Community

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
stef_schenkelaa
New Member

Rollcall Refresh tokens

Jump to solution

Hi guys,

I have a question about launching lti apps sessionless. My goal is to automate the login to Rollcall and I have an access token myself. So with the sessionless launch url from the api, I can start Rollcall. However, Rollcall needs an access token as well so it redirects me to the OAuth authorization page (to approve the access for the app). But to access this page you need to be logged in... (same idea as described here: Attendance Report Using API ) 

One solution would be that Rollcall uses refresh tokens since you can then manually approve Rollcall once. I think this is unexpected behavior since a teacher has to approve the app every time he wants to fill in the attendance and a new access token is created for each approvement. I am not sure where to make a notice of this, here / GitHub issue /mail, but lets give this a try first. A small note: I noticed that with another account, rollcall has an access token without an expiration date and there my entire process works.

I am really wondering if you guys have another solution for my problem without saving the user's password in my database or know why Rollcall does not use refresh token.

Thanks,

Stef

ps. This is my first post on this forum so if I forgot something like mentioning someone or added the question to the wrong group, please let me know.

rollcall‌lti app‌oauth2‌

Tags (3)
0 Kudos
1 Solution

Accepted Solutions
stef_schenkelaa
New Member

Since nobody from instructure responded, I contacted them directly. They then fixed the issue within a week. They still do not use refresh tokens but they switched the developer key to an old version which does not require refresh tokens. So not completely fixed but it works for now. 

Just that people know if they end up here

View solution in original post

0 Kudos
4 Replies
kona
Community Coach
Community Coach

Due to the technical nature of this question I'm going to share it with the Canvas Developers group in the Community. They are the ones that work with this side of Canvas and should hopefully be able to help! In addition, you might consider joining the Developers group and checking out some of their other resources/information!

James
Community Member

Does it work if you manually log into RollCall at least once before trying to use the sessionless launch?

Well, it works for an hour. Just until the token is expired and rollcall should refresh the token. Instead it redirect the user to https://<canvas-install-url>/login/oauth2/auth to authorize the app but to access this page you need to be logged in, an access token is not sufficient. 

Does this explanation help?

stef_schenkelaa
New Member

Since nobody from instructure responded, I contacted them directly. They then fixed the issue within a week. They still do not use refresh tokens but they switched the developer key to an old version which does not require refresh tokens. So not completely fixed but it works for now. 

Just that people know if they end up here

0 Kudos