SSO with SchoolTool development question

SSO with SchoolTool development question

Matt Oquist -
回帖数：4
Hi. I intend to start writing code in the next couple of weeks, and I have some ideas to present for consideration.

The way mnet auth works now, you need to jump to the subscriber system in order for your account there to be created. When you're working with an SIS, it's quite possible that you want all your accounts to go from one system to the other regularly...it's no good being unable to assign your students to courses until they've each bothered to log in to the system, for example.

The client who's funding this integration wants Moodle's casual student-driven enrollment system to continue driving their enrollments, so version 1.0 of this integration will basically push the user directory, all enrollments, and grades from Moodle to SchoolTool. This means I need a cron-driven update to make sure SchoolTool is up-to-date.
  1. I [believe I] need a representation in the Moodle DB of the state of the integration as understood by SchoolTool. That way I can avoid regular redundancy in mnet calls, and only send new or updated user info (for example) when I know something has changed in Moodle that we haven't successfully sent to SchoolTool yet. This means I need to create one or more tables that will be managed by auth/mnet. These tables will need to contain basically everything that's getting sent to SchoolTool, or at least a primary key for each sent row and an md5sum of what was sent (so I can tell when updates are necessary).
  2. auth/mnet/auth.php has a cron() function, but I need it to do things like ensure the other side has all the latest updates. It seems that for each user needing to be updated in SchoolTool, this cron() function could call an mnet interface in SchoolTool that tells SchoolTool to pretend a login session has been requested, so SchoolTool will then do the equivalent of confirm_mnet_session(), ask Moodle for the account info, and create the account.
The above seem to me like reasonable design decisions -- do others agree?

Thanks,
Matt
平均分： -
回复Matt Oquist

Re: SSO with SchoolTool development question

Matt Oquist -
Oh - for more info on the project, see this work-in-progress page: http://docs.moodle.org/en/Development:SchoolTool_Integration
平均分： -
回复Matt Oquist

Re: SSO with SchoolTool development question

Anthony Borrow -
Core developers的头像 Plugin developers的头像 Testers的头像
Matt - Keep up the good work with the SchoolTool integration. You (and others) may also be interested in the OpenSIS Integration work that I have been trying to guide. Hopefully there can be some synergy between the two integration projects. Let me know how I can be supportive. Peace - Anthony
平均分： -
回复Matt Oquist

Re: SSO with SchoolTool development question

Penny Leach -
Hi Matt,

Can you give me a bit more of an idea about exactly what data you're going to need to represent integration state in the Moodle DB?

As to your second point, that does seem like a slight limitation of mnet. I know that this doesn't help your implementation on 1.9 but maybe that is something that could be addressed in Moodle 2.0 with the mnet refactor or whatever is going to happen?

Mocking a login request seems a bit hacky, but I guess there's no other way to do it right now. I guess you don't really want custom mnet extensions at the moment.

Cheers
平均分： -
回复Penny Leach

Re: SSO with SchoolTool development question

Matt Oquist -
Hi Penny,

Thanks for your thoughts.

I guess I'm really picturing something similar to the external DB auth & enrolment plugins, except that 1) in this case the external DB is replaced by a set of internal tables managed by these plugins we're building, and 2) in this case all the transfer of data to/from those tables is handled by MNET. (So the data I'm planning to represent internally will basically be what you would typically store in one of those external DBs.)

Of course with integration v1.0 we're only integrating Moodle-->SIS instead of allowing the administrator to choose which way the data flows, but my idea is to create similar functionality to the "external DB" plugins while using an easily-configured MNET communication channel between the systems.

I agree about the hackiness of waving at SchoolTool over and over ("Hey! Why don't you ask me about 'jjohnson'? Hey! Ask me about 'trobinson'! Yoo-hoo...ask me about 'msmith'!!!!"), but as long as that doesn't raise big red flags as being a horrible idea for now, we'll head that direction in the interest of avoiding premature optimization.

Cheers,
Matt
平均分： -