Configuring LTI Advantage Tools

For a successful launch to occur, LTI Advantage Tools require configuration on both Canvas and inside the tool:

• Configuring LTI Advantage Tools
• Overview of an LTI Launch
• Configuring Canvas in the Tool
• Configuring the Tool in Canvas
  • Anatomy of a JSON configuration

But first, the importance of each configuration setting can only be understood with a basic understanding of how an LTI launch occurs.

Overview of an LTI Launch

The IMS Security Framework uses an Open ID Connect (OIDC) third-party flow. You'll want to read these specifications in detail, but the following is a Canvas-specific summary:

Step 1: Login Initiation

Canvas initiates a login request to the oidc_initiation_url that is configured on the LTI developer key. This requests contains an issuer identifier (iss) to recognize Canvas is launching the tool. As the issuer, Instructure-hosted Canvas intances all use the following, regardless of the specific account domain(s) that the tool was launched from:

• https://canvas.instructure.com (Production environment launches)
• https://canvas.beta.instructure.com (Beta environment launches)
• https://canvas.test.instructure.com (Test environment launches)

The request also includes a login_hint that is passed in the next step. Last, the request include the target_link_uri that has been configured on the Developer key; this is later used by the tool as a recommended final redirect.

Step 2: Authentication Request

To complete authentication, tools are expected to send back an authentication request to an "OIDC Authorization end-point". This can be a GET or POST. For cloud-hosted Canvas, regardless of the domain used by the client, the endpoint is always:

• https://canvas.instructure.com/api/lti/authorize_redirect (if launched from a production environment)
• https://canvas.beta.instructure.com/api/lti/authorize_redirect (if launched from a beta environment)
• https://canvas.test.instructure.com/api/lti/authorize_redirect (if launched from a test environment)

Among the required variables the request should include:

• a redirect_uri, which must match at least one configured on the developer key.
• a client_id that matches the developer key. This must be registered in the tool before the launch occurs.
• the same login_hint that Canvas sent in Step 1.
• a state parameter the tool will use to validate the request in Step 4.

Step 3: Authentication Response (LTI Launch)

Canvas will use the client_id to lookup which developer key to use and then check the redirect_uri that was sent in the previous step and ensure that there is a exact-matching redirect_uri on the developer key. Canvas then sends its authentication response to the redirect_uri that the tool provided in Step 2. The request will include an id_token which is a signed JWT containing the LTI payload (user identifiers, course contextual data, custom data, etc.). Tools must validate the request is actually coming from Canvas using Canvas' public JWKs.

Step 4: Resource Display

The tool then validates the state parameter matches the one sent in Step 2 and redirects the User Agent to the target_link_uri that was sent in Step 1 (or some other location of its choice) to display the final resource. This redirect occurs in an iframe unless the tool is configured otherwise.

Configuring Canvas in the Tool

Tools will need to be aware of some Canvas-specific settings in order to accept a launch from Canvas and use the LTI Advantage Services:

• Canvas Public JWKs: When the tool recieves the authentication response (Step 3), tools must validate that the request is actually coming from Canvas. Canvas' public keys are environment-specific, but not domain-specific (the same key set can be used across all client accounts):

  • Production: https://canvas.instructure.com/api/lti/security/jwks
  • Beta: https://canvas.beta.instructure.com/api/lti/security/jwks
  • Test: https://canvas.test.instructure.com/api/lti/security/jwks

• Authorization Redirect URL: The values and use of this are described in Step 2. Since the URL is static, you will want to configure this in your tool.

• Client ID: The client_id of the Developer Key that's been configured in Canvas. Your tool will need to use this in the authentication response to Canvas (Step 2) and it is also used during the Client Credentials Grant to access LTI Advantage Services.

• Deployment ID: The deployment_id can be optionally configured in the tool. A single developer key may have many deployments, so the deployment ID can be used to identify which deployment is being launched. For more, refer to the LTI 1.3 core specification, section 4.1.2. The deployment_id in Canvas is exposed after a tool has been deployed using the client_id.

