cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
judd
New Member

Permissions vs. role sent over LTI

Jump to solution

I'd like to find out how Canvas roles/permissions affect the "roles" value sent to the LTI provider when an LTI link is opened from a Canvas course. For example, I'd like to know how it might be possible to control whether the "TA" role, or custom roles derived from it, sends "instructor" in the LTI roles parameter. Is there a default matrix of which Canvas roles map to which LTI roles ("student" or "instructor" vs. anything else)?

I am working with a publisher that makes its products available via LTI. I don't have administrative access to a full Canvas "account" instance in which I can test this myself.

Tags (3)
1 Solution
kenneth_larsen
Community Champion

 @judd , Canvas does not lump a "TA" and an "Instructor" together. Each role is identified and passed through the LTI launch. There are two POST values that are sent along with an LTI tool that list information about a user's roles: ext_roles and roles.

Each user type will result in the following being present in the ext_roles value:

urn:lti:instrole:ims/lis/Student,urn:lti:sysrole:ims/lis/User

In addition, here is how the various roles are posted to the LTI in these two fields:

RoleRole as posted in ext_roles Role as posted in roles
Studenturn:lti:role:ims/lis/LearnerLearner
Teacherurn:lti:role:ims/lis/InstructorInstructor
TAurn:lti:role:ims/lis/TeachingAssistanturn:lti:role:ims/lis/TeachingAssistant
Designerurn:lti:role:ims/lis/ContentDeveloperContentDeveloper
Observerurn:lti:role:ims/lis/Learner/NonCreditLearnerurn:lti:instrole:ims/lis/Observer

If a user has multiple roles in a course, than they will be added together. From what I understand, custom roles within Canvas are not set to pass automatically through an LTI launch. There is a way that they can be passed using the custom fields portion of LTI, but I have not played with it yet so I cannot explain how at this point.

Hopefully that helps clarify things for you.

View solution in original post

8 Replies
Renee_Carney
Community Team
Community Team

 @judd ​

Our Community Team is reaching out to some of our LTI experts to get you an answer on this.  Thank you for your patience! 

kenneth_larsen
Community Champion

 @judd , Canvas does not lump a "TA" and an "Instructor" together. Each role is identified and passed through the LTI launch. There are two POST values that are sent along with an LTI tool that list information about a user's roles: ext_roles and roles.

Each user type will result in the following being present in the ext_roles value:

urn:lti:instrole:ims/lis/Student,urn:lti:sysrole:ims/lis/User

In addition, here is how the various roles are posted to the LTI in these two fields:

RoleRole as posted in ext_roles Role as posted in roles
Studenturn:lti:role:ims/lis/LearnerLearner
Teacherurn:lti:role:ims/lis/InstructorInstructor
TAurn:lti:role:ims/lis/TeachingAssistanturn:lti:role:ims/lis/TeachingAssistant
Designerurn:lti:role:ims/lis/ContentDeveloperContentDeveloper
Observerurn:lti:role:ims/lis/Learner/NonCreditLearnerurn:lti:instrole:ims/lis/Observer

If a user has multiple roles in a course, than they will be added together. From what I understand, custom roles within Canvas are not set to pass automatically through an LTI launch. There is a way that they can be passed using the custom fields portion of LTI, but I have not played with it yet so I cannot explain how at this point.

Hopefully that helps clarify things for you.

Kenneth:

Thanks so much for the helpful table and the reminder about the ext_roles variable. I'll explore what that shows for the custom role. Hopefully the Canvas folks will also come back with info on the custom situation.

Why wouldn't the TA and Observer roles under the Roles be the same format as the other roles?  See the last column of the above table.  It is easy for us to grab the Learner, Instructor and Designer roles.  But the others require a little more code.

That is a great question to which I do not have an answer. My solution is usually to see if the field contains the role name I am looking for because then it doesn't matter whether the role begins with "urn:lti:role:ims/" or what other roles a user may have.

Looking for the same

Are this still current? What about admin role?

Anyone knows more about custom roles?

0 Kudos

You might find the $Canvas.membership.roles variable useful (see LTI Variable Substitutions )

It passes the roles as Canvas values, eg., TeacherEnrollment, StudentEnrollment and if you are an admin I think "Account Admin" gets passed as well.

Admins also show in roles and ext_roles as urn:lti:instrole:ims/lis/Administrator

To be more explicit the $Canvas.membership.roles will pass across custom roles. So if you have a custom role based on Teacher called Course Manager anyone who has the role Course Manager in the course will have the value "Course Manager" in the $Canvas.membership.roles expanded variable.

0 Kudos