SIS → LMS roster sync over LTI Advantage (NRPS)

Keep LMS course rosters in sync with the SIS using LTI 1.3 Advantage Names and Role Provisioning Service (NRPS). This replaces nightly flat-file dumps with real-time membership calls initiated by the LMS against the SIS platform endpoint. The SIS acts as the LTI 1.3 Platform; the LMS acts as the Tool. All calls use OAuth 2.0 bearer tokens with RS256 JWT signatures.

Phases

1. Discovery and Registration. Register the LMS as an LTI 1.3 tool with the SIS. The LMS presents its public key (JWKS at /api/lti/.well-known/jwks.json), redirect URIs, and OIDC login initiation URL. The SIS records the tool's client_id, grants the names_and_roles scope, and issues a platform-level installation ID. Validate that the SIS security document exposes a memberships endpoint before proceeding.
2. OAuth2 Authentication Flow. On each sync cycle the LMS initiates OIDC login against the SIS authorization endpoint. The SIS returns an id_token; the LMS validates the signature against the JWKS, confirms the aud claim matches its client_id, and exchanges the id_token for an access token via the token endpoint. Store the access token and refresh token securely (AES-256 at rest minimum).
3. NRPS Endpoint Discovery. From the access token response, extract the memberships service URL. The endpoint follows the pattern {platform_base}/api/lti/courses/{course_id}/names_and_roles. Verify the endpoint accepts a limit pagination parameter and optionally a !update timestamp for delta queries.
4. Memberships Pull. For each course, GET the memberships endpoint with an Authorization header (Bearer {token}). The response contains a context object (course identifier) and a members array. Paginate through all pages using the next link. Map each members[].role value to an internal role constant:
   • Student / Enrollment → Learner
   • Instructor → Instructor
   • TA / TeachingAssistant → TeachingAssistant
   Capture members[].status (Active or Inactive) and lis_person_sourcedid as the stable SIS person identifier.
5. LMS Write-Back. Ingest the normalized membership list. For each member: look up the LMS user by lis_person_sourcedid (or create by email with update_on_email_match = true). Compute the delta against the current LMS enrollment table: additions, removals, role changes. Write changes via the LMS enrollments API (e.g., Canvas POST /api/v1/courses/{id}/enrollments). Handle instructors and TAs with enrollment_type = teacher or ta; do not use designer for instruction-capable roles.
6. Error Handling and Retry. If the LMS returns HTTP 429, back off exponentially (start at 2s, cap at 5 min). If HTTP 401/403, refresh the token and retry once; if it fails again, raise an alert. Log every failed enrollment operation to a dead-letter queue for manual resolution. Set partial_sync_mode = true after three consecutive failures and halt the batch.
7. Cutover. Validate the sync by exporting the current SIS roster and the LMS enrollment list, then comparing counts and role distributions. Look for users present in the LMS but not in the SIS (deprovisioned users that should be suspended, not deleted). Verify instructor enrollments carry read-grade permission. After confirming accuracy, enable the NRPS sync as the authoritative source. Retain the CSV fallback export for 30 days.

Field Mapping