LTI 1.3 🤝 Docs?

[tibroc]

Bonjour, Hallo, Hallo 👋

We're exploring launching Docs directly from an LMS (Moodle, Canvas, Sakai, Blackboard…) via the LTI 1.3 standard, and we'd like the community's input before building it.

Why

Schools and universities work inside an LMS. To use Docs there, a teacher or student needs to open the right document from their course — no separate account, no second login, with permissions applied automatically (teacher: edit/manage, student: read or edit).

LTI 1.3 is the standard every major LMS already speaks, so one integration covers them all instead of a bespoke per-institution/per-LMS one. It's also a natural fit: LTI 1.3 builds on OIDC + signed JWTs, which Docs already uses for auth.

A first version would cover the launch + role mapping (LTI role → DocumentAccess), ideally Deep Linking so a teacher can pick/create a doc in the course.

Two ways to build it

• A: Native, inside Docs (Django app, in-repo or pip-installable). First-class and clean for role mapping/Deep Linking, but adds LTI surface and maintenance to the codebase.

• B: Gateway in front of Docs (sidecar). Terminates the LTI launch, does an OIDC token exchange against the existing Keycloak, drops the user into a normal Docs session. Trade-off: another service to run, and in-app features (Deep Linking, role sync) must go through the Docs API (which probably also means touching some functions in the Docs codebase).

B could be more easily developed independently; native A could follow later. They're not mutually exclusive.

One detail to figure out either way: how access should be revoked after a course ends, and how the LMS notion of instructor should map onto Docs' owner / administrator roles.

The two questions we mainly want your take on

• Is there interest in this from other deployers, especially in the education sector?

• Would maintainers consider merging an LTI app into the main repo, or does this make more sense as a community package?

Thanks for reading! 🙏

[IAMME543]

I am not the most knowledgable on auth or LMS' at all. But if my schools LMS works much like any other than I would wonder if the LMS could act as the OIDC provider instead of keycloak? Just asking, not sure if that is a way it could work?

[Wqrld]

I presume most organisations will already have their own Identity provider that the LMS then uses, but then you don't have information about i.e. the courses someone is in.

If i understand correctly LTI already has this feature where the LMS is the IdP. So doing that basic integration should be very easy.

I'm not sure how far along group support is in docs. That might be something to keep in mind. Revoking access would also need some kind of back door unless you only want to sync groups on login.

[Wqrld]

We are indeed also working on Integrating Lasuite at our university.
LTI support is not something we have thought of yet since the LMS already handles attacked documents already,
but having documents integrated that can be updated without having to fully reupload a PDF would be quite interesting. (Although you'd have to keep some side effects in mind like wanting to only make a document public at a certain date)

Since Lasuite mostly focuses on the government sector I would personally prefer to keep the LTI support as a separate layer as much as possible, but since education seems to be the sector focusing on sovereignity the most after government it might be worth integrating aswell if it's not too much maintenance work.

[lunika]

Hi,
This is an excellent idea.

We should take time to discuss how to do it. I made an application in the past using LTI 1.1; I don't know the difference with LTI 1.3 but I would be more than happy to brainstorm with you how to do it.

[tibroc]

Hi @lunika, we'd love to brainstorm with you! You can find me on matrix (@timb [colon] uni-osnabrueck.de) if we want to organize a meeting.