LTI 1.3 · Trust
After registration, who holds which value - and where does the trust in it come from? The same relationship, seen from both sides.
The operator hands the school the registration URL and an access code. This happens outside the protocol - by contract, mail, ticket. It is the only human-verified step, and the permission to build a trust relationship at all.
The tool checks the access code, reads the platform's configuration, registers itself. Only now do both sides exchange IDs and the JWKS URLs they will later use to verify signatures. Once.
On every launch the platform signs its JWT and the tool verifies it against the platform JWKS - and vice versa for grades (AGS) and the roster (NRPS). No more key exchange, plus a license check on every call.
| Value | Moodle (platform) | Tool | Origin / basis of trust |
|---|---|---|---|
| Issuer (platform identity) | https://moodle.bzu.chown value | https://moodle.bzu.chstored | The platform's identity; known to both sides. |
| client_idafter access code | bgDUvGD82ysDLIkown value | bgDUvGD82ysDLIkstored | Assigned by the platform during registration. |
| deployment_idafter access code | 12own value | 12stored | Created by the platform; may be filled in at first launch. |
| Authorization endpoint (platform)after access code | https://moodle.bzu.ch/mod/lti/auth.phpown value | https://moodle.bzu.ch/mod/lti/auth.phpstored | Read from the platform's openid-configuration. |
| Token endpoint (platform)after access code | https://moodle.bzu.ch/mod/lti/token.phpown value | https://moodle.bzu.ch/mod/lti/token.phpstored | Read from the platform's openid-configuration. |
| Platform JWKS URLroot of trust | https://moodle.bzu.ch/mod/lti/certs.phpown value | https://moodle.bzu.ch/mod/lti/certs.phpstored | From the openid-configuration; the tool verifies the platform's signature with it. |
| Tool login URL | https://lti.mybzu.ch/loginstored | https://lti.mybzu.ch/loginown value | Reported by the tool to the platform at registration. |
| Tool launch URL | https://lti.mybzu.ch/launchstored | https://lti.mybzu.ch/launchown value | Reported by the tool; the only URL the platform may launch to. |
| Tool JWKS URLroot of trust | https://lti.mybzu.ch/jwksstored | https://lti.mybzu.ch/jwksown value | Reported by the tool; the platform verifies the tool's signature with it. |
| License status | does not hold it | activestored | Purely tool-internal, re-checked on every login/launch. |