Canvas LTI 1.3 Integration Issues

[haeven]

Okay, so I am running into a problem with the response to the Authorization request sent to Canvas. Even though I am sending a prompt=none parameter, Canvas is responding with a login_required error.

Any assistance would be greatly appreciated!

[jpoulos]

One problem is that in your request back to Canvas, the login_hint is changed from what Canvas sends in the ODIC initiation request. Those values must match as per the spec: IMS Security Framework 1.0 | IMS Global Learning Consortium 

"login_hint
REQUIRED. As passed in the initiate login request."

[haeven]

After changing that to normal, it throws the following server error.

  ERROR: Unknown Key Type
  CATEGORY: JSON::JWK::UnknownAlgorithm
        /var/canvas/vendor/bundle/ruby/2.4.0/gems/json-jwt-1.9.4/lib/json/jwk.rb:49:in `to_key' /var/canvas/vendor/bundle/ruby/2.4.0/gems/json-jwt-1.9.4/lib/json/jose.rb:25:in `with_jwk_support' /var/canvas/vendor/bundle/ruby/2.4.0/gems/json-jwt-1.9.4/lib/json/jws.rb:105:in `sign' /var/canvas/vendor/bundle/ruby/2.4.0/gems/json-jwt-1.9.4/lib/json/jws.rb:17:in `sign!' /var/canvas/vendor/bundle/ruby/2.4.0/gems/json-jwt-1.9.4/lib/json/jwt.rb:32:in `sign' /var/canvas/gems/lti-advantage/lib/lti_advantage/messages/jwt_message.rb:67:in `create_jws' /var/canvas/lib/lti/messages/jwt_message.rb:36:in `generate_id_token' /var/canvas/app/controllers/lti/ims/authentication_controller.rb:121:in `id_token' /var/canvas/app/controllers/lti/ims/authentication_controller.rb:56:in `authorize' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_controller/metal/basic_implicit_render.rb:4:in `send_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/abstract_controller/base.rb:186:in `process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_controller/metal/rendering.rb:30:in `process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/abstract_controller/callbacks.rb:20:in `block in process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/callbacks.rb:108:in `block in run_callbacks' /var/canvas/app/controllers/application_controller.rb:482:in `report_to_datadog' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/callbacks.rb:117:in `block in run_callbacks' /var/canvas/vendor/bundle/ruby/2.4.0/gems/inst_statsd-2.1.4/lib/inst_statsd/statsd.rb:95:in `batch' /var/canvas/app/controllers/application_controller.rb:470:in `batch_statsd' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/callbacks.rb:117:in `block in run_callbacks' /var/canvas/lib/temp_cache.rb:28:in `enable' /var/canvas/app/controllers/application_controller.rb:466:in `enable_request_cache' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/callbacks.rb:117:in `block in run_callbacks' /var/canvas/app/controllers/application_controller.rb:460:in `set_locale' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/callbacks.rb:117:in `block in run_callbacks' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/callbacks.rb:135:in `run_callbacks' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/abstract_controller/callbacks.rb:19:in `process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_controller/metal/rescue.rb:20:in `process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_controller/metal/instrumentation.rb:32:in `block in process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/notifications.rb:166:in `block in instrument' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/notifications/instrumenter.rb:21:in `instrument' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/notifications.rb:166:in `instrument' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_controller/metal/instrumentation.rb:30:in `process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_controller/metal/params_wrapper.rb:252:in `process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activerecord-5.1.6.2/lib/active_record/railties/controller_runtime.rb:22:in `process_action' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/abstract_controller/base.rb:124:in `process' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionview-5.1.6.2/lib/action_view/rendering.rb:30:in `process' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_controller/metal.rb:189:in `dispatch' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_controller/metal.rb:253:in `dispatch' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/routing/route_set.rb:49:in `dispatch' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/routing/route_set.rb:31:in `serve' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/journey/router.rb:50:in `block in serve' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/journey/router.rb:33:in `each' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/journey/router.rb:33:in `serve' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/routing/route_set.rb:844:in `call' /var/canvas/gems/plugins/respondus_soap_endpoint/lib/respondus_soap_endpoint/middleware.rb:78:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/rack-2.0.6/lib/rack/etag.rb:25:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/rack-2.0.6/lib/rack/conditional_get.rb:25:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/rack-2.0.6/lib/rack/head.rb:12:in `call' /var/canvas/app/middleware/request_throttle.rb:63:in `block in call' /var/canvas/app/middleware/request_throttle.rb:309:in `reserve_capacity' /var/canvas/app/middleware/request_throttle.rb:58:in `call' /var/canvas/app/middleware/request_context_session.rb:25:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/rack-2.0.6/lib/rack/session/abstract/id.rb:232:in `context' /var/canvas/vendor/bundle/ruby/2.4.0/gems/rack-2.0.6/lib/rack/session/abstract/id.rb:226:in `call' /var/canvas/app/middleware/load_account.rb:29:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/middleware/cookies.rb:613:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/middleware/callbacks.rb:26:in `block in call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/callbacks.rb:97:in `run_callbacks' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/middleware/callbacks.rb:24:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/middleware/debug_exceptions.rb:59:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/middleware/show_exceptions.rb:31:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/railties-5.1.6.2/lib/rails/rack/logger.rb:36:in `call_app' /var/canvas/vendor/bundle/ruby/2.4.0/gems/railties-5.1.6.2/lib/rails/rack/logger.rb:26:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/middleware/remote_ip.rb:79:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/request_store-1.4.1/lib/request_store/middleware.rb:19:in `call' /var/canvas/app/middleware/request_context_generator.rb:49:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/rack-2.0.6/lib/rack/method_override.rb:22:in `call' /var/canvas/app/middleware/prevent_non_multipart_parse.rb:33:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/rack-2.0.6/lib/rack/runtime.rb:22:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/activesupport-5.1.6.2/lib/active_support/cache/strategy/local_cache_middleware.rb:27:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/actionpack-5.1.6.2/lib/action_dispatch/middleware/executor.rb:12:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/rack-2.0.6/lib/rack/sendfile.rb:111:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/railties-5.1.6.2/lib/rails/engine.rb:522:in `call' /var/canvas/vendor/bundle/ruby/2.4.0/gems/railties-5.1.6.2/lib/rails/railtie.rb:185:in `public_send' /var/canvas/vendor/bundle/ruby/2.4.0/gems/railties-5.1.6.2/lib/rails/railtie.rb:185:in `method_missing' /usr/lib/ruby/vendor_ruby/phusion_passenger/rack/thread_handler_extension.rb:97:in `process_request' /usr/lib/ruby/vendor_ruby/phusion_passenger/request_handler/thread_handler.rb:152:in `accept_and_process_next_request' /usr/lib/ruby/vendor_ruby/phusion_passenger/request_handler/thread_handler.rb:113:in `main_loop' /usr/lib/ruby/vendor_ruby/phusion_passenger/request_handler.rb:416:in `block (3 levels) in start_threads' /usr/lib/ruby/vendor_ruby/phusion_passenger/utils.rb:113:in `block in create_thread_and_abort_on_exception'

