Note the "primary_ccn". The equivalent Canvas photo URL is:

"/canvas/#{@canvas_course_id}/photo/#{canvas_student['id']}"

And similarly the URL for a photo from a campus roster might be:

"/campus/#{@class_slug}/#{@semester_slug}/photo/#{id}"

How would that work for authorization? See below...