# Atenea Exams, an IMS LTI Application to Solve Scalability Problems: A Study Case
## 2 LMS Interoperability
### The LTI Protocol  
IMS LTI enables the model of SaaS for learning activities within the context of the LMS. LTI enables to plug an external application into the LMS within a determinate context. In the LTI protocol there are two relevant actors: the LTI Provider and the LMS acting as a Consumer. A service in the form of a Web application is provided (the Learning Activity or Learning Tool) to the LMS users so they can access this tool once some setup is done. In an LMS, a learning tool is contextualized in a virtual classroom that may be a Moodle Course, the group or subgroup of students and the activity itself. For instance, a Discussion Forum in the Main Group of the Introduction to Cloud Computing Course. These three elements: course, group and activity define a specific activity and its context. When a user accesses the activity, he does so with an identification (Id) and a set of specific permissions and privileges granted by his Role (teacher, student, visitor, etc. ), and this is managed by the LMS with internal services of authentication and authorization. In addition to that, the activity reports its outcomes to the LMS: logging information, learning outcomes and grades. When a system acts as an LTI Provider, offering an online learning activity as a service via the web, it will receive the activity context (course, group, activity id), and the user's identification, authentication and role from the LTI Consumer (in our case the LMS) during the launch of the activity and via webservices communications between Provider and Consumer. Let us suppose that we have a web app that implements a Code Dojo where students can do coding exercises and some kind of group interaction. The Code Dojo can act as LTI Provider, so it is set up to get the user's Id, context, and role from the LTI Launch when a student or teacher clicks on the LTI Activity (External Tool) in the LMS as illustrated in Figure 3. The Code Dojo can report back to the LMS information about the student's logs, learning outcomes and grades via webservices defined by the LTI Protocol. Before the students can access the LTI learning activity a configuration of LTI activity in the LMS is required. An LMS activity--in a specific course and group--connects to a specific LTI service, this is set up with the External Tool in Figure 3, where the teacher can enter the proper configuration parameters (URL and Secret). Once the LMS LTI Consumer is set up, when the LMS users access this activity, they will be redirected to the LTI provider's website with the proper context, identification and authorizations to enjoy it. Figure 1: Moodle webservices architecture. Figure 2: External Tool (LTI) in the Moodle Atenea instance. As shown in Figure 3, when the LMS user accesses an LTI Activity, in the LTI Launch the LMS communicates to the LTI Provider the execution context of the activity, an identifier for the user--which may or may not include the user's personal data depending on how it is configured the system--and the permissions of this user in the context of the activity (teacher, student, etc.). The LTI provider can send student activity records and assessment data back to the LMS. There are some advantages of using an external LTI tool compared to modular Moodle extensions:  
* It does not pose a security or integrity risk to a Moodle instance. If LTI Activity drops, it does not affect the operation of the LMS. There is simply one activity that stops working. A security or performance issue in a module can compromise the operation of the entire LMS. * There is no need to update LTI activities when the LMS is updated. While the activity complies with the LTI protocol, it acts independently. * LTI Activities allow new forms of collaboration, a company can offer an LTI Activity as a service to customers around the world and regardless of the LMS they use (Moodle, Canvas, Sakai, Blackboard, etc. ), as most LMSs currently support the LTI standard. However it poses a risk to the privacy and confidentiality of students.