2.1.1 OpenID Configuration

This specification applies the following constraints to the OpenID Discovery openid-configuration metadata definition; the following properties are required unless mentioned otherwise:

2.1.2 LTI Configuration

The lti-platform-configuration exposes the current LTI capabilities of the platform and may be used by the Tool to tailor its registration process. Its properties are:

The message supported indicates support for a specific message type. Its properties are described below, and are required unless mentioned otherwise.

The lti-platform-configuration and message supported definitions are open for extensions and future additions; implementers must therefore ignore any unknown properties.

2.1.3 Non normative example

{
    "issuer": "https://server.example.com",
    "authorization_endpoint":  "https://server.example.com/connect/authorize",
    "token_endpoint": "https://server.example.com/connect/token",
    "token_endpoint_auth_methods_supported": ["private_key_jwt"],
    "token_endpoint_auth_signing_alg_values_supported": ["RS256"],
    "jwks_uri": "https://server.example.com/jwks.json",
    "registration_endpoint": "https://server.example.com/connect/register",
    "scopes_supported": ["openid", "https://purl.imsglobal.org/spec/lti-gs/scope/contextgroup.readonly",
       "https://purl.imsglobal.org/spec/lti-ags/scope/lineitem",
       "https://purl.imsglobal.org/spec/lti-ags/scope/result.readonly",
       "https://purl.imsglobal.org/spec/lti-ags/scope/score",
       "https://purl.imsglobal.org/spec/lti-reg/scope/registration"],
    "response_types_supported": ["id_token"],
    "subject_types_supported": ["public", "pairwise"],
    "id_token_signing_alg_values_supported":
      ["RS256", "ES256"],
    "claims_supported":
      ["sub", "iss", "name", "given_name", "family_name", "nickname", "picture", "email", "locale"],
     "https://purl.imsglobal.org/spec/lti-platform-configuration": {
        "product_family_code": "ExampleLMS",
        "messages_supported": [
            {"type": "LtiResourceLinkRequest"},
            {"type": "LtiDeepLinkingRequest"}],
        "variables": ["CourseSection.timeFrame.end", "CourseSection.timeFrame.begin", "Context.id.history", "ResourceLink.id.history"]
    }
}

2.2.1 OpenID Configuration

This specification applies the following constraints to the format defined by the OIDCReg tool registration metadata; the following properties are required unless mentioned otherwise; a tool may include additional properties.

2.2.2 LTI Configuration

The lti-tool-configuration defines LTI specific configuration. Its properties are described below. A platform must ignore unknown properties. If proprietary extensions are added, they should be on the URI form, for example: https://myplatform.example.org/branding to avoid any collision with future additions.

2.2.3 LTI Message

The message indicates support for a specific message type. Support for the LtiResourceLinkRequest is implicit and does not need to be defined.

Multiple entries for a given message type may be possible, in particular when coupled with placements. If a platform does not support placements, it should then only consider the first message definition for a given message type and ignore the other ones. If it does, it should use the first message definition that matches both the message type and placement.

Its properties are described below, and are required unless mentioned otherwise. A platform must ignore unknown properties. The specification defining a given message type may define additional properties.

2.2.4 LTI Message: Deep Linking

Support for LTI Deep Linking is essential to the LTI Advantage ecosystem and is very versatile in its usage. The LTI Deep Linking Request message type is thus not enough to convey all possible usages of that flow. This specification proposes additional optional attributes to better define the message and guide the platform into the intended usage by proposing a set of default placements and the definition of supported types.

The default placement for the LTI Deep Linking flow is ContentArea. If a platform does not support placements, or no placements are specified in the message definition, the platform should thus make the Deep Linking flow available only in the Context content authoring areas where the tool is available.

2.2.5 Non normative example

{
    "application_type": "web",
    "response_types": ["id_token"],
    "grant_types": ["implict", "client_credentials"],
    "initiate_login_uri": "https://client.example.org/lti",
    "redirect_uris":
      ["https://client.example.org/callback",
       "https://client.example.org/callback2"],
    "client_name": "Virtual Garden",
    "client_name#ja": "バーチャルガーデン",
    "jwks_uri": "https://client.example.org/.well-known/jwks.json",
    "logo_uri": "https://client.example.org/logo.png",
    "client_uri": "https://client.example.org",
    "client_uri#ja": "https://client.example.org?lang=ja",
    "policy_uri": "https://client.example.org/privacy",
    "policy_uri#ja": "https://client.example.org/privacy?lang=ja",
    "tos_uri": "https://client.example.org/tos",
    "tos_uri#ja": "https://client.example.org/tos?lang=ja",
    "token_endpoint_auth_method": "private_key_jwt",
       "contacts": ["ve7jtb@example.org", "mary@example.org"],
    "scope": "https://purl.imsglobal.org/spec/lti-ags/scope/score",
    "https://purl.imsglobal.org/spec/lti-tool-configuration": {
        "domain": "client.example.org",
        "description": "Learn Botany by tending to your little (virtual) garden.",
        "description#ja": "小さな（仮想）庭に行くことで植物学を学びましょう。",
        "target_link_uri": "https://client.example.org/lti",
        "custom_parameters": {
            "context_history": "$Context.id.history"
        },
        "claims": ["iss", "sub", "name", "given_name", "family_name"],
        "messages": [
            {
                "type": "LtiDeepLinkingRequest",
                "target_link_uri": "https://client.example.org/lti/dl",
                "label": "Add a virtual garden",
                "label#ja": "バーチャルガーデンを追加する",
                "custom_parameters": {
                    "botanical_set":"12943,49023,50013"
                },
                "placements": ["ContentArea"],
                "supported_types": ["ltiResourceLink"]
            },
            {
                "type": "LtiDeepLinkingRequest",
                "label": "Add your Garden image",
                "label#ja": "あなたの庭を選んでください",
                "placements": ["RichTextEditor"],
                "roles": [
                    "http://purl.imsglobal.org/vocab/lis/v2/membership#ContentDeveloper",
                    "http://purl.imsglobal.org/vocab/lis/v2/membership#Instructor"
                ]
                "supported_types": ["file"],
                "supported_media_types": ["image/*"]
            }
        ]
    }
}

