LTI Integration Guide
Connect ICT Exam to your own LTI 1.3 compliant LMS, Moodle, Chamilo or any standards-conformant platform, instead of using our hosted Moodle.
This guide is for a tenant who wants to connect ICT Exam to their own LTI 1.3 compliant LMS rather than the hosted Moodle. ICT Exam is a standards-conformant LTI 1.3 / LTI Advantage tool, verified against the saLTIre / 1EdTech reference platform, so it launches from any LMS that implements LTI 1.3. Each customer’s LMS issuer becomes its own tenant key, so your data stays fully isolated from every other customer.
Supported today: standard OIDC launch, AGS grade passback (scores flow back to the LMS gradebook), and NRPS roster sync.
Not automated yet: LTI Dynamic Registration. Onboarding is a one-time manual exchange of the values below, performed by ICT Exam staff together with your LMS admin, plus a tenant row. After that, launches just work.
How an LTI 1.3 connection works
LTI 1.3 is a two-way trust setup, where each side registers the other:
- The LMS (platform) is told about the tool (ICT Exam): where to start a launch, where to send the user, and where to fetch the tool’s public keys.
- ICT Exam (tool) is told about the platform (your LMS): its issuer, client id, and its OIDC, token and keyset endpoints.
Then a user clicks the activity in the LMS, an OIDC handshake runs, a signed launch is sent, and ICT Exam opens.
Known LTI 1.3 compliant platforms
ICT Exam works with any LTI 1.3 platform. Open-source LMSs known to support LTI 1.3 as a platform (so they can launch external tools like ICT Exam) include:
| LMS | Open source | LTI 1.3 platform support | Notes |
|---|---|---|---|
| Moodle (3.10+/4.x) | Yes (GPL) | Yes, built in | Best-supported path; optional native mod_ictexam plugin for a single clean grade column |
| Chamilo (1.11.18+) | Yes (GPL) | Yes (External tool / LTI plugin) | Standard external-tool LTI 1.3 path |
| Open edX (Maple+) | Yes (AGPL) | Yes (lti_consumer XBlock, LTI 1.3 + AGS/NRPS) | Add as an LTI component in a unit |
| Sakai (21+) | Yes (ECL) | Yes (LTI Advantage) | |
| ILIAS (7+) | Yes (GPL) | Yes (LTI consumer) | |
| Canvas LMS (community edition) | Yes (AGPL) | Yes (LTI 1.3 Developer Keys) | |
| OpenOLAT | Yes (Apache) | Yes (LTI 1.3) |
Commercial platforms such as Blackboard, Brightspace/D2L and Schoology work too; they simply are not open source. The integration mechanism is identical for all of them, only the admin screens differ.
Values ICT Exam gives your LMS
Configure these in your LMS’s external tool or LTI Advantage registration. The hosted service host is https://app.ictlms.net:
| LMS field (typical name) | Value |
|---|---|
| Tool / Launch URL, Target Link URI | https://app.ictlms.net/lti/launch |
| Login / Initiation URL (OIDC) | https://app.ictlms.net/lti/login |
| Redirection URI(s) | https://app.ictlms.net/lti/launch |
| Public keyset / JWKS URL | https://app.ictlms.net/.well-known/jwks.json |
| Public key type | Keyset URL (JWKS), preferred over a pasted key |
Grant these LTI Advantage services so grade passback and roster sync work:
- Assignment & Grade Services (AGS), line item and score scopes:
https://purl.imsglobal.org/spec/lti-ags/scope/lineitemhttps://purl.imsglobal.org/spec/lti-ags/scope/scorehttps://purl.imsglobal.org/spec/lti-ags/scope/result.readonly
- Names & Role Provisioning Services (NRPS):
https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly
Set the launch privacy to share name and email if you want roster sync and per-user grades to carry real identities.
Values your LMS gives ICT Exam
After you create the tool in your LMS, the LMS exposes its own LTI 1.3 endpoints. Send these to ICT Exam staff so we can add a registration:
| Needed value | What it is |
|---|---|
Issuer / Platform ID (iss) | The LMS base URL, for example https://lms.yourschool.edu. This is your tenant key. |
| Client ID | The id the LMS assigns to the ICT Exam tool. |
| Deployment ID | The deployment or registration id (often 1 in Moodle). |
| OIDC auth / authorization endpoint | For example Moodle …/mod/lti/auth.php |
| Access token endpoint | For example Moodle …/mod/lti/token.php |
| Public keyset (JWKS) URL | For example Moodle …/mod/lti/certs.php |
ICT Exam stores this as a registration entry, keyed by issuer:
{ "https://lms.yourschool.edu": [ { "issuer": "https://lms.yourschool.edu", "client_id": "ABC123clientid", "auth_login_url": "https://lms.yourschool.edu/mod/lti/auth.php", "access_token_url": "https://lms.yourschool.edu/mod/lti/token.php", "key_set_url": "https://lms.yourschool.edu/mod/lti/certs.php", "deployment_ids": ["1"] } ]}We also create your tenant row (issuer = your LMS, so the issuer alone identifies you) and enable AGS and NRPS. The backend is restarted once and the connection is live.
