If you have a learning application that you want to make LTI compatible, or if you want to create a new LTI Tool Provider, you only need to implement the following steps.Step 1: Setup a Launch URL
Setup a receiving point at some URL that will accept an HTTP POST message from a Tool Consumer. The script at this page should first verify that the received request is an LTI request. The POST request should contain lti_message_type with a value of 'basic-lti-launch-request', lti_version with a value of LTI-1p0 for LTI 1, oauth_consumer_key, and a resource_link_id, which is a unique id referencing the link, or placement, of the tool within the consumer's pages. If any of these are missing, then the request is not a valid LTI request.Step 2: Authenticate the request
After verification that you got an LTI request, the next step is to verify the authenticity of the Tool Consumer. All LTI launch requests are signed using OAuth 1 in order to ensure that the request is sent by the registered Consumer and the data was not altered en-route to Provider. This can also help in determining if this is a duplicate request. The data received should have the following OAuth parameters
At this point, you now have a valid LTI request.
Now you need to determine what parameters you received in
the Consumer's request.
The LTI specification has few required parameters, the rest are
either recommended or optional.
If you are receiving user_id, and if your application requires
user login, you will have to start a session for that user.
If this is a new user, you will have to create an account first
before starting their session.
The request may contain many other parameters such as, Name of a
user, course id etc.
The following is a list of parameters that LTI provides. There can be other parameters that Consumer may want to send, and those parameters will have a prefix "custom".
Tool Consumer requires a launch URL, a key, and a secret, along with the other settings such as placement of your application in Tool Consumer. The best practice is to provide an XML Configuration file, which can be copied by the Tool Consumer to make your tool available to instructors to use with the LMS. You may use this link to generate your XML file.
The XML File has the following structure
[Your App Title] [Your App Description] [Your Launch URL] public
[Your App Title] [Your App Description] [Your Launch URL] public [Your Launch URL] [Course Navigation Text] public enabled true
Now that you have a Tool which can be added in the Tool Consumer, you should now provide a link for Tool Consumers to register themselves. While minimum data required for each Tool Consumer is a key and a secret but you might want to add additional data fields while registering a Tool Consumer. For example: an instructor from Virginia Tech wants to add your tool into his course on Canvas, he should be able to register himself on your URL to use your tool. After registration, he should be provided with a key, a secret, a launch URL and an XML config file.Step 6: Get SSL Certificate
A Tool Consumer needs to have a secure connection with Tool Provider inorder to open it in an iFrame. Tool Consumers like Canvas will open your tool in a new window unless your application is running on a secure server.
If Canvas launches your unsecure application, it will show a warning and will ask the user to open the application in a new tab, which does not present a good user experience. Therefore, you should get a SSL certificate so that your application can run over HTTPS and open in an iframe. Get a PEM certificate if you are developing locally. You'll eventually need one for your production server as well.
Here are the steps for generating an SSL certificate locally on a UNIX environment
Step 1: Create your private key with any password. $ openssl genrsa -des3 -out server.orig.key 2048 Step 2: Remove the password $ openssl rsa -in server.orig.key -out server.key Step 3: Generate the Certificate Signing Request and enter localhost.ssl in Common Name $ openssl req -new -key server.key -out server.csr Step 4: Generate self signed SSL certificate $ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt Step 5) Add localhost.ssl to your hosts file $ echo "127.0.0.1 localhost.ssl" | sudo tee -a /private/etc/hosts Step 6) To run a rails application, use following command $ thin start --ssl --ssl-key-file server.key --ssl-cert-file server.crt
When you run your application for the first time, you will have to add it to the trusted system.