Canvas

Hello Everyone: I have IMSCC files that have LTI links that are actually LTI links to quizzes that are hosted in another Assessment Engine product outside of Canvas. When I import the IMSCC file into Canvas, the LTI links are importing fine as links in a module.  But in order to have the Assessment Engine post grades back to the Canvas Gradebook, I need to go through a series of steps to convert these "quiz" LTI links into Canvas Assignments.     I have upward of 500 of these type of LTI links to quizzes in a Course.   Converting these LTI links into Assignments is very, very  time consuming. My question is, in Canvas is there an easier way to convert these IMSCC LTI quiz links into Canvas Assignments so that my Assessment Engine will pass grades back to the Canvas GradeBook ? Any help would be appreciated. Thank you, Dan Giglio Ascend Learning Platform Manager ... View more

Hi all, I am attempting to link a rubric to several assignments on Canvas. However, we want to hide the points in the rubric from students. Is there a Canvas API to achieve this? On the GUI, this is accomplished by editing the rubric and by choosing "Remove points from rubric". This step needs to be performed for each assignment item. This change seems to affect the rubric_settings object of an assignment and sets its hide_points property to true. According to the rubrics API page, this option does not seem to be available via Canvas API. Am I missing something?  https://canvas.instructure.com/doc/api/rubrics.html Is there a way to set hide_points to true through the API? Thanks, Raj ... View more

Hey guys, I'd like to take a paginated list of users associated with my account filtered by enrollment type. With the REST API, I've been using /api/v1/accounts/:account_id/users?enrollment_type[]={type}. Could you please assist me to get the same result with your GraphQL API? Thanks ... View more

If you have arrived here from scratch, you may want to work through the first two parts of this blog and come back: https://community.canvaslms.com/groups/canvas-developers/blog/2017/04/04/net-oauth2-example?sr=search&searchId=4a493611-68d1-4f1a-bd15-d16b6ef27c59&searchIndex=0‌ https://community.canvaslms.com/groups/canvas-developers/blog/2017/04/07/net-oauth2-workflow-part-2?sr=search&searchId=16e54b41-d184-425f-84ff-0660e29a8405&searchIndex=2‌ At the end of .NET LTI Project - Part 2 - Launch Request we were authenticating and grabbing an access token for the logged in user.  But, each time the application was launched it was creating a new token, filling the user profile with multiple Access Tokens that would need to be manually deleted. This is messy, and for a user who keeps an eye on their profile will likely look suspicious.  So there are two possible solutions to prevent the build up of excess useless tokens: Take advantage of the "refresh token", and only ever create a single access token Delete the token each time a user session expires, or when the user exits your application The good news is, the heavy lifting is done.  Only some logic to be added to leverage the existing methods that we have already worked through. To follow along with this post, download the associated source code from this git branch: step2-token-refresh git fetch && git checkout step3-token-refresh Taking advantage of the refresh token If you users will be spending more than one hour at a time in your application, or if they will be leaving and coming back at a later date, refreshing the token you already have is something you should consider.  At the very top of the Canvas OAuth2 document, in a bright orange box, it clearly states that a token has a 1 hour life span, and refresh tokens must be used: Database Change For the sake of this simple demonstration project, I've added a field to the [accessTokenCache] table. In the SqlServer folder, execute the accessTokenCache.sql script to recrete the table with the new field. This is not the ideal place to store this value, in a live environment this would be an actual config varible.   However, this will allow the code in this part of the project to grab this value for you, for the sake of the exercise. Detecting the Existing Access Token The logic changes for this demo application to handle the token refresh is restricted almost exclusively to the HomeController.oauth2Request() method.  Storage and retrieval of the access tokens was included in .NET - OAuth2 Workflow: Part 2 - Access Token & State‌ Of course we are still validating the OAuth signature, to ensure the LTI launch request is coming from a valid source. Now, as soon as we validate the signature, we try to retrieve a previously stored token for the user. If we found a toke, we check the life of that token to see if it needs to be refreshed.  To handle this I added a simple property to userAccessToken:  tokenRefreshRequired If we have found an existing token, and it requires a refresh, we call our existing method: requestUserToken This time when we make the call we pass a different value for grantType:  refresh_token The existing logic will take over, and Canvas will return to you a new token. The user token can expire at any time during the use of your application, not just during the initial LTI launch.  Once the user has launched your application, your application will likely continue to make API calls to Canvas for specific information.  If the user stays active in your application for one hour or more, the token will expire on the Canvas server and you will need to refresh.  Each time you prepare to make an API call you need to check to see if the token has expired, and if it has you need to execute the token refresh logic. Scenarios to get you thinking about testing: Delete the access token in the Canvas user profile.  How do you want to handle that? Manually set the token timestamp in the database to force a token refresh.  Where in your application do you need to consider token expiration? Delete the access token from the database.  What affect does this have on the Canvas user profile? You can test this scenario with this simple demo application.  As your business logic becomes more complex you will need to consider handling this potential scenario in all appropriate places.   OAuth2 Logout If you want to delete user access tokens as you go, then you want your application to execute the OAuth2 Logout. This is how you clean up the list of your application tokens in the user profile settings. The sample application for this blog includes a simple "Logout" button and associated method to execute the logout API call.  This example also shows how to recover the LTI parameters from the database, where we stored them in the [stateCache] table. For purposes of a simple demonstration, the unique state id is stored on the client page in a hidden field named "stateToken".  The value of the "stateToken" is passed back to the client during validation, the submitted back to the server when the logout button is clicked.  Passing the state id in this fashion allows you to continue to track the client even when they have cookies disabled. Hidden fields are not necessarily the best way to do this, but is very easy for the purpose of this simple demo app. Do your own research on state-less applications and decide on what method is best for you. Closing Comments This three part blog should give you an overview of OAuth2, and hopefully help some get over the hump. If anyone has ideas to add, please comment and start a discussion. Keep in mind that this application is meant only as a deomonstration of how to execute the OAuth2 workflow.  As you develop your own applications, make sure you flush out your test scenarios and understand what the expected behavior is. ... View more

Original Post Disclaimer This is my second blog post to the Canvas Community, but I'm going to stick with my tl;dr format. The Situation Who doesn't like their code to be easier to read!? Oh, you use the Rich Content Editor (RCE)? Well, why are you in this blog? I see, you thought this was to add syntax highlighting to the content of an activity. Yeah...about that...no. I know there have been a few idea requests to add a syntax highlighter to the core of Canvas for supplying syntax highlighted code within the content of activities. While I have no doubt I could do this, I'm not going to. So what's this blog all about? The HTML Editor is SO boring! We load ~95% of our content via the HTML Editor, having written it in third-party applications (i.e., Notepad++), because the HTML Editor in Canvas isn't particularly inspiring, nor is it easy to read. Reason for Creating Simply put, I did this to allow our developers to more easily read the code from within Canvas. There really isn't anything more to it. The Solution A userscript the "replaces" the HTML Editor with an Ace Editor (https://ace.c9.io/) and utilizes JS-Beautify to "beautify" the HTML in the editor. So, without further ado, the Q&A: Q: What does this userscript do? A: Simply put, it "replaces" the HTML Editor provided by Canvas with an Ace Editor. Q: Why did you put "replaces" in quotation marks? A: Ah, the long answer. The userscript doesn't actually change any of the Canvas functionality. What it actually does is to hide the HTML Editor and add the Ace Editor to display in its place. When changes are made via the Ace Editor and the user clicks out of it (i.e., to see the Rich Content Editor or save), the HTML Editor is updated with the code from the Ace Editor and Canvas processes it normally. Q: Will the syntax highlighter always be enabled? A: It can be. The userscript adds a toggle anchor to the line immediately above the editors where the toggle between editors is. This will allow you to enable/disable the syntax highlighter. Q: Will it remember if I had it enabled or do I have to enable it every time? A: It will remember. The userscript uses cookies to remember the state of the toggle. This means you could enable it while working in one assignment and it will already be enabled when you open a discussion in another course. Q: What about multiple Canvas instances? I want it to be enabled in one, but not another. A: It will! Rather, it should! I configured the userscript to use the very first part of the domain name it's toggled on to give it a unique name for the instance. I haven't tested it on different Canvas instances, but if I did everything correctly it will create unique toggle cookies for each unique Canvas production instance. Q: You just said it was for "production" Canvas. Why can't I use it for "Test" or "Beta" instances? A: You can. Taking the entire previous answer to give context, I said that there would be unique cookies based upon the first part of a domain name. So, if your production URL is https://abc123.instructure.com/ with a test URL of https://abc123.test.instructure.com/, your cookie will be the same between the two: abc123_Canvas_syntaxHighlighter. Q: Can I integrate this into my global JavaScript? A: Knock yourself out, but I won't be supporting that. Q: Can I use this in German? Japanese? Italian? A: Yes? There are a few settings that can be adjusted at the top of the script (keep an eye out for the "DO NOT EDIT BELOW" line). Included in this area are variables for adjusting to different languages. These will need to be manually adjusted if your Canvas is not in English. Q: Can I use this with a self-hosted instance? A: Yes? I won't commit that it'll work, but if you update the userscript @include and @exclude values to match your actual domain, I don't see why it wouldn't. Having said that, I will not support use of this code for self-hosted instances. Q: Will it work with the #editor_tabs for inserting links, files, and images? A: No. To be blunt, the functionality of the #editor_tabs has always been a bit "wonky" for me, so I'm not even going to try to make this new editor work with it. You can, of course, toggle the editor on/off or switch back to the Rich Content Editor, make your inserts, then toggle back. Q: So, it adds this to ALL editors in Canvas? A: No. For simplicity only the first editor on a page will have the editor applied (so it won't be available to quiz questions). Furthermore, there are some editors (i.e., global announcements) that lack the HTML Editor, which the script is dependent upon. Having said that, the userscript was designed to be as inclusive as possible. If, however, you do find pages where the editor doesn't work correctly, please let me know so I can either fix it or prevent it from loading there. Q: Does it support the new RCE? A: Yes. Dependencies Userscript Manager Tampermonkey (Chrome) Tampermonkey (Firefox) Greasemonkey (Firefox) How It Works Load the userscript to your Userscript Manager of choice Enable the userscript   If you're using the "old" RCE, access the "HTML Editor" of an activity edit page If you're using the "new" RCE, access the "Switch to raw html editor" of an activity edit page   If you're using the "old" RCE, click the "Enable Syntax Highlighter" anchor right next to the toggle that allowed you to access the HTML Editor If you're using the "new" RCE, click the toggle that appears next to the "Switch to rich text editor" button Appearance BEFORE AFTER Releated Ideas/Discussion https://community.canvaslms.com/ideas/2274 ... View more