It would look something like this: the administrator sets the base URL to https://webwork.school.edu/webwork2. The instructor then sets up a link to the external tool using https://webwork.school.edu/webwork2/course_name (or directly to the assignment if you are using the grade passback per assignment). Because the first part of the URL matches the base URL, it automatically inherits the settings for that tool (particularly the shared secret).
Your concern at the bottom is a valid one. The way the WeBWorK code is written right now, if LTI is enabled server-wide, then the shared secret is enough to get you access to any course. One security feature that is in place is the ability to limit the automatic creation of permissioned accounts via LTI. By default new accounts are only created up to the role of TA, so someone linking to the wrong course wouldn't be able to create a professor account for themselves.
I believe that all of the LTI configuration (enabling LTI and/or setting the shared secret) can be done at the course level. You can put the configuration items in course.conf for an individual course. There are two approaches to this:
- Set everything up in the system-wide configuration file (in the /opt/webwork/webwork2/conf directory), and then override it on a course-by-course basis as necessary using course.conf. This allows you to have it set up once for the whole server, but means that by default things will be enabled for all courses.
- Don't enable LTI globally. Instead paste the entire configuration into course.conf. The benefit is that you can only have LTI enabled in specific courses, but it means having to maintain a separate configuration for each course.
