I am currently using the LTI authenticator with our LMS, and now I want to report back scores. It seems there is no easy way to access the LTI “session” from a server extension (e.g. lis_result_sourcedid), unless I am missing something.
Inspired by the suggestion here, I wrote a little bit of code that takes the LTI parameters from auth_state and injects them as environment variables into the user’s server. With this, I can access them from an extension, or even from a Notebook. Now my extension can post back the score to the LTI consumer.
I wonder if there is any interest in contributing the code that makes the LTI parameters available? I think it would make sense to put it in ltiauthenticator. But before I start cleaning my code up, I would like to get a bit of feedback. How should we store the parameters server side, what would be a good API to access them?
For example, I’m not sure keeping the parameters in environment variables is a good idea. I think it is OK because the user cannot get the LTI secret, so they can’t manipulate their scores, but maybe it is better to hide them. And LTI has a concept of sessions, so maybe it would make sense to store the current session on the server in a database. I am not sure what would currently happen if a users opens two different courses in different tabs. The database would also allow us to match an nbgitpuller invocation to a LTI session, so the user could go back later and submit the worksheets in any order. (This code would live in a separate extension, but access the mentioned API.)