Masquerading to Test LTI Tools

I developed an LTI tool and tried to masquerade as a Teacher to test the tool, but Canvas gave me the following error.

masquerade issue

Is there something special that I need to do to allow my tool work when masquerading? It looks like it has to do with using a developer key to generate an oauth token, but I'm not sure how to get oauth to work when masquerading or to get my tool to identify when the user coming from Canvas is masquerading.

Find more posts tagged with

Accepted answers

All comments

unknown

Hi @jloiacon ,

I will admit I don't have any experience with developing LTIs, however I can offer some advice on what we did for this. I had always assumed that this was a feature within Canvas (i.e. ensuring someone masquerading could only do so within Canvas, and not other tools). I anticipate this is due to auditing information being readily available within Canvas, however the external tool would only see what looked like the original user, hence could become an auditing risk.

The way we have bent around this is by creating a small number of 'testing' accounts that we can issue out temporarily on an as-needed basis to academics and learning designers to test functionality where the student-view is insufficient.

As the testing accounts have an email address, this provisions a new account through to linked LTIs and therefore enables testing without the need for masquerading.

Is that something that might satisfy your use case?

Cheers,
Stuart

pklove

For the masquerade identifying, there are custom variables that can be used. For example, Canvas.masqueradingUser.id will give you the Canvas user id for the masquerading user.

See: LTI Variable Substitutions

pklove

Can you clarify the workflow and at which point you get the message? Does the LTI tool launch okay (it should) and then you get the message when attempting to obtain an access token using OAuth?

If its the latter, and given the message, it looks like you probably are simply not allowed to obtain a token when masquerading. That is, the only person who can authorise a tool to act as them for API calls using OAuth is that person, not a third party masquerading as them.

Unanswered Questions

Messaging Changes--- Suggestions for more streamlining
Hello, I was thinking of this a while ago and have been trying to message Canvas support about this but they suggested here but not which category. I apologize if this is the wrong spot. When messaging students right now we need to message one by one. I would like to know if there is a way we can change that to streamline…
Finding the LTIv1.3 IDs for Members of a Course
I'm building a tool for my institution that imports grades from another LTI tool into Canvas so instructors can automate late assignment policies not otherwise supported by Canvas. I'm trying to use the LTIv1.3 ID which is readily available on the LTI-side as a link to the student record on Canvas, but I can't find the ID…
Canvas Media Question
How can one track Canvas Media use without having the reports available from Canvas Studio? Checking API endpoints and the Data 2 schema, there do not seem to be dedicated Canvas Media endpoints. Am I missing some? A method I've considered is using the body field of the wiki_pages table, as this contains the html code of…
Canvas Catalog API - Completed Certificates
Hello, I'm trying to utilize an API call to pull completed certificates and was hoping to download and store the certs as a backup. I can successfully run the API call but it will not allow me to view the certificate unless I access the URL while signed into an account where it's "my" cert. Is there a permissions setting…
UI for weekly progression idea
UI for weekly progression idea that rest in the Schedule tab of the **K-12 UI** of Canvas it's incomplete and I really would not take it and push it into instance but I am going to post it here because in the past people like @James && @robotcars || @Steve_25 have had terrific input in the past... maybe w/their eyes and…