[ARCHIVED] Canvas Google Apps LTI authorization failures

[johnmartin]

• UPDATE Jan 18, 2018  —Still broken. No word on a fix....
• UPDATE Aug 8, 2017  —Canvas recognizes this is a bug and is working on a fix (Cases #01843701, #01865357, #02000557). Not sure how or where to get updates on their progress.
• UPDATE Aug 4, 2017  —Still broken. Still no error message suggesting the user switch browsers or login to Chrome with another account. Still many confused users getting frustrated because Canvas doesn't work .
• UPDATE Apr 24, 2017 —Still broken. Not answered. Don't let the "Assumed Answered" label fool you.
• UPDATE Apr 20, 2017 —Still broken. No movement to fix on Instructure's part. They say it's "working as designed." If so, their design that forces students to jump through more hoops (see comments below) to access course content is a bad one. The goal should be to minimize navigation efforts and maximize access to content. The Canvas Google Apps LTI fails in this criteria.

ORIGINAL ISSUE, AS IT STILL STANDS — The Canvas Google Apps LTI authorization is failing on me in Chrome in one course (not others), and observed with faculty. Anyone else? Workarounds?The chat with Instructure support helped determine that it worked in Firefox but not Chrome. They suspected it may have something to do with being logged into multiple accounts. His boss suggested that the Google Apps LTI might need to be re-setup (by our Admin). 

Here's a screencast of the issue: Canvas Google LTI failures - YouTube 

More troubleshooting:

1. I cleared all Instructure and Canvas cookies,
2. then logged out of all Google accounts in Chrome,
3. then shut down and restarted Chrome.
4. Then opened afflicted Canvas course (https://canvas.wisc.edu/courses/39891/pages/feb-3-rubrics-in-canvas)
5. Still saw no Google content and was asked to Authorize. Authorization fails.

Note: 

• works in Incognito mode in Chrome.
• works in other Canvas courses in Chrome.
• works in Firefox.

Final bit of troubleshooting:

• it seems to definitely be the Canvas tool's issue. 
• a manual Google Doc iFrame embed works fine in Chrome, in that course.

[garth · Accepted solution]

 @johnmartin ‌ I haven't used Google Apps LTI, and would be interested to know more about what you are experiencing.

Please post back with any info you learn.

[johnmartin · Accepted solution]

Thanks  @jomontuori  . Yes, this has always worked for me. The problem is that we'd have to explain this to 60,000 users who are used to not having a problem using multiple Google accounts — they don't have to do this with other Google API integrations; just Canvas. This special exception for Canvas, imho, should be removed as a matter of removing barriers for learning. 

In the meantime, the other workaround — that doesn't require users to change ingrained behavior to access course content — is to use iFrame embedding.

I surely hope Instructure can recognize that adding this barrier for student-access to content is a step backwards that should be done correctly.

thanks!

John

[erinhmcmillan]

Hi, John,

I reviewed the tickets that you noted and they were marked as solved because you had received an answer from our support team and they had not received any additional correspondence. The replies acknowledged that the behavior wasn't perfect but is not something that we can directly address since it's limited by single sign-on authentication. You're correct in that this point there isn't much else Canvas support can do to resolve the situation; it needs to be handled by our product teams working with Google.

Our Canvas support team provided some workaround options that you could use to address the current situation in the meantime and we hope that those recommendations have been beneficial. 

The best way to stay updated at this point is to work with your institution's admin, who communicates regularly with your institution's Canvas customer success manager (CSM). Your admin keeps in contact with your Canvas CSM to note successes and concerns and can also convey feedback from your institution as a whole. Your admin can let you know if there have been any progress with the situation directly. I can tell you that right now, the engineering and product team that works with our LTI integrations is currently working to resolve existing bugs with the Google integration. I also see they have some research projects noted to improve Google authentication, but unfortunately I do not have a timeline as to when they will be starting that project or when more information will be available.

Hope that helps!

Erin

[johnmartin]

Thanks erinhallmark! I appreciate your efforts here, and suspect/understand that you may be tiring of flogging this dead horse. I apologize for the extra effort this may be causing, but I strongly believe it's important enough — at least for me and our campus — to continue to pursue until a decent fix (or at least error message) is in place.

