Implement an LTI 1.3 tool launch (OIDC third-party login flow)

Steps

1. Register your tool with the platform (LMS) by providing your OIDC initiation URL, redirect URI, public key or JWKS URL, and client ID
2. Receive the OIDC Login Initiation request from the LMS as a POST or GET to your initiation URL, containing iss, login_hint, target_link_uri, and lti_message_hint parameters
3. Validate that the iss and client_id are recognized, generate a cryptographically random state value and nonce, store them (e.g., in a cookie), and redirect the browser to the platform's OIDC authorization endpoint with response_type=id_token, scope=openid, and the state and nonce included
4. Receive the id_token as a FORM POST to your redirect URI; validate the state matches your stored value, then decode and verify the JWT signature using the platform's public JWKS
5. Extract the LTI claims from the JWT payload (such as https://purl.imsglobal.org/spec/lti/claim/context and roles) and establish the user's session in your tool