search
SameGoal supports Alerts and Document Viewer Integration with vendors including student information systems (SISes), learning management systems (LMSes), dashboard applications, etc. A best-in-class implementation of this integration involves:
The following documentation is intended for SIS/LMS vendors to use in developing a secure, standards-based integration:
SIS/LMS vendor can create program participation alerts (eg Special Education, Section 504, etc) in its system based on data obtained from the SameGoal API Student Program Participation endpoint (usually obtained nightly). Each program participation record includes:
SIS/LMS vendor can create a visual indicator (flag/alert) in its system using the fields above. Program Abbr is sometimes displayed within the alert, and Notes can be used in an additional field, tooltip and/or hover for the alert. SIS/LMS vendor should initiate an LTI 1.3 launch when a program alert is clicked.
When a program alert is clicked by a user logged into the SIS/LMS vendor system, the SIS/LMS vendor system must initiate an OIDC handshake resulting in a secure LTI launch to the district/LEA special programs vendor (SameGoal).
The following standards-based approach uses the authentication portion (only) of the Learning Tools Interoperability (LTI) Core Specification (version 1.3) published by IMS Global. LTI refers to this usage as 'Messages'. In the context of this specification, the following terminology applies:
LTI Platform (SIS/LMS vendor) must provide a web interface or other mechanism for districts to generate, then copy/paste, the following configuration values into the LTI Tool (SameGoal web interface). LTI Platform must also store these values to verify authentication during the LTI launch workflow:
When a logged in user clicks a program alert in the LTI Platform, the LTI Platform must redirect the User Agent (browser) to the LTI Tool OIDC endpoint:
POST https://samegoal.com/iep/lti/oidc
| Parameter | Required | Description |
| lti_deployment_id | Yes | Deployment ID (config setting) |
| iss | Yes | LTI Platform's issuer identifier |
| target_link_uri | Yes | Final launch URL; https://samegoal.com/iep/lti/launch |
| login_hint | Yes | Opaque string; required parameter but not used (recommend empty string) |
LTI Tool 302 redirects back to the LTI Platform's OIDC authorization endpoint (config setting), with the following parameters included in the URL:
GET https://vendor-app.com/api/lti/auth
| Parameter | Value Constraint | Description |
| scope | "openid" | OIDC Scope |
| response_type | "id_token" | Indicates an implicit flow returning a JWT |
| client_id | [Client ID] (config setting) | Client ID assigned to LTI Tool |
| redirect_uri | "https://samegoal.com/iep/lti/launch" | LTI Tool launch URL |
| login_hint | [Echoed Value] | Echoed value sent in step 1 |
| nonce | [Dynamic String] | Critical; cryptographic nonce to prevent replay attacks |
| prompt | "none" | Instructs LTI Platform to not display any login or consent UI |
| response_mode | "form_post" | Instructs LTI Platform to send the id_token via an auto-submitted HTML form (POST) |
LTI Platform validates the session, constructs a signed JWT (id_token), and returns an auto-submitting HTML form.
POST https://samegoal.com/iep/lti/launch
id_token: Signed JWT, constructed as follows:
JWT Header
{
"typ": "JWT",
"alg": "RS256",
"kid": "[Key ID from JWKS]"
}
JWT Payload (Claims)
{
"iss": "https://vendor-app.com",
"sub": "[User ID]",
"aud": "[Client ID]",
"exp": "[Unix Timestamp + 5 mins]",
"iat": "[Unix Timestamp Now]",
"nonce": "[Nonce]",
// LTI 1.3 Standard Claims
"https://purl.imsglobal.org/spec/lti/claim/message_type": "LtiResourceLinkRequest",
"https://purl.imsglobal.org/spec/lti/claim/version": "1.3.0",
"https://purl.imsglobal.org/spec/lti/claim/deployment_id": "[Deployment ID]",
"https://purl.imsglobal.org/spec/lti/claim/target_link_uri": "https://samegoal.com/iep/lti/launch",
// Context Claim (Program)
"https://purl.imsglobal.org/spec/lti/claim/custom": {
"program_id": "[Program]",
"student_id": "[Internal SIS Student ID]"
},
// Role Claim
"https://purl.imsglobal.org/spec/lti/claim/roles": [
"http://purl.imsglobal.org/vocab/lis/v2/membership#Instructor"
]
}
LTI Tool retrieves LTI Platform public keyset to decrypt id_token payload:
GET https://vendor-app.com/api/lti/jwks
LTI Tool finally 302 redirects to an LTI Tool-hosted document viewer web page if id_token is successfully decrypted.