I recognize that there isn't much else that Support can do to resolve the situation — it's a flawed implementation. My email archives show me that I was the last to respond in each case, so perhaps there is a system breakdown because from my end the cases just seemed to die.

I am also happy that Engineering and the Product Team are working on it. I tried all of the workaround options suggested that were practical and believe that I documented via videos and images that they did not work. The workarounds that I did not try (making sure our 60,000 students and faculty not use Chrome, or making sure that they don't log in to Chrome with their personal Google account) were not practical, and I believe I made that case beyond its self-evidence.

Again, a simple error message with directions would be a nice and helpful step on the journey to fixing it.

I've not yet brought up that it's also not working in Opera, but noticed this yesterday as I was showing my admin. Honestly, I'm tired of this too...

[erinhmcmillan]

Hi, John,

Another factor is the team is trying to solve them but is trying to prioritize against existing commitments. One of the definitive factors for bug fixes is the number of other users being affected and who have reported the behavior. So the more customers who report on it, the better. We do recognize the frustration of not having a project move as quickly as you would like. I assure you the product team is working to address these concerns as quickly as they can.

Thanks,

Erin

[johnmartin]

Yes erinhallmark, the more the merrier — and I try to get them to document their frustration (besides to me), and I tell them that the Instructure listens, but they are already well-trained to believe that it's never worth it to report issues. #bureaucracy #beaten-down. Or they believe that telling me is enough — as if I have some great power in getting this issue fixed.

[ssimpso4]

 @johnmartin ‌, I appreciate you providing this running account of your experiences with the Google LTI. I'll confess that troubleshooting similar issues in my school district is beginning to wear thin.

In regard to the current state of things (and leaving out what enhancements might be beneficial) and assuming that similar frustrations can be found in other districts & institutions in which the LTI has been enabled, it's a bit silly that we're all working in isolation to troubleshoot similar issues and develop support guidance for our users who encounter difficulty. It would be great if Instructure would synthesize all of the known-issues (as reported here and to Canvas Support) and pair each with troubleshooting suggestions/steps (all in one document made available here in the Community, perhaps organized in a similar manner to Canvas Release: Google Apps LTI). 

[johnmartin]

"Wearing thin" is a nice way to put it. "Getting tired" "losing faith" etc. are others. As I mentioned to Chris above, my faith is shifting from Canvas to other users. But it's sad to lose faith in a company that I recently saw as a great user-centered one.

[ssimpso4]

 @johnmartin ‌, you've made some very fair points here. However, I've had so many positive experiences with Instructure over the past 3 years (and as recently as a conference call less than an hour ago) that I haven't lost any of my faith in its responsiveness to customers' needs and concerns. And that's coming from someone who once described himself in a meeting as an 'optimistic pessimist'!

[johnmartin]

Thanks ssimpso4, Comments like these provide me with optimism.

[dianepbh]

Hope that this is an ok place to add my two cents about the full integration. ...

SCHOOL CONTEXT:

High School Online Program with some blended face-to-face interactions- Mostly At Risk Students and Students working from Home

THE CHALLENGES/BUGS(?):

• AUTHORIZATION FAILS: The challenge we have is when the issue happens more than once, teachers begin to not trust the product and begins to back away from using this. Since Cloud Assignments are so key to a student's learning, having it work sometimes is not acceptable. Consider also that often when kids are about ready to hit submit because the 'bell" is going to ring, getting an error right then is NOT going to be a good place for anyone to be in.
  • So.. we have a few people still willing to experiment but others are hanging back because they are worried about frustrating the kids. 
• EDIT RIGHTS - Need to make sure students cannot make edits to the teacher's documents ever.. (at least as the default) 
• SHARE RIGHTS - make sure the share button is not greyed out inside of canvas

THE POSITIVES

• natural use of LMS and Google - THIS ROCKS! (and really is the huge win.... ) 
• Fairly easy integration for both instructor and student
• Awesomeness of the  "copy" of  (similar to the google classroom option
• Ability to take advantage of the strengths of both canvas and google

THE WISH LIST

• Cloud Assignment: rename with the username at the very start
  • EXAMPLE: BEFORE: Copy of Edgar Allen Poe Analysis
  • EXAMPLE; AFTER suzy_smith9634 Copy of Edgar Allen Poe Analysis
• Cloud Assignment: sharing with the the teacher should either be automatic (best scenario) with EDIT access or the student should be able to stay INSIDE Canvas and chance share settings (greyed out right now)
• Cloud Assignment: URL to the original document should automatically be submitted when the student clicks on SUBMIT. Teacher needs that URL to get to the original via SpeedGrader. 
  • RATIONALE: We rarely only use crocodocs on an assignment that is in speedgrader is the student is expected to go back and make changes. We will make the comments in the google doc itself where the student is going to be editing their work.
  • RATIONALE: Students do not want to (and will not)  toggle between their crocodocs feedback and their google doc. 
• Cloud Assignment - Teachers make comments as annotations in a template - The share permissions need to permit these comments to be viewed. The default does not allow this. 
• Cloud Assignment AND Embedded Google in Instructions. The iframes are different sizes. So, this is distracting and also annoying because the instructions you have to scroll but the assignment you do not.  (screen shot below) 
• Google SLIDES (and other docs) : The default view should be the PRESENTATION MODE (or View ONLY for docs/sheets) )  rather than the edit mode when the slide deck is being embed in a page, a set of instructions etc.  Make sure students cannot edit this view.  Usually we use the "publish/embed" option in Google and this level of settings that a teacher within the publish mode on google is what is needed in Canvas. In other words, we do not want to lose features when we move to Canvas.  
• 

[ssimpso4]

Thanks for constructing this list,  @dianepbh . There was a Google panel discussion in CanvasLIVE on Friday and many of the same 'wishlist' items were discussed.

[johnmartin]

Oddly, I can't comment on this related thread: https://community.canvaslms.com/docs/DOC-8732 . erinhallmark , do you have any insight on this? Thanks!

[Chris_Hofer]

 @johnmartin ‌...

I am reasonably confident (though still a guess) that the Canvas Release: Google Apps LTI document has been locked for comments (though erinhallmark‌ could confirm for sure).  As you may have seen at the very bottom of that document, Erin has 1) asked that any contrary behaviors should be directed to the Canvas support team, and 2) further updates to the Google Apps LTI will be included in Canvas Release Notes.  Rather than continuing the conversation in the "Canvas Release" document, people should post comments comments on any new information in the Canvas Release Notes area of the Community.  This is just my guess, and again, Erin could tell you for sure the reasoning for not allowing additional comments.

[erinhmcmillan]

Hi, John,

 @Chris_Hofer ‌ is correct. The Google Apps LTI document was a supplemental document within the January 7 production release notes, and comments were closed after the subsequent beta release notes document. This pattern helps us (and you) stay current with all comments, and your comments can stay more relative with Canvas beta and production updates. (Allowing comments in release notes from a year ago, for instance, wouldn't help anyone since the feature being commented on would probably have already changed once, or maybe several times. And some features may be initially introduced and then updated three weeks later.) Since the Google Apps LTI document was not the direct release notes document, we left it open for several release cycles, but eventually comments needed to be closed. We did so once the general discussion of the feature had slowed down and the most notable concerns had been resolved, and changes were updated directly in that document as they were made available.

Every space in the community has a purpose—the purpose of the release notes space is to introduce and explain new and updated features and identify fixed bugs. Everyone is welcome to leave comments regarding the features as described. However, when discussions in the release notes change to significant contrary behaviors or desired feature enhancements, those discussions have their own place, too. When comments are closed, our intent is not to keep you from commenting, but we want to direct you to the other venues specifically designed to help you get the answers you're looking for. Our support team is happy to take contrary behavior inquiries through support tickets, and our product team considers ideas to feature enhancements as part of their current projects in Canvas Studio. And any feature enhancements or fixed behaviors will always be noted in a future version of the release notes.  

Thanks,

Erin

[dwillmore]

I just want to make sure I understand the basic problem/bug.

If logged into Chrome with a personal account and using a school 'Google' account to log in to Canvas, there is an authorization problem.

Did I get this right?

We don't use Google EDU and when our faculty/students use Google through the LTI we never encounter this issue because everyone uses their personal Google login and that would also be what they use to login to Chrome.

Would your simplest workaround be to use a different browser like Firefox?  I know that can be painful.  We too are Chrome-centric.

An aside, does anyone experiencing this problem also use Chrome books that must be used with the school provide Google ID?   I don't have a Chrome book and don't know if the same authentication conflict happens and would like to know if it does?

[tross]

Typically we don't have the problem on district issued Chromebooks because we require that they login with the district google id for the Chromebook.  Since Chrome already is logged on to the district id when they start Canvas, the LTI does not have any authorization issues.

[dianepbh]

Users are not paying attention to what they logged in as or what was used to authorize what... They need a smooth experience which means - 100% seamless. Teachers will eventually stop trusting the app if they get more than a few of these kinds of errors. If they do not quit 100% they will get frustrated and not give "canvas" a good rating. In other words, it behoves Canvas to make sure that the experience is as smooth as anything else on Canvas. It should not matter what browser, which cookies, what cache, what laptop, which user...

And, I am confident Canvas will figure this out. It is the beta after all.  

[dwillmore]

I very much agree with you, but this may not be a Canvas LTI issue at all because Google may be unable to handle the 2nd authentication request as their cookies are built now.  I am not saying that this is the case, but it may be.   The LTI is a handshake that requires both sides to do their part.

[ssimpso4]

 @dwillmore ‌, as I understand it, you've described the most common issue that can complicate a user's successful login via Chrome. A complicating factor on a Chromebook is the option to 'login as Guest' which many students choose as a way to bypass having to log in with their district credentials, despite efforts to discourage this practice.

We're a heavy Chromebook-using district and it's problematic when complications arise that are Chrome specific because we can't just tell our students to use Firefox as a workaround. For example, there's a newly discovered issue with Chrome 58 (latest version) that's preventing the successful previewing/rendering of cloud assignment Docs and other embedded Google App content. While I'm sure a fix is coming, we don't have great options for workarounds because we're very much reliant on Chrome-based student devices.

[tross]

They can browse as guest but we just have it locked down so much that they generally don't.  We have not seen the authorization issue for our Chromebook users but we definitely see it everywhere else.  We don't have Firefox loaded on student machines and students can't download applications so Chrome is their primary browser.

[dianepbh]

We are finding that when users contact the Canvas Hep Desk regarding this issue the help desk seems to be unaware of this problem. We have gotten the following answers;

• must be an issue with your institution's Google Account  or the LTI integration credentials, the way the LTI was set up etc... And usually this is after waiting for someone to go find out. 
• As recently as this weekend: "In regards to the Authorization Fails, would you mind providing us with some more information regarding this issue? Do you see this happening to all users or just particular ones, and when it happens what types of errors are you seeing?"
• Two weeks ago we got: "This error message isn't one Canvas generates, and it very well may be connected to document or account permissions within Google Drive.  To make sure the student's Google Drive is authorized and has an active session, delete the Google Drive token from Canvas, and then delete the Canvas integration on the student's Google account.  To remove the token on the Google side have the student click their initial at the top right and select "my account".  Then in the Sign-in & Security section select "Connected apps & sites" and click "manage apps".  In that screen select Canvas and click "remove".  Then have the student access the assignment again.  It will require the student to log in again before submitting via Google Drive.  If the issue continues to occur on a fresh session you'll know that there is a permissions issue that needs to be addressed from the Google side."

It if highly critical that the Canvas Help Desk be made aware of issues like this. We should not have to go look in a community to see if we are the only ones experiencing a problem or to find a solution ourselves and we should not try solutions that do not actually work. 

[dwillmore]

I love the Canvas Help Desk, but they do have some shortcomings.  This is true of all Help Desks I guess, but I would talk to my CSM about the issue, and update your KB document if you have not.  It is frustrating when a known issue has not fully flown down the grapevine.

[ssimpso4]

Diane, I really appreciate the efforts by Canvas Support (after all, this thing is still in beta, and they, like us, are learning as they go), but agree that there's often conflicting advice which is discouraging.

On Friday, I was advised by Canvas Support to delete the LTI at the account level. My reply:

______, this isn't an issue that's affecting every user, so I really hesitate to delete and re-add the tool at the account level because it confuses users (the student, for example, who no longer sees the Google Drive tab as an assignment submission option). I just had a colleague create a cloud assignment in a course and he's able to view it just fine (we compared Chrome settings and couldn't find anything that we believe would cause a different experience) . . .

Keep in mind, I can access my Drive via Canvas, but the previewing/rendering of Google Apps content is the problem.

Just a summary so that it's all here in one list:

1. Issue is in Chrome (no issue when in Firefox).
2. Issue presents itself in both normal and incognito modes in Chrome.
3. Confirmed that the 'block 3rd party apps' checkbox in Chrome settings is unchecked.
4. Browser has been updated: no effect.
5. Cookies and cache have been deleted and browser reopened: no effect.
6. LTI deleted at user settings level in Canvas and in Google settings: no effect.

Is it really the case now that the next troubleshooting step is delete the LTI from the entire account?

Keep in mind that yesterday I received an update that pointed towards the Chrome v.58 issue (by the way, I love the fact that the problem was so quickly identified, but worry about how future updates will complicate the integration's functionality over time):

I wanted to reach out to you regarding the issue that you are experiencing with Google Drive. We were just recently made aware of an issue regarding Google Chrome version 58, which fails to load any Google cloud assignment for Canvas; however, it can still load the Google Drive option from the course's menu and also allows you to pick files when creating the assignment. Our team created a report on this issue and our engineering team is currently looking into this, which is the same issue that you are experiencing. Looking into your Canvas logs I see that you are using Google Chrome 58; which is likely the culprit. Just to double check is the other person who was not experiencing the same issue running Chrome 57? If yes, then that is definitely what is causing the problem. As of now I would just recommend to use a different browser while our engineering team investigates further the issue relating to Chrome 58.

So, I'm glad I didn't unnecessarily delete the LTI at the account level as recommended . . .

I wonder if the Canvas Status page could be used to update users on issues like this, instead of hoping that the Guides can contain the most up-to-date acknowledgement and info. about known bugs & other issues? (I would think that would be of use to both Canvas Support staff and end users and admins like me (and I've just made this suggestion to my CSM). 

[johnmartin]

Or the ubiquitous "Clear your cache." Why not "try in Private mode" instead? There are things in my cache I don't want to clear.

[johnmartin]

Yes  @dwillmore   We could instruct all our students and faculty to use Firefox (but they won't ;-))

The frustrating aspect (to me) about it is that I can swap between Google accounts at the Tab level in every other Google integration I encounter. But for this one I can't; it requires a different behavior than is standard to all my other experiences. I am naturally curious, have a tech-philic mind, and can eventually figure it out. Most won't.

[dwillmore]

Horse, water, drink issue blah.   I totally get you on the problem sir.

[johnmartin]

Hi  @dwillmore , 

Yes, using a different browser works. But communicating to our 60,000 users that they need to use a different browser — at the time they run into the issue — is a problem I cannot fix. Instructure could make some steps by

1. acknowledging the issue to the user via an error message (vs nothing) that instructs users to try another browser (this isn't an ideal solution, but is a small step that reassures users that there is a workaround so they can at least get the assignment done instead of failing because of a software imperfection).
2. fixing the issue

[mjoaquin]

I am replying here and then going back and reading everything. Which seems backwards, but I wanted to add that my district is running into issues now with our items embedded using the Google LTI. We are getting blank pages that will not load. 

Screenshots for those that like visuals.

Sad Empty Page	Edit View--Content is There, I Promise!

In the time it has taken me to create this content, the page that I attempted to open is still spinning and blank. We went back in and added the link just so our users could get to the content, but I would love for the integration to work. 

[dwillmore]

Wow, Misty, I will be interested in what you find was the cause and solution to the problem.