3.5.1 Issuer and OpenID Configuration URL Match

Before to actually register, to guard against impersonation attacks, a tool must validate the OpenId Configuration URL using the rules described in the previous section and reject the registration request if the validation fails.

A Tool may apply some additional validation based on the product_family_code and version.

3.5.2 Client Registration Request

As defined in [OIDC-Reg] specification Client Registration Request, the tool sends an HTTP POST message to the Client Registration Endpoint with the desired tool configuration. The content type must be application/json. If provided by the platform, the tool must include the token as Bearer Token in the Authentication http header.

Non normative example:

POST /connect/register HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: server.example.com
Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJ .

{
    "application_type": "web",
    "response_types": ["id_token"],
    "grant_types": ["implict", "client_credentials"],
    "initiate_login_uri": "https://client.example.org/lti",
    "redirect_uris":
      ["https://client.example.org/callback",
       "https://client.example.org/callback2"],
    "client_name": "Virtual Garden",
    "client_name#ja": "バーチャルガーデン",
    "jwks_uri": "https://client.example.org/.well-known/jwks.json",
    "logo_uri": "https://client.example.org/logo.png",
    "policy_uri": "https://client.example.org/privacy",
    "policy_uri#ja": "https://client.example.org/privacy?lang=ja",
    "tos_uri": "https://client.example.org/tos",
    "tos_uri#ja": "https://client.example.org/tos?lang=ja",
    "token_endpoint_auth_method": "private_key_jwt",
    "contacts": ["ve7jtb@example.org", "mary@example.org"],
    "scope": "https://purl.imsglobal.org/spec/lti-ags/scope/score https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly",
    "https://purl.imsglobal.org/spec/lti-tool-configuration": {
        "domain": "client.example.org",
        "description": "Learn Botany by tending to your little (virtual) garden.",
        "description#ja": "小さな（仮想）庭に行くことで植物学を学びましょう。",
        "target_link_uri": "https://client.example.org/lti",
        "custom_parameters": {
            "context_history": "$Context.id.history"
        },
        "claims": ["iss", "sub", "name", "given_name", "family_name"],
        "messages": [
            {
                "type": "LtiDeepLinkingRequest",
                "target_link_uri": "https://client.example.org/lti/dl",
                "label": "Add a virtual garden",
                "label#ja": "バーチャルガーデンを追加する",
            }
        ]
    }
}

3.6.1 Successful Registration

As per [OIDC-Reg] upon successful registration a application/json the platform must return a response containing the newly created client_id. It then echoes the client configuration as recorded in the platform, which may differ from the configuration passed in the request based on the actual platform's capabilities and restrictions.

The registration response may include a Client Configuration Endpoint and a Registration Access Token to allow a tool to read or update its configuration.

In the case where a Platform is combining the client registration with the tool's actual deployment, it may also include the deployment_id in the LTI Tool Configuration section.

Non normative example:

{
    "client_id": "709sdfnjkds12",
    "registration_client_uri":
      "https://server.example.com/connect/register?client_id=709sdfnjkds12",
    "registration_access_token": "iDPzMyKHMX_4CkTpwLDCK",
    "application_type": "web",
    "response_types": ["id_token"],
    "grant_types": ["implict", "client_credentials"],
    "initiate_login_uri": "https://client.example.org/lti",
    "redirect_uris":
      ["https://client.example.org/callback",
       "https://client.example.org/callback2"],
    "client_name": "Virtual Garden",
    "jwks_uri": "https://client.example.org/.well-known/jwks.json",
    "logo_uri": "https://client.example.org/logo.png",
    "token_endpoint_auth_method": "private_key_jwt",
    "contacts": ["ve7jtb@example.org", "mary@example.org"],
    "scope": "https://purl.imsglobal.org/spec/lti-ags/scope/score",
    "https://purl.imsglobal.org/spec/lti-tool-configuration": {
        "domain": "client.example.org",
        "target_link_uri": "https://client.example.org/lti",
        "custom_parameters": {
            "context_history": "$Context.id.history"
        },
        "claims": ["iss", "sub"],
        "messages": [
            {
                "type": "LtiDeepLinkingRequest",
                "target_link_uri": "https://client.example.org/lti/dl",
                "label": "Add a virtual garden"
            }
        ]
    }
}

3.6.2 Client Registration Error Response

As per OIDCReg, any configuration that cannot be registered should be rejected with a 400 Bad Request response with a JSON Object describing the error in the body.