Allow users of the LTI provider plugin to also provision Hypothesis accounts

[SteelWagstaff]

Feature Description

Many Pressbooks users want to use Hypothesis to allow readers to create (and view) open web annotations on public webbooks. Many of these users would like to use a user's university credentials to create and provision an account not just for Pressbooks, but also for Hypothesis when an LTI link is successfully launched to a Pressbooks webbook from within a learning management system. Hypothesis has built a reference implementation to allow third-party tools to create and manage user accounts. We would likely need to adapt it to a WordPress/Pressbooks-specific environment, and "auto-provision H users in a 3rd-party authority." See Jon Udell's comments or the larger thread for more context on the state of the possible.

Feature Use Case

Anyone interested in using our LTI provider plugin alongside of the Hypothesis annotation tool. Interest in this use case is high among academic institutions.

Other Notes

See https://github.com/hypothesis/product-backlog/issues/718 for a conversation about this functionality in the Hypothesis GitHub repo and https://docs.google.com/document/d/1HtqHkrqE81OuFzRxv68qG_GZUrAzri7dZ4Zy3rL9up0/edit# for a prose description of some of the issues/desires involved here from Nate Angell at Hypothesis.

[SteelWagstaff]

@judell wrote me on 7.12.19 to say: "We've long imagined provisioning Hypothesis users directly from the WordPress user table, and logging them in automatically when serving the Hypothesis client using our plugin. Here's a proof of concept: http://jonudell.info/h/wordpress-thirdparty-01.mp4. It uses a PHP variant of the "3rd-party" mechanism that elifesciences.org are using: https://github.com/hypothesis/publisher-account-test-site. ... We'd like to know whether this looks interesting to Pressbooks"

[SteelWagstaff]

Dac and Steel met with Jon Udell on 7.23.19 and learned more about current functionality/possibilities for provisioning third-party Hypothesis users from the shared WordPress users table used by Pressbooks and other WordPress multisite installations. As we understand it, these third-party provisioned accounts currently have some limitations, namely, 1) they cannot be connected/linked to first-party accounts, 2) they are placed into a site specific 'authority' which is the only layer that their account is able to view/create annotations. These third-party accounts cannot annotate on the public layer, or be added to 'normal' private groups, for example.

Jon did note, however, that multiple private groups could be created within this site-specific 'authority,' and that each of these could be made available to the various third-party created accounts. See

Jon writes: "You can try this yourself at h.jonudell.info. The administration of this group creation is not yet self-serve, and would need to be at scale."

At Pressbooks, we'd be most interested in using in using this together in conjunction with our LTI provider tool (i.e. provisioning third-party hypothesis accounts for teachers/students when then launch a Pressbook chapter with annotation turned on from an LTI link within their LMS). For this to be of use, students/teachers would need to be able to segregate their annotations within private groups for each class (so that annotations from other third party users were not visible to them). If this group provisioning/assignation could be done automatically/intelligently (like the Hypothesis LTI app), that would be ideal. The second thing that would be important for us here would be making sure that instructors could copy top-level annotations they'd made from private group to private group each semester (as they can now do with @judell's copy annotation tool: https://jonudell.info/h/CopyAnnotations/).

[judell]

If this group provisioning/assignation could be done automatically/intelligently (like the Hypothesis LTI app), that would be ideal.

Agreed. That will require new (and currently unplanned) dev work. The solution I've shown you doesn't, it's just a variant of the Hypothesis WP plugin. Is that solution, with the group model I've shown you, enough to warrant a pilot project that could make the case for investing in new core dev work?

making sure that instructors could copy

That's doable.

[judell]

Does your LTI provider currently use Pressbooks in a way that creates separate contexts (groups?) for different courses (or sections) using the same text? If so, how does that work?

[SteelWagstaff]

No it does not. In most cases, the text in question is already openly available, so the LTI provider is simply providing access to the open text within an iFrame inside the LMS. We also provide the option to remove our native book navigation tools (hide CSS), so that chapters become autonomous units and the LMS navigation is the only way to move around. When private content is loaded via LTI, we automatically create a Pressbooks account for the user launching the link via LTI (or match them with an existing account), and then provision their role access based on rules set at the book level, so that they have the necessary permissions to view 'private' content. In most cases they're given what WordPress calls the 'subscriber' role within the book in question. No matter what LMS or course the user accesses the LTI link from, users are all given access at the book level in Pressbooks, without any indication of origin (so no info about which LMS or which course in the LMS the LTI user came from is sent to or stored by Pressbooks).

[judell]

So per-course annotation groups could/should be handled in the WordPress/Hypothesis plugin?

If so, would it be possible (in theory) to pilot the use of an SSO-enabled WordPress/Hypothesis plugin with group admin done by us manually at first, in our backend, then later by the WP admin in plugin config?