23 November 2015, 22:54

We currently use institutions but are considering not using them (due to shibboleth issues).

Could someone tell me what the implications of removing institutions are re security/privacy and anything else that comes to mind

Thanks

02 December 2015, 8:35

Hello David,

Can you please explain your Shibboleth issue? We use Shibboleth on a multi-tenanted instance and haven't run into issues. Maybe your Shibboleth is set up differently though as the one that we are connecting to...

As for working with institutions, I see the following as the primary advantages:

• You can set up institution admins who can do user management and group management but don't have full site admin permissions changing plugins or other important parameters of the site. Even if you only want to go with one institution, I'd recommend you set up one besides "No institution" and don't use "No institution" just for that reason. You never know when institution admins might come in handy.
• You can tailor messages on the dashboard to different user groups. For example, if you have all students in one institution and all teachers in another, you can have different announcements for students than teachers.
• You can also tailor other institution settings more to your different user groups.
• You can use different themes for different institutions.

There are no security or privacy concerns when you have all users in one institution in regards to who can see whom or whose portfolio. On Mahara, you can share your portfolio with anybody, no matter whether they are in your institution or not. You can also friend anybody.

The only privacy concern could arise in a scenario like the following: Primary school students and teachers are using Mahara. The primary students should not have the right to make their portfolios available for the entire world whereas the teachers should be able to do so. If you have everyone in one institution, either everybody or nobody can share their portfolios publicly. If you have one institution for students and one for teachers, you can allow the latter to share publicly while the former are not allowed.

I hope that clears things up a bit.

Cheers

Kristina