Step by step: Moodle
- Site administration → Plugins → Activity modules → External tool → Manage tools → Configure a tool manually.
- Set:
- Tool name: ICT Exam
- Tool URL:
https://app.ictlms.net/lti/launch - LTI version: LTI 1.3
- Public key type: Keyset URL
- Public keyset:
https://app.ictlms.net/.well-known/jwks.json - Initiate login URL:
https://app.ictlms.net/lti/login - Redirection URI(s):
https://app.ictlms.net/lti/launch
- Under Services, set IMS LTI Assignment and Grade Services to Use this service for grade sync and column management, and IMS LTI Names and Role Provisioning to Use this service to retrieve members’ information.
- Under Privacy, set share launcher’s name and email to Always.
- Save, then open Tool configuration details (the “i”) to read Moodle’s Platform ID (issuer), Client ID, Deployment ID, and the auth, token and public-keyset URLs. Send these to ICT Exam.
- (Optional) For the cleanest single grade column, install the native
mod_ictexamplugin instead of a raw external-tool activity. - Add an External tool activity in a course pointing at the ICT Exam tool, then launch.
Step by step: Chamilo
- Administration → Plugins → enable the LTI / External tool plugin (or Course → Tools → External tool (LTI) depending on version).
- Add a new tool with:
- Name: ICT Exam
- Launch URL:
https://app.ictlms.net/lti/launch - LTI version: 1.3
- Login / Initiation URL:
https://app.ictlms.net/lti/login - Redirect URL:
https://app.ictlms.net/lti/launch - Public keyset (JWKS) URL:
https://app.ictlms.net/.well-known/jwks.json
- Enable AGS (grade services) and NRPS (membership) if your Chamilo version exposes them.
- Save and open the registration details to read Chamilo’s issuer, client id, deployment id, and its OIDC auth, token and JWKS endpoints. Send these to ICT Exam.
- Add the tool to a course and launch.
Step by step: any other LTI 1.3 LMS
For Open edX, Sakai, ILIAS, Canvas, OpenOLAT and the rest, the mechanism is identical and only the admin labels change:
- In the LMS, register a new LTI 1.3 / LTI Advantage tool using the four ICT Exam tool endpoints (Login, Launch/Target, Redirect, JWKS) from the table above.
- Enable the AGS and NRPS services and scopes.
- Configure the tool to send the user’s name and email.
- Copy the LMS’s issuer, client id, deployment id, OIDC auth endpoint, token endpoint and JWKS URL and send them to ICT Exam.
- ICT Exam adds the registration and your tenant, restarts, and confirms.
- Place the tool or activity in a course and launch.
For Open edX specifically, use the lti_consumer XBlock in “LTI 1.3” mode and enable LTI Advantage (AGS/NRPS). For Canvas, create an LTI 1.3 Developer Key with the same endpoints and scopes.
After connecting, what works
- Single sign-on launch: teachers land in the authoring workspace; students go straight into the exam, with no separate ICT Exam login.
- Grade passback (AGS): a student’s score is written back into the LMS gradebook on submit, and updated again after teacher recheck.
- Roster sync (NRPS): a teacher launched from a course can pull the course’s members into ICT Exam (creating users and enrolments) from the Sync roster from Moodle/LMS button.
- Tenant isolation: everything created under your issuer stays in your tenant.
Troubleshooting
| Symptom | Likely cause |
|---|---|
| “Unknown LTI issuer/client registration.” | ICT Exam does not yet have your platform registration, or the issuer/client id sent does not match what was registered. |
| Launch fails signature / JWKS validation | LMS keyset URL wrong or unreachable, or clock skew between servers. |
| Grades do not appear in the LMS | AGS scopes not granted, or the activity has no line item or grade column. |
| Roster sync button missing or returns 401 | You did not launch from inside an LMS course as an instructor, or the NRPS scope was not granted. |
| Names and emails show as ids | The LMS privacy setting is not sharing name and email at launch. |
When in doubt, the fastest check is the Tool configuration details screen in your LMS. It lists exactly the issuer, client, deployment and endpoints ICT Exam needs.
Need a hand?
If this guide does not cover what you are after, open a ticket and our team will help.
Contact us