Articles in this section

See more

LTI 1.3 Single Sign-On Setup: D2L Brightspace

  • Updated
Follow

In This Article:

 

Overview

Learning Tools Interoperability 1.3 is a Single Sign-On standard that lets D2L Brightspace launch directly into Genius without a separate Genius login. A learner (or instructor) clicks a link inside Brightspace and lands signed into Genius automatically.

This is an additional way to connect Brightspace to Genius. It runs alongside the existing Learning Tools Interoperability 1.1 connection method. If your organization already has Learning Tools Interoperability 1.1 configured, it continues to work unchanged. Learning Tools Interoperability 1.3 uses a more modern security standard (OpenID Connect with signed tokens).

You'll configure both sides: a "registration" in Genius, and a matching LTI Advantage registration in D2L Brightspace. Each side needs something the other generates, so setup moves back and forth. See Setup Order before you start either side.

 

 

How It Works

At a high level:

  1. A user clicks a Learning Tools Interoperability 1.3 link inside Brightspace.
  2. Brightspace redirects the user's browser to Genius, carrying information about the launch.
  3. Genius sends the user back to Brightspace to confirm their identity via a signed security token.
  4. Brightspace returns that signed token to Genius.
  5. Genius verifies the token, matches the user to a Genius account, and signs them in.

Users never see any of these steps - they click a link and land in Genius already signed in.

Matching Brightspace users to Genius accounts

Genius matches users by Email for Brightspace registrations. Before completing setup, confirm that your Brightspace instance is configured to send a verifiable email address in the launch — this is controlled by the Security Settings on the deployment (see Step 2). Match Field: Username is not currently usable for Brightspace.

 

 

Setup Order: Why It's Not One-Directional

Each system needs something only the other can generate, so you'll move between Genius and Brightspace four times before setup is complete:

  1. Start in Genius. Two values Brightspace needs are already visible before you save anything.
  2. Configure Brightspace. Register the tool and create a deployment. This generates a Client ID and a Deployment ID — but the Keyset URL field can't be filled in yet.
  3. Return to Genius to finish the registration. Saving generates a JWKS URL that doesn't exist until this step.
  4. Go back to Brightspace to paste the JWKS URL into the Keyset URL field, and to add a launch entry point for users.

The steps below walk through each exchange in order.

 

 

Setup

Step 1 (Genius): Get the Two URLs Brightspace Needs

  • Navigate to Administration → Integrations → LTI 1.3 Registrations.
  • Select New Registration. Don't fill anything in yet. The form immediately shows a Tool URLs card with a Login Initiation URL and Redirect URI, visible before you save or fill in anything else. These two URLs are fixed per Genius environment, not per registration.
  • Copy both URLs, then keep this tab open and proceed to Step 2. Nothing you'd enter here is saved until you submit the form.

 

Step 2 (Brightspace): Start the LTI Advantage Registration

Whoever administers your D2L Brightspace instance handles this step. Steps use Brightspace terminology as of when this article was written.

  1. In Brightspace, go to Admin Tools > Manage Extensibility, then select the LTI Advantage tab.
  2. Select Register Tool, then choose the Standard registration option (not Dynamic Registration).
  3. Fill in the registration form:
    • Name (required): a friendly label (e.g. "Genius").
    • Domain (required): the base domain of your Genius tenant (e.g. https://your-tenant.geniussis.com). Use your Genius tenant domain here - not Genius's authentication host domain, which is different.
    • Redirect URLs (required): paste Genius's Redirect URI from Step 1.
    • OpenID Connect Login URL (required): paste Genius's Login Initiation URL from Step 1.
    • Target Link URI: the Genius destination this registration launches to by default. Should match one of the Target URIs you'll enter in Step 3.
    • Keyset URL: leave blank for now - Genius's JWKS URL doesn't exist until you save the registration in Step 3. You'll come back to fill this in during Step 5.
Screenshot of Register a Tool window
  1. Leave all LTI Advantage service extensions disabled - Genius's Learning Tools Interoperability 1.3 integration is Single Sign-On only and doesn't use grade passback, names and roles, or other services. 
  1. Select Save. Brightspace shows a Registration Details confirmation screen. Copy these three tenant-specific values - you will need them in Step 3: 
  • Issuer (Genius field: Issuer URL) 
  • OpenID Connect Authentication Endpoint (Genius field: Platform OIDC Auth URL) 
  • Brightspace Keyset URL (Genius field: Platform JWKS URL). This is Brightspace's own public key — not the Keyset URL input you left blank earlier, which is where Genius's key goes. 
Screenshot of Brightspace registration details

Note: All three values above are tenant-specific. Copy them from this screen; do not reuse example values from documentation. 

