As an admin, you can configure LTI 1.3 (LTI Advantage) single sign-on (SSO) so your users launch Impact directly from Canvas without a separate login. Canvas remains your primary identity provider (IdP), and Impact trusts Canvas to verify user identities.
Once SSO is set up, a user clicks the Impact link in their Canvas navigation, Canvas authenticates the user through LTI 1.3 (OIDC), and Impact opens in a new tab with the user already logged in.
Notes:
- Developer Keys is an account permission. If you cannot view the Developer Keys link in Account Navigation, this permission has not been enabled for your user account.
- LTI SSO handles authentication, but it does not provision new user accounts. Users must already be invited to Impact, or have access through your organization's onboarding flow, to log in.
- Forced LTI is optional and requires two steps: configure the LTI yourself, then submit a ticket to Impact Support to turn on the Forced LTI option. Once it's active, Impact admins can only launch Impact through the LTI in Canvas and can't sign in directly at app.impact.instructure.com.
Check Prerequisites
Before you begin, confirm you have the following:
- Canvas Administrator access, with permission to create developer keys and external apps.
- A current Impact subscription.
- Impact Subscription Administrator access, with permission to change single sign-on settings.
Set Up Configuration in Impact
Open Impact Settings
Log in to your Impact administrator dashboard. Click the Settings icon [1], then select Settings link [2].
Edit Single Sign-On Account
Click the Single sign-on tab [1]. Locate the account requiring LTI enablement and click the Edit button [2].
Copy Generated URLs
Impact generates three URLs for your instance: a JWKS URL [1], an OpenID Connect Initiation URL [2], and a Target Link URI [3]. Copy all three values to paste into Canvas in the next section. Keep this browser tab open to complete setup in a later step.
Create Developer Key in Canvas
Open Developer Keys
In a new tab, log in to Canvas as an administrator. In Global Navigation, click the Admin link [1], and then click the name of your account [2].
In Account Navigation, click the Developer Keys link [3].
Add LTI Key
Click the Add Developer Key button [1]. Then, click the LTI Key option [2].
Enter Settings
Enter the basic settings for the key:
- Key Name [1]: Impact
- Owner Email [2]: your preferred IT or administrator contact email
- Method [3]: select Paste JSON from the drop-down menu
Copy the template below, paste it into the configuration block [4], and replace each placeholder with the matching URL you copied from Impact.
{
"title": "Impact",
"description": "Impact Analytics",
"target_link_uri": "PASTE_YOUR_TARGET_LINK_URI_HERE",
"oidc_initiation_url": "PASTE_YOUR_OIDC_INITIATION_URL_HERE",
"oidc_initiation_urls": {},
"public_jwk_url": "PASTE_YOUR_JWKS_URL_HERE",
"public_jwk": {},
"custom_fields": {},
"scopes": [],
"extensions": []
}Save Key
For Canvas to parse data correctly, click the Sync URIs button [1]. Then, click the Save button [2].
These settings make Impact open in a clean, full-sized browser tab.
Set Privacy Level
Find your new developer key and click the Edit icon [1]. Under Additional Settings [2], set the Privacy Level to Public so user context passes safely [3].
Add Account Navigation
To pin Impact to your sidebar, in the Placements drop-down menu, select the Account Navigation option [1]. In the Target Link URI field, enter the appropriate regional domain depending on your account's region [2]:
Note: A Target Link URI is required; otherwise, a 404 error occurs when launching LTI.
Update Placement JSON
In the Method drop-down menu, change the configuration method to Paste JSON [1]. Locate the placements section at the bottom of the JSON [2] and update it to match the snippet below. This forces Canvas to launch Impact in a new window. Then, click the Save button [3].
"placements": [
{
"placement": "account_navigation",
"message_type": "LtiResourceLinkRequest",
"windowTarget": "_blank"
}
]Activate Key
In the Developer Keys table, locate Impact [1] and then click the State toggle on [2].
Add Impact App to Canvas
In Admin Navigation, click the Apps link [1]. In the Manage tab [2], locate Impact and click the app name [3].
Unlock App
In the App details page, click the Unlock app button [1]. Then, in the Availability and Exceptions tab [2], click the Edit icon [3].
Update Availability
Verify that the status is set to Available. If necessary, click the drop-down menu and select the Available option [1], then click the Save button [2].
Copy Client and Deployment ID
To copy the client ID, click the Copy Client ID button [1]. Then, select and copy the Deployment ID [2].
Finish Configuration in Impact
Return to the open Impact browser tab and paste yourCanvas Client ID [1] and Deployment ID [2] into their respective fields. To save your changes, click the Save button in the LTI Configuration menu [3], then click the Save button in the main Settings page.
Test Configuration
Before you roll this out to your team, verify the setup:
- Open your Canvas Admin dashboard.
- Click the Impact link in your account navigation sidebar.
- Confirm that a new tab opens, that you bypass the Impact login prompt, and that you land on your active dashboard.
Troubleshooting
Issue
|
Likely cause
|
Resolution
|
|---|
Redirect error
|
Redirect URI mismatch
|
Verify that the Canvas Target Link URI exactly matches the URI on
your Impact setup screen.
|
User not logged in
|
Account missing in Impact
|
Confirm the user has received and accepted an active invitation to
Impact.
|
Missing email or profile errors
|
Incorrect Privacy Level
|
Set the developer key Privacy Level to Public in Canvas.
|
App not visible
|
Placement not active
|
Confirm that Account Navigation is listed under active placements
in the developer key settings.
|
Note: If you hit an error these steps don't resolve, contact Impact Support and include your Canvas Client ID, your Deployment ID, and the approximate timestamp of the failed login attempt.
Glossary
- LTI: Learning Tools Interoperability, the standard protocol for connecting an LMS with external applications.
- OIDC: OpenID Connect, the identity verification protocol that signs users in.
- JWKS: JSON Web Key Set, the cryptographic keys that verify data passed between Canvas and Impact hasn't been tampered with.