Configuring the Tool in Canvas

With LTI Advantage, Canvas moved to using Developer Keys to store tool configuration information. After a developer key is created and enabled, tools can be deployed to accounts/sub-accounts or courses.

Developer Keys allow tools to set the required parameters to complete the OpenID Connect Launch Flow, leverage LTI Advantage Services, and configure other important settings.

With guidance from the tool developer, developer keys settings can be manually entered by Account Admins. Tools providers can also supply Account Admins with a JSON configuration or configuration URL containing the settings the tool provider has verfied to work.

In the manual case, since many of the extensions listed here require more than a few lines of configuration, there is not currently an interface for every extension to be manually configured. Instead, we encourage tool providers to expose a set of URL endpoints that return working configuration options for their tool services.

If providing a URL configuration endpoint is not an option, you can also provide your users with raw JSON that they can paste in for configuration.

Anatomy of a JSON configuration

In this section, an example JSON configuration is shown followed by a table describing the relevance of each field.

NOTE: Certain placement-specific settings may not be described here. Some examples of JSON configuration snippets and placement-specific settings are also found in the placements sub-menu in the left-navigation of this documentation.

{  
   "title":"The Best Tool",
   "description":"1.3 Test Tool used for documentation purposes.",
   "privacy_level":"public",
   "oidc_initiation_url":"https://your.oidc_initiation_url",
   "target_link_uri":"https://your.target_link_uri",
   "scopes":[
       "https://purl.imsglobal.org/spec/lti-ags/scope/lineitem",
       "https://purl.imsglobal.org/spec/lti-ags/scope/result.readonly"
    ],
   "extensions":[  
      {  
         "domain":"thebesttool.com",
         "tool_id":"the-best-tool",
         "platform":"canvas.instructure.com",
         "settings":{  
            "text":"Launch The Best Tool",
            "icon_url":"https://some.icon.url/tool-level.png",
            "selection_height": 800,
            "selection_width": 800,
            "placements":[  
               {  
                  "text":"User Navigation Placement",
                  "enabled":true,
                  "icon_url":"https://some.icon.url/my_dashboard.png",
                  "placement":"user_navigation",
                  "message_type":"LtiResourceLinkRequest",
                  "target_link_uri":"https://your.target_link_uri/my_dashboard",
                  "canvas_icon_class":"icon-lti",
                  "custom_fields":{  
                     "foo":"$Canvas.user.id"
                   }
               },
               {  
                  "text":"Editor Button Placement",
                  "enabled":true,
                  "icon_url":"https://some.icon.url/editor_tool.png",
                  "placement":"editor_button",
                  "message_type":"LtiDeepLinkingRequest",
                  "target_link_uri":"https://your.target_link_uri/content_selector",
                  "selection_height": 500,
                  "selection_width": 500
               }
            ]
         }
      }
   ],
   "public_jwk":{  
      "kty":"RSA",
      "alg":"RS256",
      "e":"AQAB",
      "kid":"8f796169-0ac4-48a3-a202-fa4f3d814fcd",
      "n":"nZD7QWmIwj-3N_RZ1qJjX6CdibU87y2l02yMay4KunambalP9g0fU9yZLwLX9WYJINcXZDUf6QeZ-SSbblET-h8Q4OvfSQ7iuu0WqcvBGy8M0qoZ7I-NiChw8dyybMJHgpiP_AyxpCQnp3bQ6829kb3fopbb4cAkOilwVRBYPhRLboXma0cwcllJHPLvMp1oGa7Ad8osmmJhXhM9qdFFASg_OCQdPnYVzp8gOFeOGwlXfSFEgt5vgeU25E-ycUOREcnP7BnMUk7wpwYqlE537LWGOV5z_1Dqcqc9LmN-z4HmNV7b23QZW4_mzKIOY4IqjmnUGgLU9ycFj5YGDCts7Q",
      "use":"sig"
   },
   "custom_fields":{  
      "bar":"$Canvas.user.sisid"
   }

}