  1. Select View Deployments on the Registration Details screen, then select New Deployment. Fill in: 
  • Enabled: leave the toggle on. 
  • Tool (required): select the tool you just registered. 
  • Name (required): a friendly label for this deployment (e.g. "Genius SIS"). 
  • LTI Advantage service extensions: leave disabled.
Screenshot of Deploy Tool settings

 

7. Under Security Settings, make sure User Information is checked, and under it, Email is checked. Genius needs the user's email address in the launch token to match users. Without this, sign-in will fail. 

Screenshot of Security Settings

 

8. Select Save. The deployment's Deployment ID now appears on the LTI Advantage list. Copy it - you'll enter it into Genius in Step 3.

Screenshot of Brightspace Deployment Details

You now have a Client ID and a Deployment ID. Proceed to Step 3.

 

Step 3 (Genius): Finish the Registration

Return to the New Registration form in Genius and fill in the remaining fields:

Field What to enter
LMS Name A friendly label for this connection (e.g. "Brightspace - Production"). For your reference only.
Issuer URL Tenant-specific — copy from the Registration Details screen in Step 2.
Client ID Generated when you saved the tool registration in Step 2.
Deployment ID Generated when you created the deployment in Step 2.
Platform OIDC Auth URL Tenant-specific — copy from the Registration Details screen in Step 2.
Platform JWKS URL Tenant-specific — copy from the Registration Details screen in Step 2.
Match Field Use Email. Match Field: Username is not currently usable for Brightspace — see the warning below.
Algorithm RS256 or ES256, the signing method Genius uses for its own key pair. If unsure, use RS256.
Target URIs One or more destination pages inside Genius that Brightspace is allowed to launch into, each with a Label and a URI. Brightspace can only launch to URIs listed here. Decide these ahead of time.

Note: Only Client ID and Deployment ID come from the deployment steps. Issuer URL, Platform OIDC Auth URL, and Platform JWKS URL are all tenant-specific for D2L Brightspace — copy them from the Registration Details screen shown after saving the tool registration in Step 2.

Warning: Match Field: Username does not work for D2L Brightspace. Brightspace sends the username inside a nested claim that Genius's current implementation cannot resolve. Use Match Field: Email. 

 

Select Create Registration. 

Screenshot of Create Registration window

 

After saving, the registration's detail page shows a Tool URLs section including the JWKS URL. This URL only exists now because it's tied to this registration's ID. Copy it. 

Screenshot of Tool URLs

 

Genius shows you Paste it into Brightspace as
JWKS URL Keyset URL

(The Login Initiation URL and Redirect URI also appear here again - you already entered those into Brightspace in Step 2.) 

 

Step 4 (Brightspace): Add a Launch Entry Point

Making Genius launchable for users requires two steps: creating a Basic Launch link under the deployment, then surfacing it in a navbar.

  1. Go to Admin Tools > Manage Extensibility > LTI Advantage, select your deployment's name, then select the Links tab, then Create Link.
  2. Fill in the form:
    • Name (required): e.g. "Genius SIS".
    • URL (required): one of the Target URIs configured on the Genius registration in Step 3.
    • Type: leave as Basic Launch.
  3. Save.
Screenshot of Create Link window
  1. Go to Admin Tools > Navigation & Themes, select the Custom Links tab, then Create Link. 
  1. In the URL field, select the Insert Quicklink button — do not type or paste a URL directly into this field (see the warning below). In the picker that opens, select External Learning Tools, then select the row whose LTI Advantage Deployment column shows your deployment's name. If multiple rows appear with the same display name, pick the one tied to your deployment. 
  1. Set Behavior to New window/tab. This prevents the third-party-cookie session issue that affects iframe-embedded launches. 
  1. Save. 
Create Custom Link window

 

Insert Quicklink window

 

8. Add the custom link to the active navbar for the course or org unit where you want it to appear.

Warning: Do not paste Genius's URL directly into the Custom Links URL field. Brightspace must resolve the link through Insert Quicklink > External Learning Tools to tie it to your Learning Tools Interoperability deployment. Pasting a raw URL creates a plain hyperlink that will not trigger the Single Sign-On launch. 

