Student identified as other student when clicking LTI-link

[Spruce8913]

During a last exam, a student (student 1) was using someone else's laptop and was accidentally identified in their Numbas attempt as that other person (student 2). Is it possible to be identified as someone else, if another browser session is still open with the other person logged into the LMS? I manually verified and saw that in the open browser, they were logged into our LMS as student 1, but when clicking the numbas lti link, it still came through as student 2.

Related: How can I now adjust our grading without a "dummy test" in our LMS? Because student 2 has 2 attempts, and student 1 has no attempts. (Note, we use separate LTI links in the LMS as the huge group is split into parts; the two attempts I am talking about are not on the same LTI link)

[christianp]

When you open a Numbas LTI link, it should authenticate you using whatever user details the LMS sent. So even if they were previously logged in as student 2, they should present as student 1 to the Numbas LTI tool.

Are you absolutely sure that they were acting as student 1 when they clicked the link?

If this sequence of events happened, then they'd be acting as student 2:

• log in as student 1
• navigate to a page containing a Numbas link
• in a new tab, log in as student 2
• switch back to the first tab, without reloading it
• click the Numbas link

After logging in as student 2, their browser's cookie would use that on any subsequent page loads. It doesn't matter that the page with the link was loaded when they were student 1.

To fix the problem you have at the moment, if you have access to the command-line on the Numbas LTI server, you could reassign one attempt to student 1, then click the "report scores back to the VLE" button.

[Spruce8913]

Dear Christian

It's definitely possible multiple tabs with different students logged in were open. I will be sure to check this in case of issues like this. Unfortunately, I already deleted their attempt... Is there another way to report their score back to the LMS? I would prefer modifying it in the Numbas LTI provider, than making a dummy test in the LMS just for their score.

[christianp]

I don't think there's a way to set a score in the Numbas LTI provider without an associated attempt.

Deleted attempts are kept in the database - if you can run python manage.py shell on the command-line, try this:

First, get the pk of the resource: it's the number part at the end of the URL when you're looking at the resource, which has the form resource/<resource_pk>/.

Then, in the Python shell, run:

from numbas_lti.models import *
user = User.objects.get(first_name='...', last_name='...')
for a in Attempt.objects.deleted().filter(user=user, resource=resource_pk):
   a.deleted = False
   a.save()

[christianp]

@Spruce8913 can I close this issue?

[Spruce8913]

Yes, although I must be honest: I did not try the suggested python shell approach but just manually replaced the score in our internal grades spreadsheet