05 June 2011, 18:34

Hello Andrew and Ruslan,

You may know that myportfolio.school.nz is a large Mahara site for use by schools in New Zealand. As we have schools from primary to secondary in it, the question about restricting access to certain items comes up in discussions. At first, Isolated Institutions had been seen as too restricted. Therefore, we will implement some changes that give an institution admin more control, e.g. limit the users in the sidebar "Online Users" to only their institution, make certain default settings for the user, but some schools may be interested in it.

Paul Seiler has the following questions for your proposed plugin:

• Can this functionality be turned on by role (e.g. on for students but left off for staff)?
• Could this functionality be turned on for some students, e.g. younger and left off for others, e.g seniors? There are schools that have grades 1-13.
• How does it apply to people belonging to more than one institution?

I think I can already answer the last question: It checks on all the institution settings.

Thanks

Kristina

06 June 2011, 3:38

Hello Kristina,

Not sure why you think that the current implementation of Isolated Institutions is "too restricted", it is restricted up to sensible level of isolation and pretty flexible (e.g. trust relationship between isolated and non-isolated institutions, etc.). The limit of users in the "Online Users" sidebar is already there - when isolatation is on, only users in this institutions (as well as users in institutions we have trust relationships with) will be listed in that block, the same implies to friends and group search. Anyway, regarding your questions:

> Can this functionality be turned on by role (e.g. on for students but left off for staff)?

Currently that is not implemented, but easily can be added.

> Could this functionality be turned on for some students, e.g. younger and left off for others, e.g seniors? There are schools that have grades 1-13.

That depends on how these groups of students are differentiated. If they are in different institutions, then it can easily be done.

> How does it apply to people belonging to more than one institution?
>I think I can already answer the last question: It checks on all the institution settings.

Yes, when you are trying to access some item that belongs to the user or group, it checks based on all institutions settings and use the least restrictive ones. e.g. if you are a member of two instiutions, you will be able to see users and groups in both of them as well as the users in all trusted institutions based on all institutions trust relations you are the member of. User can also be the member of isolated and non-isolated institutions at the same time.

Ruslan

06 June 2011, 14:43

Hello Ruslan,

Thank you for your answers.

>> Could this functionality be turned on for some students, e.g. younger and left off for others, e.g seniors? There are schools that have grades 1-13.

> That depends on how these groups of students are differentiated. If they are in different institutions, then it can easily be done.

This would mean a great administrative overhead as 2 institutions would have to be created. What would other possibilities be? A different role? Just an administrative flag?

Cheers

Kristina

06 June 2011, 17:10

It should be somthing that user would not be able to change. It indeed could be an "administrative flag" as you sugest. The role even sounds more appropraite, but we do not currently have role implementation as such, roles (not group roles) are currently more like flags rather than a nomnated set of rights. That is interesting idea actually, we may consider designing a proper roles-permissions mechanism for the specific groups of students isolation purpose which will be beneficial for Mahara in general.

06 June 2011, 20:19

Ruslan, the questions I asked and Kristina posted contained no criticism for the degree of restriction, rather questions as to how certain needs I think we have could be met. They mostly revolve around keeping the more vulnerable safer while allowing the less vulnerable more freedom. While role may currently be (almost) suitable to distinguish between staff and student it might not be so for younger cf older students. Likewise, trusted relationships between institutions, if applied to all users from each of the 500 institutions in MyPortfolio might prove to course a setting. Keen to hear how others think the right balance could be catered for.

Paul.

07 June 2011, 4:11

I did not get it as criticism at all . That is the interesting case you suggest to think about in fact. I vote for flexible roles mechanism design for this, then we could apply "isolation" to the role that will limit its visibility within institution.

Regarding the high number of trust relationships, not sure if I undestood you correctly, but "isolated" and non-isolated insitutions can co-exists, and even stay in trust relationships between each other (in which case isolated will only see the one it trusts, while that one will see all non-isolated plus isolated ones with trust relations established). If most of insitutions do not requre isolatation, just apply isolation to the small number and leave other institutions as normal (they will be able to see each other like it works in Mahara now). In addition to that, site admin has a handy tool to see who trusts whom (and even control this), so making sense of the trust relationships settings on the site with  the large number of insitutions is not complicated at all.

07 June 2011, 4:35

Hi Paul,

As Ruslan pointed out, there's currently no way of differentiating between different groups of students -- only between Institution administrators, Staff, and everyone else. The existing Groups functionality in Mahara is not suitable in this regard. User Groups are a vastly different beast and not currently in Mahara.

Without some form of user role management, there's no real way of giving different isolation between different sets of students. It should be possible to give Staff a greater degree of freedom than Students without too many modifications (I think), so if a roles system were added, it should also be possible to give some sets of users greater freedom than others.

Of course, as more role-control is added, it becomes harder to make the control of it simpler for institution administrators. This is something that we need to bear in mind for interface design. In the present implementation, we've opted for a more simplistic interface and what we felt was the most optimum solution given our user base at the time -- hence the current implementation is slightly restricted in this functionality.

After implementing this for schools in the North-West of England (~100 institutions IIRC), we found that only three schools actually set up a trust relationship, and only one school dropped out of the walled garden entirely. All other schools wanted to keep the barriers up. That said, we rolled out Isolated Institutions in our initial release of Mahara to these schools, so this was the first use for many of our users. It may be that as time moves on, and as both pupils and staff become more accustomed with Mahara, they'll want to drop the barriers a little more.

I think that the Isolated Institutions feature has some real potential for your installation from what you've said of it. The limiting factor and the main constraint stems from the lack of user role management within Mahara. If we can develop a useful mechanism for assigning roles to users then it should be possible to achieve what you're after.

Andrew

07 June 2011, 19:00

While I think having a role-based access control system in Mahara would be great, it's a really big piece of work.

The very nice and flexible system that Moodle has took a long time to implement (in 1.8) and then quite a bit of time to optimize and make scalable (1.9). Then a lot of time was spent improving its usability for 2.0 (backported to later versions of 1.9). All in all, it was a big task.

So I would personally suggest not making this RBAC system a mandatory dependency for other work you want done.

Cheers,

Francois

07 June 2011, 21:33

François, I totally agree. There are so many cool features and tweaks that could be worked on to realy make things happen.

After all, what's stopping a k-12 school from running three independant instances on the same box? Maybe one for the very young students with maximum restrictions, and two that are more open for the older crowd. From my experience I can say that we have minimal if any issues with older learners using the same system as the very young and its not an issue at all. The effort of running multiple instances is minimal and does not cost a penny. Just my thouhgts :)

10 June 2011, 20:37

Hello Dirk,

I don't agree with your statement "the effort of running multiple instances is minimal" because you always have to update two systems and have more administrative task to do, e.g. importing portfolios when the younger ones continue to the later grade levels. This may work for one school, but not for a national portfolio service and if teachers / staff need to be in both. Where would they keep their portfolio? How could they get comments from everybody? Do you have duplicate accounts set up or is there virtually no interaction between teachers for the lower grades and teachers in the upper ones? I am just curious.

On MyPortfolio we foster the collaboration aspect of Mahara. There are a number of groups in which teachers from all different grade levels get together to discuss ePortfolio questions and how to use MyPortfolio. They also share examples or templates that others can then copy and adapt. In my opinion, this environment is very supportive useful because it supports the teachers who just start out and test the waters but also those who are more experienced because they can discuss their ideas.

Cheers

Kristina