with Turnitin Originality Admin Settings -- the most restricted admin permissions still allow access.  So who has to fix it -- the 3rd-party vendor or Canvas?  TII at least may be more motivated to fix it than Blackboard.