Lab-Aids offers a host of options for schools and districts to roster their students, teachers, and other staff so that they can access their online curriculum from the Lab-Aids Portal. The Lab-Aids Portal (provided by MagicBox) is OneRoster v1.1 certified.

We have the ability to roster and sync account info via OneRoster API from your district’s SIS (or other platform), which should be OneRoster v1.1 certified. Below is a list of details and technical specifications that outlines how we sync rosters from your SIS to the Lab-Aids Portal.

Requirements:
  • SIS (or other source of accounts) that is OneRoster v1.1 compliant (we do not support OneRoster v1.0)
  • Admins established at each school that needs licenses
  • Users are only associated with one school (org)
  • Users only have one role/user type
  • Classes differentiated by title/name only (no class metadata synced at this time)
  • Obtain parental/guardian permission to share account data for students under the age of 13

What information do we need to provide Lab-Aids to roster via OneRoster API?

In addition to verifying that your SIS is OneRoster v1.1 compliant, we will need the following info: API url, Consumer Key, and Secret Key. Please verify that you have already obtained parental/guardian permission to share account data for students under the age of 13. You will also need to communicate your preference on how we authenticate users for SSO.

What account metadata is synced?

We sync the following user metadata for each account:

  • Username
  • Password (encrypted, if available)
  • First name
  • Last name
  • School
  • User type/role
  • Class associations

For classes, only the class title/name is synced--we currently do not sync class metadata (such as section/period, room, etc.) at this time.

How long does the initial sync take?

This depends on how many accounts are being synced and other factors, but expect the initial sync to take up to 8 hours.

What authentication protocols do you offer?

Below are the options we currently support.

OAuth Version Authentication Support?
OAuth 1 SHA 1 Yes
OAuth 1 SHA 256 No
OAuth 1 512 No
OAuth 2 Basic Base64 Yes
OAuth 2 Grant type Authorization Code No
OAuth 2 Grant type Implicit No
OAuth 2 Grant type Password No
OAuth 2 Grant type Client Credential Yes

How do we provision licenses that grant access to the online curriculum?

If we only sync accounts that need licenses, we can assist with provisioning licenses to all teacher and student accounts in some cases.

However, if we sync all accounts in your SIS (including accounts that do not need licenses), district and school admins will have to assign licenses to accounts that need them. When licenses are issued to your account by us, the licenses are transferred to a district admin, who then transfers the needed quantity to a school admin at each school that needs access. The school admin then transfers the licenses to teachers that need access. Teachers then transfer licenses to their students.

How frequently does account data sync?

This depends on the SIS's implementation of OneRoster. If the API supports filters based on dateModified, then we will sync differential data only. In this filter is not available, then the entire full sync will occur every 24 hours.

Are grades or any other data sent back to our SIS/database on student accounts?

No. We do not pass any data back to the SIS where we obtained the account data (such as grades or test scores).

Can we anonymize any account data for privacy concerns?

This is dependent on your SIS (or other source of user account data). For example, you could anonymize each user’s first and last name, but we advise against anonymizing usernames/email address to aid in diagnosing accounts when issues arise and to allow single sign-on (SSO).

Are class associations synced, and if so, what class data is synced?

Yes, class associations for teachers and students are synced so that teachers can communicate with their students within the Lab-Aids Portal. At the moment, we only sync class titles/names and no other class metadata, such as period/section, room, etc. If you have multiple classes at one school that have identical class titles, but are differentiated by class metadata (such as section/period), this can cause some confusion amongst teachers. Please contact us for further details. We hope to resolve this issue during the 2019-20 school year.

What user roles/types are synced?

The following OneRoster user types are recognized and synced: admin (at both the district and school level), teacher, and student. We currently do not sync parents nor aides.

After rosters are synced, are we notified if the sync was successful?

Yes, the District Admins are notified via email of the status of the sync.

How do users log into the Lab-Aids Portal?

All users (students, teachers, administrators) log into the Lab-Aids Portal on the following page: https://portals.lab-aids.com. Single sign-on (SSO) is available for the following:

  • SAML 2.0 or oAuth2.0 based implementations
  • SAML / ADFS
  • SAML / Google
  • LTI 1.0 with oAuth1.0 SHA1
  • ClassLink LaunchPad for users that roster via ClassLink's Roster Server

What is the general process for OneRoster API Integration? 

Roster Sync process:

  1. Lab-Aids verifies the district meets requirements and understands process
  2. District sends Lab-Aids the API URL, Consumer Key, Secret Key, and district admin name/email address
  3. Lab-Aids sets up integration and initiates sync
  4. Lab-Aids and district both check sync data for accuracy (schools, school admins, number of classes/teachers/students rostered at each school)
  5. Lab-Aids/district verify that a school admin is rostered at each school that needs access
  6. District admin assigns licenses to the schools and teachers that need access

SSO process, if applicable:

  1. District and Lab-Aids determine SSO beforehand
  2. District sends Lab-Aids SSO XML file
  3. Lab-Aids sets up SSO integration
  4. District tests SSO to validate SSO functionality
  5. If necessary, schedule meeting with tech teams from Lab-Aids and the district to verify SSO functionality