Requirement: Anonymous ID linked to the campus LMS identity.
This requirement implies that we may need to create a second type of user in edX. A user who signs up through the edX registration process has at minimum the following attributes:
- Email address
- Full name
- Public user name
- Country
- Password
The user has also agreed to the T&C and the honor code.
A user who enters the edX site through LTI is not guaranteed to have any of these things. There are no required user-specific attributes in the LTI 1.2 spec (even the user ID is only recommended). We can of course require a minimal set before we will allow a user to access edX (see the LTI launch page), but since one of our other requirements is to allow for a launch with no Personally Identifiable Information (due to various national privacy laws), we can be certain that there are circumstances in which we will not have this information available.
Our LTI users will either have some empty attributes or some automatically generated. In either case, we will have to figure out where the existing edX code assumes that a user has a particular attribute and make sure that it will continue to work properly without one. An example would be the discussion forums - if our user has no public user name, we must either ensure that we have a generated user name (which wouldn't be particularly useful to forum viewers), or make sure that the code can handle an empty user name.
Topic: Defining a unique login ID (e-mail) for an LTI user
LTI provides us with a user identifier that is determined by the tool consumer. Per the LTI spec:
Uniquely identifies the user. This should not contain any identifying information for the user. Best practice is that this field should be a TC-generated long-term “primary key” to the user record – not the “logical key". At a minimum, this value needs to be unique within a TC.
Since we will eventually have multiple campus systems
One user, multiple campus systems
Cookie issues:
- User has an existing cookie on LTI launch. Do they get logged out? Merge accounts? May not want to.
- User logged in anonymously via LTI. Next time they visit edx.org will they automatically log in?
- Cookie from campus system A, visits using campus system B.