LTI user_id uniqueness

LTI user_id uniqueness


I tried to conclude the uniquness requirements of the user_id property from the LTI 1.1 spec, but I'm not sure I have a definite answer.

To phrase my question shortly, please indicate which of the following statements is true:

1. A user_id value has to be globally unique.

2. The combination of a user_id and tool_consumer_instance_guid has to be globally unique.

3. The combination of a user_id and oauth_consumer_key has to be globally unique.



StephenVickers's picture

Re: LTI user_id uniqueness

Thanks for your question; apologies for not responding more promptly.

Of your 3 statements, 1 is false, but 2 and 3 should be true from the perspective of an individual tool provider.  That is, the combinations are not globally unique to any tool provider as the OAuth consumer keys are generated by each tool provider and could overlap, though in theory the tool consumer GUID should be globally unique so one might consider 2 to be a truly globally unique value.  However, note that not all tool consumers supply a tool consumer GUID value and not all make it different for each tenant in a multi-tenant scenario - this is an area which is currently being investigated to see how we can achieve better consistency.

You may find this link of interest, depending upon the reason for your question: