[ARCHIVED] Canvas Google Apps LTI authorization failures

[johnmartin]

• UPDATE Jan 18, 2018  —Still broken. No word on a fix....
• UPDATE Aug 8, 2017  —Canvas recognizes this is a bug and is working on a fix (Cases #01843701, #01865357, #02000557). Not sure how or where to get updates on their progress.
• UPDATE Aug 4, 2017  —Still broken. Still no error message suggesting the user switch browsers or login to Chrome with another account. Still many confused users getting frustrated because Canvas doesn't work .
• UPDATE Apr 24, 2017 —Still broken. Not answered. Don't let the "Assumed Answered" label fool you.
• UPDATE Apr 20, 2017 —Still broken. No movement to fix on Instructure's part. They say it's "working as designed." If so, their design that forces students to jump through more hoops (see comments below) to access course content is a bad one. The goal should be to minimize navigation efforts and maximize access to content. The Canvas Google Apps LTI fails in this criteria.

ORIGINAL ISSUE, AS IT STILL STANDS — The Canvas Google Apps LTI authorization is failing on me in Chrome in one course (not others), and observed with faculty. Anyone else? Workarounds?The chat with Instructure support helped determine that it worked in Firefox but not Chrome. They suspected it may have something to do with being logged into multiple accounts. His boss suggested that the Google Apps LTI might need to be re-setup (by our Admin). 

Here's a screencast of the issue: Canvas Google LTI failures - YouTube 

More troubleshooting:

1. I cleared all Instructure and Canvas cookies,
2. then logged out of all Google accounts in Chrome,
3. then shut down and restarted Chrome.
4. Then opened afflicted Canvas course (https://canvas.wisc.edu/courses/39891/pages/feb-3-rubrics-in-canvas)
5. Still saw no Google content and was asked to Authorize. Authorization fails.

Note: 

• works in Incognito mode in Chrome.
• works in other Canvas courses in Chrome.
• works in Firefox.

Final bit of troubleshooting:

• it seems to definitely be the Canvas tool's issue. 
• a manual Google Doc iFrame embed works fine in Chrome, in that course.

[garth · Accepted solution]

 @johnmartin ‌ I haven't used Google Apps LTI, and would be interested to know more about what you are experiencing.

Please post back with any info you learn.

[johnmartin · Accepted solution]

Thanks  @jomontuori  . Yes, this has always worked for me. The problem is that we'd have to explain this to 60,000 users who are used to not having a problem using multiple Google accounts — they don't have to do this with other Google API integrations; just Canvas. This special exception for Canvas, imho, should be removed as a matter of removing barriers for learning. 

In the meantime, the other workaround — that doesn't require users to change ingrained behavior to access course content — is to use iFrame embedding.

I surely hope Instructure can recognize that adding this barrier for student-access to content is a step backwards that should be done correctly.

thanks!

John

[Rmorgant]

2020 my course shows this same error.

however u see student view only. My worry is my class of 500 won’t see all of the course content.

i need a fix but canvas for help I’ve been on chat waiting at #99 for 3 days! I’ve called and it said 1 hour wait!

[c8jones]

I had the same issue: cleared cookies, signed out of accounts etc, didn't work in incognito.

I resolved it by clicking "Submitted Files: (click to load)" in the panel on the right.

Edit: this was a different submission type. I still have this issue.

[EitanSeitchik]

Has literally anyone figured it out?  It's so frustrating.

[ZackDrucker · Accepted solution]

Hey Everyone - I have the solution!  At least it worked for us...

This does involve going into Google Admin and making a change to the Sharing settings for the Drive and Docs app settings.

1 - Go here

2 - Scroll to Option 2, then number 2 "Go to Apps > Google Workspace > Drive and Docs"

3. Make sure you are in the Sharing Settings, then choose the proper OU that you would like to make the change for.

4. The setting that needs to be on is: "When sharing outside of "your institution name" is allowed, users in "current OU" can make files and published web content visible to anyone with the link.

[Adeel-Raza]

@johnmartin I am facing an error on my custom LTI tool launch on Chrome as well, It says,
 - Please make sure you have cookies enabled in this browser and that you are not in private or incognito mode

Although cookies are enabled and it's not incognito. When I load the tool in a new window instead, the error goes away and it works fine. I am assuming it has to do with recent Chrome security updates about iFrame usage. Looks like there is a missing piece by Canvas to ensure that this error does not occur on Chrome for LTIs

[garth · Accepted solution]

 @johnmartin ‌ I haven't used Google Apps LTI, and would be interested to know more about what you are experiencing.

Please post back with any info you learn.

[johnmartin]

Google Apps LTI is still broken for me and some of our faculty.

More trouble shooting.

1. Campus admin "reset" the LTI as suggested by Canvas help.

Authorization Failed

1. Removed all instructure cookies.
2. Removed all Canvas cookies.
3. Restarted Chrome.
4. Reopened Canvas course.
5. Reauthorized as directed.

Authorization Failed

1. Removed all Chrome extensions
2. Removed all Canvas & Instructure cookies
3. Restarted Chrome & Canvas
4. Reauthorized.

Authorization Failed

1. Re-registered Google Drive in Account settings.
2. Re-Integrated "User-Generated Google Apps Integration LTI" in Account settings.
   • 1. Click on "Account" in the left-hand navigation
     2. Click on "Settings"
     3. Scroll down to "Approved Integrations"
     4. Find the integration titled "Google Drive LTI IAD-Prod"
     5. Click the trashcan to the right of that integration
     6. Try again to authorize your account to Google
3. Reauthorized.

Authorization Failed

• Google Apps LTI still works in Firefox and in Chrome Incognito mode
• Google docs still embed nicely if manually iframed

Anyone from Canvas looking into this?

[johnmartin]

Here's a screencast of the issue.

Canvas Google LTI failures - YouTube 

[Stef_retired]

 @johnmartin , your screencast didn't come through; could you re-post?

[johnmartin]

Ugh, I dislike that the community forum doesn't support embeds... 😞

(Link added to post)

[jomontuori]

 @johnmartin , my co-Canvas Admin and I have experimented with the Google Apps LTI in our Canvas instance, a K-12 district, with our own Google domain. 

My district Google account authorization in Canvas worked at first. Now it doesn't. My co-Admin's is still working, as is that of another colleague, a teacher without Admin access.

One other factor that may be relevant. My co-Admin and I both added the Google LTI, independently, and at different moments. We wondered if that somehow created my problem.  

[tross]

We have found that we have to login to the google account that is linked to our Canvas account first and then use the LTI.   If we do that it works,  if we don't we get the authorize.  Most of our users use Chrome.  Since you have to login first, it works really well on Chromebooks because you have to login to the chromebook and for us that is the account that is tied to Canvas.  

[johnmartin]

Canvas replied: 

The Google Drive Registered Service is not related to the Google LTI other than being you log into your Google Account with both. So the account signed up for the registered service should not affect the Google LTI log in. 

You stated that when adding the two accounts in Chrome, you were still unable to authorize. I have been testing this and was unable to replicate the issue. When I add the two accounts to my Google account on Google.com the LTI will authenticate. I have created a screencast of my testing that I hope helps: https://screencast.com/t/ejAG2lBwNDEW. 

Don't hesitate to let me know if you are still coming across this issue, I'd be more than happy to give you a call if needed so we can get this going for you. Please let us know if you have any additional questions; happy to help

When we are done responding to a case we put it in pending waiting for a response. Were you able to look at my screencast, to see my findings? Please let us know if you have any additional questions; happy to help

I responded: 

Alas, my experience is still different than yours. I've created another screencast doing what you did in your screencast. Sorry for the poor audio quality.

Thanks for digging into this further!

John

[emihunt]

We really need a definitive answer as to how the Google Drive "Registered Service" interacts with the LTI. The reply you received here ("The Google Drive Registered Service is not related to the Google LTI other than being you log into your Google Account with both") is fairly consistent with the documentation ("For any of your courses, if the Course Navigation Menu includes a Google Drive link, your institution or instructor has enabled a global Google Drive integration. You do not need to enable Google Drive as a web service"), but I've been receiving conflicting information from Canvas Support/seeing different behavior in testing. We were told by support to add Drive as a Registered Service to fix some auth errors (which worked--but before doing so no Google accounts had been added to Registered Services as directed in the doc I linked above), and we were just told today that having a Google account in Registered Services that is different from the account you're authorizing in Collaborations will cause issues. Confirming at minimum that the tool should work without any Google accounts added to Registered Services would be a step in the right direction -- and would suggest that some of the behavior we've seen is indeed buggy/not intended.

[jomontuori]

Ah. Problem resolved for me. Hope this helps you too,  @johnmartin ! 

I was logged into Google Drive with my district Google account (the one I was also authorizing Canvas to access). However, I was logged into my Chrome browser using my personal Google account. Apparently, this was causing a conflict. Frankly, I don't even remember logging into Chrome, but it's a setting that remains even when you restart your device. 

So once I logged into Chrome with the same Google account in Chrome, Drive, and the Google App LTI authorization, the Google Apps LTI worked fine. 

[johnmartin · Accepted solution]

Thanks  @jomontuori  . Yes, this has always worked for me. The problem is that we'd have to explain this to 60,000 users who are used to not having a problem using multiple Google accounts — they don't have to do this with other Google API integrations; just Canvas. This special exception for Canvas, imho, should be removed as a matter of removing barriers for learning. 

In the meantime, the other workaround — that doesn't require users to change ingrained behavior to access course content — is to use iFrame embedding.

I surely hope Instructure can recognize that adding this barrier for student-access to content is a step backwards that should be done correctly.

thanks!

John

[johnmartin]

Here's what a standard embedded iframe looks like in a page vs what the Canvas LTI integration looks like:

[johnmartin]

Another Update: 

Hi Aiona, 

What is the problem?

I see this behavior (Canvas Google LTI Authentication failure loop) in *any* course, whether I am enrolled as a student or instructor — if I am logged into a Chrome browser window with my personal Gmail account. If I log into the browser window with my campus Google Apps account, it works fine.

Why is this a problem then? (Why not just log in to Chrome with your campus account?)

Logging into Chrome with my campus account is a workaround for me, but this re-education is not a workaround that easily scales to our >60,000+ users — most of whom have multiple Google accounts, and most of whom do not realize they're "logged in" — let alone with what account they're logged in with. Their other Google usage lets them be logged in with multiple accounts, and they switch back and forth at the tab (or web app) level, vs. the browser window level. So, since this isn't required in their other Google use, it shouldn't be a problem here either.

It seems that the Canvas Google LTI Integration pulls from the browser window login rather than from the tab or web app login. This seems to be non-standard. Perhaps if the LTI either asked in Settings which account to connect to, or pulled from the tab level login, it would not be an issue for UW-Madison.

thanks,

John

[johnmartin]

Canvas responds: 

"When a user logs in to their account, a session cookie is saved in the browser to identify a user's session (accounts.google.com); this cookie won't be destroyed until a user logs out. Since cookies can be shared between domains, if the same user requests to authenticate to any other Google hosted or third-party apps, it recognizes the account that they are trying to log into because of the cookie. Those keys won't be removed until they reach their expiration date. 

A mismatch in credentials could result in poor user experience and loss of privacy. I highly recommend adding accounts to the browser to avoid the issue you are encountering.

See online guide:
https://support.google.com/accounts/answer/1721977?hl=en

Let me know if you have any other questions."

[johnmartin]

My response: 

"

As you can see in this screen capture, I already have multiple accounts for the browser. Adding multiple accounts to the browser does not fix the issue I am encountering.

Notice that I'm logged into the browser with my personal Google account, and not with my Google Apps for Education (wisc.edu) account:

Now notice that I can access my Google Apps for Education (wisc.edu) account's Google Drive space — while still logged into the browser window with my personal account:

I imagine that most of our 60,000+ users do not pay attention to which account they use to log into Chrome. Most probably use the account they've used for years before coming to our campus. Those who access Canvas with their personal Android phone most certainly use their personal account. They do not need to log out of, or change accounts at the browser level to access any of their Google material. They do that at the tab level. I would like to do the same thing with the Canvas Google LTI, so I don't have to explain to each of them that Canvas is different than every other Google experience they've had."

[Chris_Hofer]

Hello  @johnmartin ‌...

I thought I would check in with you regarding this topic.  It looks like there hasn't been any activity in this particular discussion topic for a while.  In reading through your postings and the feedback from others, have you been able to completely resolve this issue with the Google Apps LTI, or are you still looking for some help from members of the Canvas Community?  Your most recent response above from March 3rd has some broken images, and so I'm not sure if you'd be able to re-upload those so that the Community could help you, if needed.  Because there hasn't been any new activity in this particular discussion topic for over a month, I'm going to mark your question as "Assumed Answered", but that won't prevent you or others from posting additional replies below.  I hope that's okay with you.  Looking forward to hearing from you, John.

[johnmartin]

Thanks Chris Hofer  I too am disappointed that Instructure is ignoring this issue. There has been no resolution. I still get regular complaints from faculty who get complaints from students about the extra steps Instructure has added for them to access course material.

I've updated the original post to this effect, and I've reuploaded the images to the earlier comment. Please unmark the "Assumed Answered" as I'm still hoping for a resolution to this issue. And forgive me for hoping that the Community forum was a place that Instructure monitored, or student accessibility was a thing they cared about .

[ssimpso4]

And in that same vein, here's my first attempt at a troubleshooting Doc to share with my users. I've enabled comment-rights via this link, so please let me know what I've left out or what might be improved as I'm welcoming as much feedback as possible so that it's comprehensive and accurate. 108336  @bmueller   @johnmartin 

Don't know if you're a music fan, John, but right now a lyric from Modest Mouse's Gravity Rides Everything accurately describes my day with Google LTI:

Early, early in the morning
It pulls all on down my sore feet
I want to go back to sleep . . .

[johnmartin]

This is great ssimpso4! Thanks!

[Chris_Hofer]

Hello  @johnmartin ‌...

John Martin wrote:

And forgive me for hoping that the Community forum was a place that Instructure monitored, or student accessibility was a thing they cared about .

I'm sad to read this.  I can tell you from my own experience that Instructure employees DO monitor many parts of the Canvas Community, and they do respond.  (Personally, I've received feedback from Community Managers, Project Managers, and other Instructure staff on many of my postings including questions here in the Community and Feature Ideas that I've proposed.)  For example, I can see that you've been participating in a recent conversation, Idea System Broken?.  Any time that you see a red panda icon (and I believe a gray panda, too) next to someone's name, they are Instructure employees.  I'm not sure if you've had a chance to read  @Renee_Carney ‌'s response in that thread (also found here: https://community.canvaslms.com/thread/16197-idea-system-broken#comment-67091), but at the very end she says "We read them all" (speaking to Feature Ideas).

Regarding this "Find Answers" space of the Community website, it's been my experience that, from time to time, Instructure employees will chime in here, too.  And, as you've noticed, there are many, many people (non-Instructure employees) who will reach out and help if they can provide input.  That help may include things like links to Guides, how-to steps, and work-arounds.  Now, there are also times where a question like yours may also sit unanswered for quite a while.  sadpanda  In those cases, it's not necessarily that Instructure employees haven't seen the question...it's just that there may not be many people in the Community that have a solution at the time.  In those cases, I've come back to those threads maybe a month or two later and to check in and say something like, "It looks like you may have stumped the Community with your question.  Have you come up with a solution on your end since your initial posting?"

Instructure takes accessibility very seriously in their development process.  Check out  @kona ' comment here: https://community.canvaslms.com/thread/16197-idea-system-broken#comment-66970 

I hope that you will continue to come back to the Community whenever you are seeking assistance, John.

[johnmartin]

Thanks  @Chris_Hofer . I do know Instructure employees do monitor the forums. They're put in a terrible position by their management where they need to placate the posters, but apparently, are not empowered to change the Canvas UX. 

What they (Canvas decision-makers vs forum monitors, who can't do this) don't do is a good enough job sharing evidence of taking issues seriously. When my faculty members run into significant issues and get on the Community forums (as I encourage them to do), and their questions and issues are ignored for months, they feel unheard, ignored, and abused by an uncaring system.

Here are three things Instructure can do to alleviate this: 

1. Acknowledge the Issue(s). We get that Instructure is big and that there are a lot of interconnected parts that make making changes difficult. But Canvas silence = Canvas Indifference. 
2. Explain the Process(es): We suspect there are processes, but we aren't sure what they are. Remind us often.
3. Explain the Challenges: I presume that the Google Apps LTI integration was created for K-12 schools whose students generally have only one Google account (the school's). So, it probably works fine for K-12 users. It does not work fine for Higher Ed, where our faculty and students go back and forth between multiple accounts. Because I've heard no reason or explanation from Canvas, this is pure conjecture on my part. Maybe there are technical challenges. Maybe because they designed it to look like Canvas instead of like Google (an odd choice) there are other issues in play. Who knows? — I'm sure someone does, but they're probably not even aware that the issue exists because they're not on the forum or hearing about the issues. If I knew of some reason why it was designed as it was, I would be more placated. But I don't. My faculty have similar experiences. It comes off as "Canvas does not care."

I'll stay on the forums. I tend towards optimism even when I express the pessimism I hear. I see the forums as a great way to find workarounds and tips and hints from other users. I am not finding it to be a place where Canvas decision-makers listen and act.

[scottdennis]

Hi John,

Let me assure you that we do read the things people post in the forums and we do work together to address issues.  We highly value these open and honest interactions in the community. We have ample evidence that Canvas as a product and Instructure as a company are better because of it.  As an initial example, I worked with both our Director of Product and the related Product Manager to gather the information for this response. I’ll start by saying...we agree that the issue you have identified should be better and we are working to make it better.  

First, a bit of context…

As you know, every three weeks we release new updates to our code that can include:

• Bug fixes
• Enhancements to existing features
• New features

...all three largely directed by the input we receive from users through various channels.

We released the new Google LTI integration with the January 7 release. In the four releases since that first release we have fixed 14 bugs and enhancements to the Google LTI, which were all user-reported.

Part of our methodology is to get functionality into the hands of users and then iterate based on user feedback. It’s a constant challenge to find the right balance between releasing too soon (not enough refinement) and waiting too long only to find out it’s not right and having to start all over again. For this priority (a larger project) specifically, it’s important to keep in mind that it is a collaboration between Instructure and Google (we also worked on the Microsoft 365 integration priority at the same time).  Because this priority is a collaboration, iterations become necessarily more complex than they would be were we writing all the code ourselves. However, we’re confident it’s worth the extra effort because the possibilities with combining Instructure and Google functionality are super exciting.

Our long-term plan is to replace the older, more-limited Google Drive integration (aka Docs) with this new LTI that more fully takes advantage of Google’s capabilities for education. The expectation in January when we initially released this LTI (please see the January 7 release notes) was that it was good enough to add value for many users and could be used as an option for those interested in trying it and providing feedback. For this priority, that’s the balance I mentioned earlier.   

With the continuous release of user-reported bugs and enhancements to date, we’re making progress and we continue to review feedback and act on it. As it happens, just today our product manager for this LTI was meeting with her counterpart at Google about the very same authentication issue you made reference to.  They are both actively working with their respective teams to determine where the issue resides.  The number of possible scenarios across our two systems, combined with browser variation, means that there are a many possibilities that must be considered and tested. She also mentioned that another aspect we want to improve is making our error messaging more explicit, such as with problems related to multiple Google accounts, in the event we can’t solve every possible scenario.

As I mentioned before, this is an ongoing priority.  As we work through the issues and get to solutions you will be able to read about them in the release notes.  I hope this explanation gives you a better picture of what is happening behind the scenes.

Thanks,

SD

[johnmartin]

Thank you Scott! This is a fantastic example of the kind of information I had hoped to see in February or March!  I know employees read the forums, but I kept hearing from level 1 and 2 support that it worked fine, and worked as designed. I felt brushed off and wasn't sure how to respond to faculty who were complaining to me about it. I couldn't even say "Yes, Canvas knows about it and is doing something about it; please be patient". I *had* been telling faculty that the Community and Canvas were responsive and listen, but the evidence for that had dried up. And I couldn't make the case at all to our Computer Science folks — many of whom were on here and left in frustration (my sense is that they know what changes are easy, and what changes are not).

Anyway, I appreciate the information you shared, and I really do appreciate that Canvas has people who pay attention to their users. Naturally, I want Canvas to be even more forthcoming and responsive than it is. Thanks again!

[scottdennis]

Hi John,

Reading your reply this morning, it occurs to me that 'functioning as designed' and 'definite room for improvement' are not necessarily contradictory.  After talking with multiple people in Product on Friday and Saturday I know that we are continuing to develop this integration.  As far as communication and transparency, we put a high priority on that there is always room for improvement.

[johnmartin]

Hello  @Chris_Hofer ‌, can you change this back from "Assumed Answered" to "Still a Problem" please? I'd hate to reinforce to Instructure that by ignoring problems they go away 😞

thanks!

[Chris_Hofer]

Hello  @johnmartin ‌...

Per your request, I have removed the "Assumed Answered" label from this question for the time being.  However, just so you know, my statement above from April 19th would still hold true even if we kept the "Assumed Answered" label:

Because there hasn't been any new activity in this particular discussion topic for over a month, I'm going to mark your question as "Assumed Answered", but that won't prevent you or others from posting additional replies below.

But I do understand why you would like it removed for now.

[johnmartin]

Thanks for understanding Chris! It still shows up as "Assumed Answered" for me. I worry that people will see this thread and, per the label, assume it has been answered rather than assume that it's been 1) hard for Instructure to solve, 2) not deemed worth their time to solve; or 3) simply ignored by fix-makers. "Assumed Answered" isn't nearly correct. Maybe other labels could be developed and used?

thanks!

[Stef_retired]

As of this writing, it's no longer marked "Assumed Answered,"  @johnmartin . 

[johnmartin]

Thank you  @sanders3 !

[johnmartin]

Oh no!  @sanders3 ! Someone marked it as "Assumed Answered" again!

[Stef_retired]

 @johnmartin , the entire purpose of the Find Answers space is for Community members to share their tips, tricks, and solutions about how Canvas currently functions. If users encounter a situation that falls in the category of a "bug fix," we'd like them to report the behavior in the form of support tickets; that is where updates will be issued, and anyone who submits a ticket will receive notifications of the progress of the fix. If users want to see new features or enhancements to existing features implemented in Canvas, we ask them to submit those to Canvas Studio as new ideas and "follow" those ideas to keep on top of comments and updates.

Your original question about the authorization issue has been answered, so we're marking this with the Answered flag. That doesn't close the conversation, nor does it remove it from view. Anyone searching for it will be able to find it, read the entire thread, and continue to contribute to it. The "Answered" flag simply means that it's not a question that our Community members who participate in the Find Answers space will be able to address--and that the question about how Canvas functions at the time the question was asked has been answered.

[johnmartin]

Thanks  @sanders3 ! This helps me understand the process better. So, to the best of my knowledge, there are several support tickets on this:

1. Case #01843701 seems to have died on March 7th.
2. Case #01865357 seems to have died on March 7th too.
3. Case #02000557 (April 22) never got past the first "We haven't heard from you on Case #02000557 for a few days. As a reminder, the subject line on this case is: [blank]. We hope this means that all's well now. If that's so, please disregard this message. If you still need a hand with the issue you reported, you can just reply to this message to update the case. We'll be happy to help. Thanks!" My email reply didn't get a response.

I guess I've given up on Canvas Support to do anything about it, so am hoping to keep the issue alive here until:

• it's fixed
• it's partially fixed (at least an error message to help redirect the user?)
• Canvas admits they don't care about Google Doc users (I don't believe this, but needed a 3rd option)

Where are the conversations about this bug now happening? And how do I stay informed?

thanks!

John

[Stef_retired]

 @johnmartin ‌, I'm not sure what you mean by cases having "died." If you've replied, the case should still be open. And when a fix is initiated, you'll receive an update via the email address associated with the Canvas account you used to initiate the case. Please be aware that the ticket thread is where you'll receive updates as they become available; since that's not the purpose of Community conversations, they're not updated in that fashion, unless a member chooses to post his/her response to a ticket.

[johnmartin]

Sorry  @sanders3 , by "died" I mean the last I've seen/heard on those cases were in March 7, and were email replies by me that I haven't heard back from for over 3 months. Perhaps they're still active, but I've not seen any responses about them.