Abandon LTI 1.1

If you need any help in filling out this wiki page, please visit our ILIAS Community FAQ.

1 Reasons to Abandon Feature

LTI 1.1 (together with the related versions 1.0, 1.1.1, 1.1.2, 1.2 and LTI 2.0) was formally deprecated by 1EdTech (formerly IMS Global). 1EdTech stopped issuing new certifications for these versions on December 31, 2019, stopped recertifications on June 30, 2021, and ended all support on June 30, 2022 (see https://www.1edtech.org/lti-security-announcement-and-deprecation-schedule): "All support for LTI versions 1.0, 1.1, 1.1.1, 1.1.2, 1.2, and 2.0 will end on June 30, 2022. All institutions and suppliers should adopt LTI 1.3 and LTI Advantage for teaching and learning integration to receive its many benefits." Support for these versions has therefore already been over for several years.

The core reason for the deprecation is security. LTI 1.1 launches and outcome/grade services are authenticated with OAuth 1.0a request signing, based on a shared consumer key/secret transmitted with every request, without key rotation or asymmetric cryptography. In its Security Framework (May 2019), 1EdTech "formally deprecates the use of OAuth 1.0a across all 1EdTech specifications" in favor of OAuth 2.0 and OpenID Connect. LTI 1.3 replaces this with an OIDC third-party login initiation flow and JWTs signed with rotating keys (JWKS), which 1EdTech describes as making "LTI Advantage the most secure integration option available".

ILIAS already fully implements LTI 1.3 and LTI Advantage on both the consumer side (LTIConsumer component) and the provider side (LTIProvider component), so every current LTI 1.1 use case is already covered by a supported, more secure alternative. Keeping LTI 1.1 means maintaining two parallel authentication/signing code paths (OAuth 1.0a vs. OIDC/JWT) and two grade-sync implementations (Basic Outcomes vs. LTI Advantage AGS) in the ILIAS core, which increases the attack surface and the maintenance burden without adding functionality.

Proposal: remove LTI 1.1 support starting with ILIAS 12.

2 Technical Information

Dependencies: the feature lives in two core components. LTIConsumer (ILIAS acting as LTI Consumer/Platform towards external tools): class.ilLTIConsumeProvider.php stores a per-provider "lti_version", which currently defaults to "LTI-1p0" (LTI 1.1) for newly created providers; class.ilLTIConsumeProviderFormGUI.php exposes LTI 1.1 and LTI 1.3 as mutually exclusive radio options. LTIProvider (ILIAS acting as LTI Tool/Provider consumed by external platforms): the InternalProvider classes (ilAuthProviderLTI, ilLTIPlatform, ilLTIProviderObjectSetting) handle both OAuth 1.0a-signed LTI 1.1 launches and OIDC/JWT-based LTI 1.3 launches. Grade/outcome synchronization (ilLTIConsumerServiceBase and related grade-service classes) still implements the LTI 1.1/2.0 Basic Outcomes model (OAuth-signed requests) in parallel with LTI Advantage AGS (1.3). The underlying protocol library is celtic/lti (^5.0.0, via composer, with ILIAS-specific patches under imsglobal/lti); it implements both LTI 1.1 and 1.3, so it remains a dependency after this change and is not removed, only the OAuth 1.0a code paths ILIAS builds around it for 1.1.

Necessary modifications: remove the LTI 1.1 (LTI-1p0) option from ilLTIConsumeProviderFormGUI and make 1.3.0 the only selectable/default version; add a database update step (similar to class.ilLTIConsumerDatabaseUpdateSteps.php) to migrate or flag/deactivate existing LTIConsumer objects whose lti_version is still LTI-1p0; remove OAuth 1.0a signing/verification from the grade/outcome services and from the InternalProvider launch validation, keeping only the OIDC/JWT-based 1.3 launch and LTI Advantage AGS; remove the corresponding admin UI strings (e.g. lti_con_version_1.1) and settings forms; update the automated test suites (ilLTIConsumeProviderTest.php, ilLTIToolConsumerTest.php).

Security: LTI 1.1 authenticates launches and outcome requests via OAuth 1.0a signing with a shared consumer key/secret sent with every request, without key rotation or asymmetric cryptography. LTI 1.3 uses an OIDC login flow plus JWTs signed with rotating keys (JWKS). 1EdTech itself has formally deprecated OAuth 1.0a across its specifications in favor of OAuth 2.0/OIDC, so dropping LTI 1.1 removes a known-weaker, unsupported authentication mechanism from the ILIAS core and reduces the code's attack surface.

Performance: no relevant performance impact is expected; LTI 1.1 support does not carry a measurable overhead independent of LTI 1.3.

3 Contact

4 Funding

Removing the feature from the ILIAS code base might need funding. If you are interest in funding this request, please add your name and institution to this list.

5 Discussion

Use the following discussion section to express your objections against this request or your consent to get rid of this feature.

6 Implementation

{The maintainer has to give a description of the final implementation and possible consequences for existing installations.}

Removed Testcases

The following testcases have been removed from Testrail or modified because the feature is no longer part of the ILIAS core.

Approval

Approved at {date} by {user}.