How can I get started building an LTI external application?

[73396fae490e357]

Hello, I am a freelance web developer tasked with adding on some additional functionality to an existing Canvas LMS system. It seems the way to do this is to build and integrate an external LTI application, and I would likely do this in rails. While I have found the documentation on this and the course on building LTI applications, I haven't been able to find anything that clearly explains on a basic level what an LTI app does functionally, how it is structured, and how it interacts with the LMS system. I have the following questions and would greatly appreciate any help I can get getting started.

1. My understanding is that LTI applications are separate free standing applications that are run within the LMS system and share authentication. Is this correct? Several of the following questions are based on this assumption so please correct me if I am wrong and help me understand what LTI applications functionally do.

2. If LTI apps are in fact free standing applications, are they then deployed separately on their own servers with no particular integration with the Canvas LMS system to begin with?

3. If LTI applications are deployed separately, and if they are in fact run from within the LMS system, how do they interact with the LMS system while they are running? In other words, is there some direct interaction between the application and the LMS system, or is it simply rendered within a particular classroom with access to the user's data, say via an iframe?

4. If LTI applications are deployed separately, and if they are in fact run from within the LMS system, is the application, or the LMS system responsible for handling the data for the application? If there is a database for the LTI application, how should that be set up and structured to work with the LMS system? If all data is handled by the LMS system, is it possible to create and store specialized data for the LTI application?

5. What is the protocol for getting an application to be accessible and eventually integrated to a particular LMS system? Is there anything that needs to be arranged with my client or the CanvasLMS company? If I just want one client to be able to use my application, is this possible? (In this case client refers to the person I'm working with rather than the front end, sorry for the confusion)

6. What is the best way is to set up a hello world type application to get myself started? Eventually, I would like to have a test environment set up to continually update and test out my application as I build it. Is it feasible to set up a LSM system on my local machine with a decent knowledge of the rails framework and use this in the development of my LTI application, or is there some other way I should go about this?

6. Are there any specifics I should know about the particular LMS system that I would like to work with in order to be able to develop my application in the appropriate way?

Thanks in advanced. I will likely have some follow up questions, but right now I am just trying to understand the fundamentals, again I will greatly appreciate any help I can get here.

[sonya_corcoran1]

Hi Allan, I too am getting started and have the exact same questions.

Although, I'm a junior dev so not THAT good on the Rails side of things.

I found  @garth  's 3 Part blog on Getting Started in .Net excellent and will answer most, if not all of your questions. I have a friend who is translating this blog into a Ruby on Rails and Javascript as that is what I am most familiar with. So once I have that I'll share it with you.

My best attempt is that I got a clone of the Instructure TP Example up and running on Heroku (note: the LTI2 part is not working and they are currently fixing it). Here are my notes from last week after reading the IMS-LTI Implementation Guide and the Canvas LTI Course:

The way the Consumer and Provider talk to eachother is by using LTI and OAuth. An LTI Link is an iframe with 3rd party content on a page inside a tool consumer. The IMS LTI2.0 implementation guide is good, but in PHP: https://www.imsglobal.org/specs/ltiv2p0/implementation-guide

So my understanding is I need an app that:

1) must be iframable

The HTTP header x-frame-options

(Links to an external site.) contains instructions to a browser on how a page can be consumed. Generally when this header is sent a browser will not allow it to be rendered in an iframe. The google search page, for instance, sends x-frame-options: SAMEORIGIN and cannot be embeded in another site via iframe. This option allows web developers to prevent their page from being displayed inside another page. Since LTI links operate via iframe, this option will prevent a page from being able to be included as an

2) It must accept POST (Links to an external site.) requests

Most web traffic operates using GET requests. POST requests are generally reserved for form submission, such as when a user signs up for a website. POST requests allow browsers to send user information back to the webserver. In LTI, POST requests are used to send user and context information from the tool consumer to the tool provider.

3) It must be HTTPS

I think my best option is to build a ‘Hello World' RoRo app and deploy it on heroku with a SSL cert. But once I understand the LTI and OAuth, I’d like to build apps in Meteor.JS.

I'd be very willing to figuring this out with you and sharing notes/repos etc.

Best of luck

Sonya

UTS

Sydney, Australia

[garth]

 @sonya_corcoran1 ​ great answers.  You make some very good points.

This post was actually made twice, and  @RobDitto ​ also gave some good feedback here:

• How can I get started building an LTI external application?

Lots of good info.

[stephen_woosley]

Thanks for the post! Very encouraging to know another Junior Dev is attempting this. Any updates as to whether or not the Javascript blog translation is complete yet? I'm very interested in starting this process in a JS framework.

[garth · Accepted solution]

73396fae490e357703ca9512472ce424b31700771b9369e148624b3b9d5ecb8d I'll do my best to provide some initial answers.

