24 July 2025, 3:11

Hi

We're investigating the use of Institutions, now that we have an increase in users, and have hit some issues that I hope others can help with.

Mahara version 25.04 (for testing).

• Our site initially worked with one 'institution - 'mahara'.
• I've added 2 new ones.
• We use LDAP authentication.
• We are trying institutions without any 'registration'.  We were hopeful that on first log in students could pick the relevant institution.  However, when a new user logs in, and an account is created, it is defaulting to one of the 2 new institutions.  There was no choice.
• I tried adding existing members to the new institutions - this worked fine.  However when they now log in, they are also defaulting to the same institution as new members.
• I also gave one member the role of 'institution administrator' thinking they would be able to edit institution settings (they cannot) and view reports for the institution (they see reports for the whole site).

I get the feeling I'm missing some key setting or that I've not understood the guidance!  Can anyone offer advice on set up? Are there some key settings that could be causing the above?

Thanks

Yvonne

24 July 2025, 9:39

Hi Yvonne,

You touch on a number of things. If you use LDAP, yout can add students to their respective institution automatically based on group attributes that you have in LDAP. Of course that only works if you have them in different groups there. However, you also use LTI and thus would need two separate LTI connections as authentication methods are bound to an institution. Can you please get in touch with your support provider? They have a solution that should resolve the LTI question without needing to set up multiple LTI connections, which can be confusing, esp. when you have students take a course from the other institution. We received a version of the code but have not yet reviewed it and tested.

Institution admins can edit settings for their institution. If they see reports for the entire site, do you have that person also set up as site admin? Though that would give them edit permissions of the institution settings. So I wonder if they have some site settings but only institution support admin permissions in their institution. If you shared a screenshot with all settings options of the 'Account settings' that the site admin sees displayed for the account that is supposed to be institution admin, I will have a better idea of what's going on.

Thank you

Kristina

24 July 2025, 23:44

Hi Kristina

Thanks for your response.

We're not trying to use LTI, just LDAP at the moment. We don't use any groupings with LDAP unfortunately. I'm using a test account so that it doesn't get confused with my site admin role - and I could see they had been given the various roles I'd selected but I was confused by the level of detail in the reports they could see, and I couldn't see institution settings at all.  I've emailed you the settings separately - thanks for taking a look.  (In fact, just re-reading your message I think you need different settings, so I'll go an fish those out!).

I'm happy to log a support ticket with Catalyst if that's a more appropriate route to ask questions.

Thanks again!

Yvonne

25 July 2025, 8:15

Hi Yvonne,

Thank you for having sent through the screenshot. The problem was that the account had both 'Site staff' and 'Institution administrator' permissions. It looks like that in this combination, 'Site staff' takes precedence and cancels out the institution admin permissions. Usually, we have cumulative permissions, and thus I filed an issue report.

Since you don't use groups in LDAP to identify who needs to go into which institution, maybe there is an attribute, e.g. email domain, that could be used to identify the different groups. Please do discuss that with your support team as that kind of support goes beyond what we can offer here as it requires looking at your particular setup and the options available there.

Thank you

Kristina