-
Bug
-
Resolution: Fixed
-
Minor
-
2.5.1
-
MOODLE_25_STABLE
-
MOODLE_25_STABLE
-
MDL-40848_master -
Currently when a user connects to a backpack they only need to provide the email address of a backpack owner and the badges will be pulled in and displayed in their profile. There is no confirmation that the backpack belongs to the user.
To an extent this is a limitation of the badges infrastructure, and since users may use a different email address in their backpack to their Moodle email there is no easy way to check that the user owns the backpack.
I posted to the open badges forums about it here:
https://groups.google.com/forum/#!topic/openbadges-dev/fHFvEQCXyYU
Francois from Mozilla suggested we could validate them using Persona and I even implemented a proof of concept that does work, but it would require the user to sign up for Persona, and have javascript and 3rd party cookies enabled for it to function.
On the other hand pushing a badge to a backpack already requires all of those things so perhaps it is acceptable?