Names and Role Provisioning Services (NRPS)

Notice: This feature is required to apply for the 1EdTech LTI Advantage certification of ILIAS as LTI Tool. "LTI Advantage Complete" requires LTI 1.3 Core and all three LTI Advantage services: Deep Linking, Assignment and Grade Services, and Names and Role Provisioning Services.

1 Initial Problem

LTI launches tell each side only about the user who launches. An external tool in ILIAS does not know the other members of the course, and ILIAS as a tool does not know the members of the course at the platform until each one launches: an instructor cannot prepare anything for learners who have not entered yet.

2 Conceptual Summary

3 User Interface Modifications

3.1 List of Affected Views

3.2 User Interface Details

Both forms get the checkbox "Names and Role Provisioning Services", for LTI Advantage only and off by default, also for existing tools and platforms. When a tool registers in ILIAS through Dynamic Registration, the checkbox is set if the tool asks for the service.

3.3 New User Interface Concepts

None.

3.4 Accessibility Implications

None. The checkboxes are KS elements.

4 Additional Information

4.1 Involved Authorities

Authority to Sign off on Conceptual Changes: Díaz, Saúl [sdiaz]
Authority to Sign off Code Changes: Díaz, Saúl [sdiaz]

If this request is related to multiple components, please list both authorities for all related components.

4.2 Technical Aspects

4.3 Privacy

As Platform, the tool receives each member as a launch would describe the user, under the same privacy settings of the tool ("User identification", "User name"). With a random user id per object, only members who launched the object are listed. ILIAS stores nothing for it.

As Tool, ILIAS creates an account for each active member without one, with the user id, name and email the platform sends, even for members who never launch ILIAS. This is why it has to be activated per platform.

The data is described in the PRIVACY.md of the LTI component.

4.4 Security

As Platform, the list is only given to a tool with the service activated, with an access token of LTI Advantage for that tool, and only for a course or group that holds an object of that tool. It is read-only. As Tool, the list is read with an access token from the URL the platform gives in the launch, and only active members get roles, only those of the release.

4.5 Contact

Person to be contacted in case of questions about the feature or for funding offers: Díaz, Saúl [sdiaz]

4.6 Funding

Funding status and funding parties are listed in the block 'Status of Feature' in the right column of this page.

SURLABS funds this development in advance because it is needed for the maintenance and security of the LTI component and for the LTI Advantage certification. We expect to get funding from the community during and after the integration.

If you are interested to give funding for this feature, please get into contact with the person mentioned above as 'Contact'.

5 Discussion

Díaz, Saúl [sdiaz], 20 OCT 2026: The implementation is included in the LTI rework for ILIAS 12: https://github.com/ILIAS-eLearning/ILIAS/pull/12232. The pull request is open for review.

Díaz, Saúl [sdiaz], 23 OCT 2026: The pull request has been merged into trunk.

6 Implementation

Implemented by Saúl Díaz (SURLABS) as part of the LTI rework for ILIAS 12. The implementation is available in pull request #12232: https://github.com/ILIAS-eLearning/ILIAS/pull/12232. It was merged into trunk on 23 OCT 2026.

6.1 Description and Screenshots

Implemented in both roles as described in the Conceptual Summary. As platform, ILIAS provides the members of the course or group containing the LTI object, with role filtering and pagination. The data returned follows the privacy settings of the tool.

As tool, ILIAS retrieves the membership list when an instructor or administrator launches a released object. Active members without an account get one and receive the roles of the release. Members reported as inactive or deleted lose those roles; their accounts remain. Members simply absent from the response keep their roles.

NRPS is enabled independently for each tool or platform and is off by default for existing registrations. The two LTI Advantage forms provide the corresponding checkbox. No manual migration is required when updating ILIAS.

6.2 Test Cases

Test cases completed at 23 OCT 2026 by Díaz, Saúl [sdiaz]

C96430 : Names and Role Provisioning Services: members of the platform synchronised
C96431 : Names and Role Provisioning Services: suspended or unenrolled Moodle students keep their ILIAS membership
C96459 : Names and Role Provisioning Services: option off and on, privacy of members
C96458 : Service requests refused: no token, object of another tool, service not enabled

6.3 Privacy

The PRIVACY.md of the LTI component was updated on 20 OCT 2026 by Saúl Díaz. It documents the membership data disclosed by ILIAS as platform and the accounts created through NRPS when ILIAS acts as tool. The update is included in pull request #12232, merged into trunk on 23 OCT 2026: https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/components/ILIAS/LTI/PRIVACY.md.

6.4 Approval

The feature was accepted for trunk by the Jour Fixe on 19 OCT 2026 (see Discussion). Approval of the delivered implementation has not yet been recorded.