[ssimpso4]

There's a Service case open about this issue. The tentatively identified issue is related to having updated Chrome to version 58. Seems to only be affecting admin users . . . 

 @mjoaquin ‌, have you guys had students and teachers encounter the problem?

[dwillmore]

Thank you for that information, Stephen.

[mjoaquin]

Yes, thanks for that info ssimpso4! I know that our Chrome is set to automatically update across the district, so all users are most likely on version 58. We did have teachers reach out last week that they could not get the Toolkits to load. However, earlier this week, I was able to re-add them toolkits and they functioned. Today I have only seen the problem from my own log in and  @mheckman ‌ and we both have admin rights. I will reach out to a few teachers and see if it is impacting them and reply back here. 

[mjoaquin]

So, I reached out to 35 teachers that covered all 9 campuses and a variety of grade levels. It also included a few instructional aides. I heard back from 17 of them. All but one could see what we want them to see...

So I checked with the one who could NOT see the embedded doc. She was not signed in to Chrome, but was signed in to her Gmail as that is what we use to access Canvas. I asked her to sign in to Chrome on the small chance that would change things, but it didn't. So with that said, any thoughts on what else I can/should do to help those that are running into this? I still don't know how many are being impacted, my sample size is small, and 1/17 is pretty good, but I don't want to react, I would rather be proactive! 

[ysmalls]

 @johnmartin  I just had this happen to one of my teachers.  I was able to integrate his Google Drive with Canvas on my computer but he could never get it to work on his computer or lap top.  I saw the video you posted and I saw his too and you both have the "cookie" icon on the URL address bar next to the star:

I went back and forth with the teacher and after reviewing his "Privacy Settings" then "Content Settings" he had "Block third-party cookies and site data" under the "Cookies" sections selected, I told him to de-select that option.

Under "Flash" he changed his setting to "Allow sites to run Flash"

Pop-ups:  Allow all sites to show pop-ups

Notifications:  Allow all sites to show notifications

I had a hunch that his Chrome settings was what was preventing him to get the same error messages as show on your video.

He changes his Chrome settings as I suggested and he is happy since he is now able to use his Google Drive in Canvas.

Hope that helps you.

[jventrano1]

Thank you so much.  This helps with an issue I had too.

[johnmartin]

Thanks ysmalls That's a brilliant thing to check! It also reminded me to turn that back on! These are the variations I've tried — none work:

1. All 3rd party cookies blocked.
2. All 3rd party cookies except instructure.com, canvas.com, canvas.wisc.edu, (etc — the ones it uses)
3. No 3rd party cookies blocked (what it was set at until your comment reminded me to go back to blocking, since it wasn't having an effect).

Alas, I think this is a case of window-level login.

[schroeder]

This is an issue we are experiencing with the Google Drive LTI too. The issue definitely relates to "Block third party cookies and sites" being turned on. After turning that setting off, the Google Drive LTI works just fine. The thing is, for security reasons, we don't want all third party cookies to be allowed all the time. So, does anyone know specifically what cookies the Google Drive LTI uses so that we can whitelist them so that we can go back to blocking other third party cookies?

[johnmartin]

 @schroeder ‌, I wish that fixed it for me, but it doesn't . And like you, we need to block 3rd party cookies for certain sites.

[jfribush]

Thank you for this thread.  I had the same issue today.  I wasn't able to authorize a connection the Google APPs LTI.  After reading this thread I realized that Chrome was logged into a different account than I was attempting to authorize.  After I logged out of Chrome it authorized perfectly.   This seems like a pretty big issue, I'm surprised Canvas doesn't at least have an error message for when this happens.   Without Google and this thread I don't think I would have been able to fix this issue.

[johnmartin]

Happy to help  @jfribush ‌! (But sad that this is still an issue!!!!!). 

 @scottdennis  — It was wonderful to meet you at InstructureCon! Any updates on the April 24th discussion you had with developers about this issue?  It would be great if it were fixed by the time our Fall semester starts!

thanks!

John

[scottdennis]

Hi John,

As far as I can tell, there are no updates to share on this issue.

Thanks,

Scott