Streamlining Student Access Without Explicit Group Assignment

[niclasheun]

Problem

Currently, students must be assigned to a <CourseName>-<SemesterTag>-Student role in order to access a course (e.g., to fill out a survey). This leads to complications regarding when students should be assigned or unassigned from this group. For instance:

• Assigning students too early (e.g., right after the application phase) can be incorrect since TUM Matching has not been finalized.
• An instructor must manually trigger this assignment in Prompt at the correct time, which is cumbersome and unpleasant from a user perspective.

Proposed Solution

Instead of assigning students to a Keycloak role, we can determine course membership using the student’s TUM-ID or matriculation number. This information is already contained in the token. The aim is to eliminate the need for explicit group assignments in Keycloak.

Revised Authentication Flow

1. Course Visibility
   A student can see a course if they already have a course participation record. (This participation record is typically created when the student applies.)

2. Phase Visibility
   The student can see only those phases:

   • That have a student-facing frontend.
   • Where the student has a course phase participation record.
   • Or for which the student has passed the previous phase (if applicable).

This approach ensures that students can seamlessly access what they need, based on existing participation data, without requiring an extra administrative step to manage Keycloak group memberships.