 

 

Step 5 (Brightspace): Finish the LTI Advantage Registration

Now that you have the JWKS URL from Step 3, return to Brightspace to complete the registration.

  1. Go to Admin Tools > Manage Extensibility > LTI Advantage, then select your registration's name.
  2. On the Registration Details screen that appears, select Done to dismiss it and reach the Edit form.
  3. Paste the JWKS URL from Genius's registration detail page into the Keyset URL field.
  4. Save.

Both sides are now fully configured. 

 

 

Day-to-Day Usage

Once the registration is Active, launches run automatically. This section covers ongoing maintenance.

Enabling / Disabling a Registration

Navigate to Administration → Integrations → LTI 1.3 Registrations and open the registration you want to manage. Select Disable to immediately block all launches through that registration. Select Enable to restore it.

Warning: Disabling a registration immediately blocks all launches through it. Re-enable it to restore access.
Screenshot of disable registration warning

 

 

Troubleshooting

Issue Possible Cause Resolution
Clicking the Brightspace link does nothing, or shows a generic error Registration is Disabled; or Client ID, Issuer URL, or Deployment ID doesn't exactly match what's in Genius Check that the registration's Status is Active; re-verify Client ID, Issuer URL, and Deployment ID match exactly between Brightspace and Genius
Users land in Genius but aren't recognized, or are matched to the wrong account Match Field: Email is selected but Brightspace isn't sending a verifiable email address in the launch — check Security Settings on the deployment In Brightspace, open the deployment and confirm User Information and Email are both checked under Security Settings (see Step 2)
Everything looks correctly configured but launches still fail Genius couldn't verify Brightspace's signed response, generally due to a field not matching what's on the Genius registration Re-verify every URL and ID pasted between the two systems for typos — Learning Tools Interoperability 1.3 requires exact matches on both sides
Match Field: Username never matches any account Brightspace sends the username inside a nested claim that Genius's current implementation cannot resolve Switch to Match Field: Email for Brightspace registrations
Navbar link opens a plain page or a blank Genius page, not the signed-in destination The custom link was added via a raw URL paste rather than Insert Quicklink > External Learning Tools, so the Single Sign-On token is never generated Delete the custom link and recreate it using Insert Quicklink > External Learning Tools (see Step 4)
Navbar link behaves like a Learning Tools Interoperability 1.1 launch rather than Learning Tools Interoperability 1.3 The link was created from an External Learning Tools row with a blank LTI Advantage Deployment column — that row is a legacy Learning Tools Interoperability 1.1 entry In the Insert Quicklink > External Learning Tools picker, verify the selected row shows your deployment's name in the LTI Advantage Deployment column, not a blank entry

 

 

Best Practices

  • Follow the setup steps in order. Start in Genius and copy the Login Initiation URL and Redirect URI before creating anything (Step 1); use those to register the tool in Brightspace and create the deployment (Step 2); finish the Genius registration with the resulting Client ID and Deployment ID (Step 3); then add the launch entry point and paste the JWKS URL back into Brightspace (Steps 4 and 5). You'll move between both systems twice.
  • Use a descriptive LMS Name for each registration. If your organization connects more than one Brightspace instance (e.g. separate production and test), that field is for your reference only — a clear name makes it easier to manage multiple registrations.
  • Disable rather than deleting a registration you want to pause. There is no delete action. Disabling is instant and reversible; it preserves all configuration so you can re-enable without starting over.
  • Set custom links to open in a new window or tab. In Navigation & Themes > Custom Links, set the Behavior field to New window/tab (see Step 4). This avoids the third-party-cookie session issue that affects iframe-embedded launches.
  • Use Match Field: Email. Match Field: Username is not currently usable for Brightspace. Email is the only reliable option.

Comments

0 comments

Article is closed for comments.