canvas-moodle-lms-integrations

Canvas & Moodle LMS Integration Skill Guide

This skill governs standard implementation of LTI 1.3 Advantage protocols and REST API automation for enterprise learning platforms like Canvas and Moodle.

1. LTI 1.3 Advantage Security Architecture

LTI 1.3 replaces legacy shared-secret authentication with an OIDC Third-Party Initiated Login & OAuth 2.0 JWT Launch.

[ Canvas / Moodle LMS ]                              [ Tool Provider Backend ]
         |                                                       |
         |--(1) OIDC Login Initiation (iss, login_hint, lti_id)->|
         |                                                       |
         |<-(2) 302 Redirect to LMS /api/lti/authorize ----------|
         |                                                       |
         |--(3) POST id_token (Signed JWT with Roles & Claims) ->|
         |                                                       |
         |         [ Tool validates signature against LMS JWKS ] |
         |                                                       |
         |<-(4) Render Tool Inside LMS iFrame -------------------|

2. Production Code Implementations

A. LTI 1.3 Launch Token Verification (Python)

import jwt
from jwt import PyJWKClient


class LTILaunchVerifier:
    def __init__(self, platform_jwks_url: str, client_id: str, platform_issuer: str):
        self.jwks_client = PyJWKClient(platform_jwks_url)
        self.client_id = client_id
        self.platform_issuer = platform_issuer

    def verify_launch_token(self, id_token: str) -> dict:
        signing_key = self.jwks_client.get_signing_key_from_jwt(id_token)

        claims = jwt.decode(
            id_token,
            signing_key.key,
            algorithms=["RS256"],
            audience=self.client_id,
            issuer=self.platform_issuer,
            options={"require": ["iss", "aud", "exp", "sub", "https://purl.imsglobal.org/spec/lti/claim/message_type"]},
        )

        message_type = claims.get("https://purl.imsglobal.org/spec/lti/claim/message_type")
        if message_type != "LtiResourceLinkRequest":
            raise ValueError(f"Invalid LTI message type: {message_type}")

        return claims