Canvas LTI 1.3 OpenID Login Initiation Url not found with 404 issue

[citv257]

Canvas is not able to find "OpenID Connect Initiation URL" from the LTI 1.3.In my case I have developed a provider which is based on LTI1.3 IMSGLOBAL standard. So when trying to launch the url link , Canvas is sending proper access token request with  form parameters (client_id, login_hint,target_link_uri,lti_message_hint,canvas_region)as a POST request  to the LTI but unfortunately OidcLogin file  which is the path of "OpenID Connect Initiation Login URL" is giving us 404 error due to which LTI is not able to request for ID Token .

I am using Dot Net core 3.1 with razor page and OidcLogin page is PageModel type.

[svickers2]

Are you able to share a copy of the request you are sending to the Login Initiation URL so it can be checked for possible reasons?

[citv257]

Thanks for your reply.
Please find the below request which is sending by Canvas(Consumer) to Tool(Provider).


<form action="https://ivle2dev.nus.edu.sg/OidcLogin"
class="hide"
method="POST"
target="tool_content"
id="tool_form"
data-tool-launch-type=""
data-tool-id="ivle2dev.nus.edu.sg"
data-tool-path="/OidcLogin"
data-message-type="tool_launch">
<input type="hidden" name="iss" id="iss" value="https://canvas.instructure.com" />
<input type="hidden" name="login_hint" id="login_hint" value="41005d156797ebb480888f7e702877310d7030ef" />
<input type="hidden" name="client_id" id="client_id" value="201810000000000128" />
<input type="hidden" name="target_link_uri" id="target_link_uri" value="https://ivle2dev.nus.edu.sg/Tool" />
<input type="hidden" name="lti_message_hint" id="lti_message_hint" value="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ2ZXJpZmllciI6ImViNzRlOWE5NjcyZmE2MGZjMjQyYTdkY2I5MTZkN2VjYjlkODM0ZjRmZjM0NzJmMGYxOGU2NDExNTZkOTI5ZjBiNWRmZTIwZjExMzVmMTc0ZWE2YTJlOGVjNzY3NzdmN2QwZjE4YzBhOWU5MDY0ZGMxNDJhN2NjYjQ5MmRkNjRmIiwiY2FudmFzX2RvbWFpbiI6Im51cy1kZXYuaW5zdHJ1Y3R1cmUuY29tIiwiY29udGV4dF90eXBlIjoiQWNjb3VudCIsImNvbnRleHRfaWQiOjIwMTgxMDAwMDAwMDAwMDAwMSwiY2FudmFzX2xvY2FsZSI6ImVuLUdCIiwiZXhwIjoxNjU3NjkyNjk5fQ.vi-Osv2kR8sMb69qU5Rf4BO9CGFaXn3A3sl8VWkRgOc" />
<input type="hidden" name="canvas_region" id="canvas_region" value="ap-southeast-1" />
<div style="margin-bottom: 20px;">
<div class="load_tab">
This tool needs to be loaded in a new browser window
<div style="margin: 10px 0;">
<button class="btn" type="submit"
data-expired_message="The session for this tool has expired. Please reload the page to access the tool again">
Load LTI - Student Innovation Portal 1.3 in a new window
</button>
</div>
</div>
<div class="tab_loaded" style="display: none;">
This tool was successfully loaded in a new browser window. Reload the page to access the tool again.
</div>
</div>
</form>

Error :Failed to load resource: the server responded with a status of 404 ()     OidcLogin:1

[svickers2]

Thanks for the sample.  This does not look like a valid response to an LTI 1.3 Initiate Login request from a platform.  I would expect the response to include the following parameters:

• client_id
• login_hint
• nonce
• prompt=none
• redirect_uri
• response_mode=form_post
• response_type=id_token
• scope=openid
• state
• lti_message_hint

and to be sent to an endpoint at /api/lti/authorize_redirect.  See section 5.1.1.2 of the IMS Security Framework specification at https://www.imsglobal.org/spec/security/v1p1 for more details.

[citv257]

Thanks for your response. 
Since I am implementing LTI1.3 , so I am following this official docs https://www.imsglobal.org/spec/lti/v1p3/#services-exposed-as-additional-claims .
In most of the articles\resources I have found that third party login initiate is carrying these five parameter i.e from canvas to LTI1.3 tool ("iss","login_hint","client_id","target_link_uri","canvas_region") and tool is binding these parameter and again requesting platform for ID Token.

So now after lot of changes done  , tool is able to bind these parameter and tool is able to request  Id Token to canvas seems like :

https://nus-dev.instructure.com/login/oauth2/auth?client_id=201810000000000128&response_type=id_toke...

but I am getting this error :{"error":"invalid_request","error_description":"redirect_uri does not match client settings"} .

[svickers2]

I do not see any of these parameters in your authentication request:

• client_id
• login_hint
• redirect_uri
• lti_message_hint (if passed in the Login Initiation request message)

Stephen