1. Yes, LTI applications are free standing app, completely separate from the LMS.  The LMS will send a launch request and pass the user credentials and other information so the LTI app knows how to pass info back to the LMS.  The Roll Call app is a good example of this.

2. Yes, LTI apps are deployed separately, and run outside of the LMS eco-system, on their own servers, and are not managed by the LMS team.

3. LTI apps can interact with the LMS through the API, and through the LTI links that are passed to the LTI app through the launch request.  In simple terms, an example would be an LTI provider, like Pearson, who provides a digital textbook with associated assignemnts.  Pearson will post grades for the assignments back to the LMS gradebook.

4. The creator and host of the LTI app is responsible for their own data, not the LMS platform.

5. You will need to register your app with the LMS platform.  This can be done by an LMS admin using an XML file, and typically requires a unique key and shared secret.  I'm not sure what you mean by "client", there are ways to control access to the LTI app,  you will need to investigate configuration options as you learn more about LTI.

6. I have posted a three part blog on just that, connecting a "hello world" app using LTI.  You can read the first post here:

• .NET LTI Project - Part 1 - Connect to Canvas​

You may not be using .NET, but the concepts apply to whatever technology you choose to use.

7. You should take a look at the IMS Global website, they define the standards.

I have also posted some helpful LTI links here:

• LTI 1.x - Useful Links

I hope this helps get you started.

[Coen1]

Hi @garth,

I noticed that the two of the links at the bottom of your post (that was selected as the solution) are broken.

Interested in reading your three part blog.

[Stef_retired]

In the interest of keeping the conversation unified under a single discussion topic, I've copied and pasted  @RobDitto ​'s response to this question in the parallel thread:

Oct 17, 2016 12:24 PM

These slides from my friends at Harvard University have filled in a lot of the blanks for me as a technical director making LTI "build or buy" decisions. Based on my experience, I'll suggest some possible answers to your questions:

1. LTI applications are free-standing; however, they're run outside the LMS system. Regarding sharing authentication, it's more that the LMS sends the LTI tool authentication information for the logged-in user through a secure signed form post.
2. Yes, that is correct.
3. Today, the majority of LTI applications are like your last sentence:
   

   or is it simply rendered within a particular classroom with access to the user's data, say via an iframe?

   Canvas pioneered the notion of LTI placements the most common of which is within a course. (The next version of LTI should open up some additional interaction possibilities through message-passing between the LMS and tool.)
4. The application is responsible for storing and managing data it receives from the secure form post. Developers are free to design how that works, choose databases, etc.
5. If your application supports the LTI standard, that itself is the bulk of the protocol -- especially the key and secret, which are (in LTI 1.1) the main way you limit use of a tool to pre-arranged institutions/situations. Each LMS connects to LTI tools differently, normally with no vendor interaction required. Here's one of the more commonly used ways to connect an external tool to Canvas: How do I configure an external app for a course using a URL?
6. Probably the simplest "Hello World" for Ruby on Rails would be to try the Ruby gem provided by Instructure, up to the point of the Tool Provider instructions:
   GitHub - instructure/ims-lti: A Ruby library to help implement IMS LTI tool consumers and providersDr. Chuck Severance's examples have been helpful to our third-party developers:
   Dr. Chuck's Blog  » Blog Archive  » How to Build a Rich / Non-Trivial IMS LTI 1.1 Provider

[sonya_corcoran1]

Thanks  @garth  and stefaniesanders for catching the duplication.

I also found AtomicJolt's OAuth walk through really helpful from understanding the structure of a Rails App.

Ruby Ep. 6: OmniAuth Demo - YouTube

My issue is that I understand the process, I just don't know where the code should go in a Rails/Meteor app.

Oh well - I'll continue to plod along but if anyone has any other resources/worked examples of LTI Tool Providers with LTI2 it would be most appreciated

Cheers

Sonya

[garth]

 @sonya_corcoran1 ​  IMS Global is the entity responsible for publishing the LTI standards.

They provide sample code, which I'm sure can help to get you started:

• Learning Tools Interoperability: Sample Code | IMS Global Learning Consortium

[73396fae490e357]

Hi all,

Thanks so much for your support in my efforts to get started, I can't tell you how helpful this has been over the past couple weeks. I hope this post will be of help to others getting started with LTI applications as well. (I would have replied sooner, except that I somehow got locked out of my account.)

Best,

-Allan

[sonya_corcoran1]

Hey Stephen,

How are you getting on with your build? I've asked for from help from some more senior devs.

Hope these coding walkthroughs help you get started with LTI.

Learning LTI with Atomic Jolt & a Noobie

Cheers

Sonya

[dacarter]

This solution is rather old and the links within the solution are now broken.

I would go to Garth's profile page and look for some of the links there.  I was able to find parts 1, 2, and 3 of the .NET LTI Project there.

.NET LTI Project - Part 1 - Connect to Canvas, but a few of the others I haven't found yet.