LTI integration with Moodle LMS: Error: The keyset URL did not return a valid JWKS document. Expected a JSON object with a 'keys' array per RFC 7517

The error messages indicate that Moodle cannot validate the LMS public keyset URL and cannot complete the OAuth token flow for the Microsoft 365 LTI registration.

Based on the documented setup and troubleshooting guidance, the following checks and actions apply:

1. Validate the LMS public keyset URL
   • The Microsoft LMS Gateway requires a valid JWKS document from the LMS public keyset URL.
   • Ensure that the Public keyset URL copied from the Moodle tool configuration details is entered exactly in the Microsoft registration portal under Keyset URL.
   • Confirm that this URL is reachable and not blocked by network or firewall rules for requests originating from https://lti.microsoft.com/.
   • If the public keyset URL is incorrect or inaccessible, the Microsoft registration portal will raise the error: “The keyset URL did not return a valid JWKS document. Expected a JSON object with a 'keys' array per RFC 7517.”
   • Correct the URL in the registration and retry.
2. Reconfirm all LMS-provided registration keys For Moodle, the Microsoft registration portal expects the following values copied from the Moodle tool configuration details:
   • Issuer ID URL: Platform ID
   • Client ID: Client ID
   • Keyset URL: Public keyset URL
   • Platform authentication URL: Authentication request URL
   • Deployment ID: Deployment ID
   • Access token URL: Access token URL (for Microsoft 365 LTI and Teams Assignments LTI)
   Verify each field carefully against the Moodle “View configuration details” modal. Any mismatch (especially Client ID or Access token URL) can cause the “Token acquisition failed. The LMS platform rejected the authentication request” error.
3. Verify the Access token URL
   • Ensure the Access token URL from Moodle is copied exactly into the Microsoft registration portal.
   • If the Access token URL is wrong or incomplete, the LMS will reject the authentication request and the portal will report AccessTokenUri: TokenAquisitionFailed.
4. Confirm the registration flow order
   • In Moodle:
     1. Configure the external tool (Microsoft 365 LTI / Microsoft Education) with the values from the Microsoft registration portal.
     2. Save changes.
     3. Open View configuration details for the tool and copy the Platform ID, Client ID, Public keyset URL, Authentication request URL, Deployment ID, and Access token URL.
   • In the Microsoft registration portal:
     1. Select Next to the LMS-provided registration keys page.
     2. Paste each value into the corresponding field.
     3. Select Next, then Review and save and Save.
5. Check for incomplete or deleted registrations
   • If the registration was partially completed or deleted in Microsoft LMS Gateway, the portal can report registration validation errors.
   • Re-run the registration from scratch, ensuring all steps are completed in one flow.
6. Network and cookie considerations (for launch issues after registration)
   • If launch issues occur after registration, ensure third-party cookies are allowed for the LMS URL in the browser, as required for the LTI 1.3 handshake.
   • Also ensure the public keyset URL is not blocked by network settings.
7. Escalation to Microsoft Education Support
   • If the public keyset URL and Access token URL are confirmed correct and accessible, but the Microsoft registration portal still reports JWKS or token acquisition errors, LMS admins should contact Microsoft Education Support for deeper investigation of the LMS–Gateway interaction:
     • Microsoft Education Support

These steps align with the documented Moodle and generic LTI registration flows and the LMS Gateway troubleshooting guidance, focusing specifically on the public keyset URL and Access token URL validation.

References:

• Integrate Microsoft Reflect LTI with Moodle
• Deploy the Microsoft 365 LTI® app in Moodle™
• Use Teams Assignments LTI with Moodle™
• Deploy the Microsoft 365 LTI® app in any LTI 1.3 compliant LMS
• Manage Microsoft LMS Gateway for any LMS