Permissions vs. role sent over LTI

[judd]

I'd like to find out how Canvas roles/permissions affect the "roles" value sent to the LTI provider when an LTI link is opened from a Canvas course. For example, I'd like to know how it might be possible to control whether the "TA" role, or custom roles derived from it, sends "instructor" in the LTI roles parameter. Is there a default matrix of which Canvas roles map to which LTI roles ("student" or "instructor" vs. anything else)?

I am working with a publisher that makes its products available via LTI. I don't have administrative access to a full Canvas "account" instance in which I can test this myself.

[Renee_Carney]

 @judd ​

Our Community Team is reaching out to some of our LTI experts to get you an answer on this.  Thank you for your patience! 

[kenneth_larsen · Accepted solution]

 @judd , Canvas does not lump a "TA" and an "Instructor" together. Each role is identified and passed through the LTI launch. There are two POST values that are sent along with an LTI tool that list information about a user's roles: ext_roles and roles.

Each user type will result in the following being present in the ext_roles value:

urn:lti:instrole:ims/lis/Student,urn:lti:sysrole:ims/lis/User

In addition, here is how the various roles are posted to the LTI in these two fields:

Role	Role as posted in ext_roles	Role as posted in roles
Student	urn:lti:role:ims/lis/Learner	Learner
Teacher	urn:lti:role:ims/lis/Instructor	Instructor
TA	urn:lti:role:ims/lis/TeachingAssistant	urn:lti:role:ims/lis/TeachingAssistant
Designer	urn:lti:role:ims/lis/ContentDeveloper	ContentDeveloper
Observer	urn:lti:role:ims/lis/Learner/NonCreditLearner	urn:lti:instrole:ims/lis/Observer

If a user has multiple roles in a course, than they will be added together. From what I understand, custom roles within Canvas are not set to pass automatically through an LTI launch. There is a way that they can be passed using the custom fields portion of LTI, but I have not played with it yet so I cannot explain how at this point.

Hopefully that helps clarify things for you.

[judd]

Kenneth:

Thanks so much for the helpful table and the reminder about the ext_roles variable. I'll explore what that shows for the custom role. Hopefully the Canvas folks will also come back with info on the custom situation.

[ldprogrammers]

Why wouldn't the TA and Observer roles under the Roles be the same format as the other roles?  See the last column of the above table.  It is easy for us to grab the Learner, Instructor and Designer roles.  But the others require a little more code.

[kenneth_larsen]

That is a great question to which I do not have an answer. My solution is usually to see if the field contains the role name I am looking for because then it doesn't matter whether the role begins with "urn:lti:role:ims/" or what other roles a user may have.

[daniellopez1]

Looking for the same

Are this still current? What about admin role?

Anyone knows more about custom roles?

[pklove]

You might find the $Canvas.membership.roles variable useful (see LTI Variable Substitutions )

It passes the roles as Canvas values, eg., TeacherEnrollment, StudentEnrollment and if you are an admin I think "Account Admin" gets passed as well.

Admins also show in roles and ext_roles as urn:lti:instrole:ims/lis/Administrator

[matthew_buckett]

To be more explicit the $Canvas.membership.roles will pass across custom roles. So if you have a custom role based on Teacher called Course Manager anyone who has the role Course Manager in the course will have the value "Course Manager" in the $Canvas.membership.roles expanded variable.