[jpoulos]

https://www.imsglobal.org/spec/lti/v1p3#lti_message_hint-login-parameter

I wondering if it's related to the lti_message_hint also differing between what Canvas sends and what's returned. You should be returning the same value that Canvas sends in the initiation request.

I'm suspect the JWT that the tool is returning is missing important data that Canvas needs to form the launch request.

[haeven]

Yes, but as you can see by the screen shots, the tool is returning the exact same lti_message_hint that Canvas sent originally, so I'm still unsure as to why it would be throwing such an error.

[jpoulos]

Look at the end of the JWT's in your 1st and 3rd screenshot, they are different. They begin the same, but end differently.

[haeven]

My apologies, those screenshots are not of the same request, here are some of the same request in which the lti_message_hint is indeed the same but Canvas is still throwing the error specified earlier.

OIDC Login Request from Canvas:

Id_token Request from Tool

Result:

while(1);{"errors":[{"message":"An error occurred.","error_code":"internal_server_error"}],"error_report_id":238}

[jpoulos]

If this is the same error that your team discussed with me last week ( Nil is not a valid JSON source.), then this would appear to be due to Canvas being unable to retrieve the launch data from cache. You can see the full error report by going to https://canvas.greatriverlearning.com/error_reports/238 as your siteadmin user. We had recommended verifying that redis is set up correctly.

Do you get the same error if you spin up a new Canvas host using the docker setup? https://github.com/instructure/canvas-lms/blob/4159e09bc08bd7b516f26c5f75f8c0bfccbc8ea5/doc/docker/R...

[haeven]

I will test this in another environment and get back to you. Thank you very much for you support up to this point!

[rohits_paktolus]

Hi Haevan,

I have one question please guide me about this:

how many LTI 1.3 tool can be created in the canvas of the same domain?

[mahmoud_mostafa]

Hi Rohit, 

did you reach out something for this error 'UnknownAlgorithm' ? , I am getting the same error though my key looks fine 

{ "e": "AQAB", "n": "qHErINvmzcRquA5c74GT8vWcR7kWNOXc6wIxYBS1zB6bQFsuXAhHbHx5pJeZJIbSFiXX9Bbb5zICtY4DHrtHmHEKLHkk4U_7MgYWnUQN9NfYN0W_OQYlm-zR5dAk3JFONw7LnhxV6qOIWAJkGpjdNX0LxKXTh51u7Lwd_BTkltLK_2IDpXu_EfeFq2lw6lrJRn-6-fzKE8HN28MFgCs0AWb38-ls5N21qbyNB-06HM-ZGaR3Ok8Fjzz34VO9R-vcPhLci7iLhVD1nWfiDLQCl5FVXJ5DQv7JDUvVBXX5GB0bhW_-6zHuNleaQsYJFWVv1wIlhoI17IpDaQ347a9FZsJGseO6pYE66EL6OJouquG3X0byEr3DrSKuK4WvLoyDFwtQmQiOWR1b0wPLwiQMdm0atXS2g5yeXFGTbHG1Jj_z2XRILCHv7o2uF3GVELKfEi3j2_xs9R0gn3hRo1a__f6BKOeEuJtC8LKwwFe1CsB0f2igPwbOPekZgxYmilIfmmn0ggcc24RGXPDgg8KiA3dvIlEotdx0VkuScLLiOfk_AtUjkq9WcJpj_YhXmMiOZApTInGoWVJL6cm5a-akS45KUWGDwWns2ZFxbkS9jgRRF_A0FZ1gHgnUCgzCwCaBcFfI405O5Jv8sw_3Q-rslOSC3qOWomEdhHtJh1dMH_k", "alg": "RS256", "kid": "700f7577-64c5-403f-92af-e67e6782781d", "kty": "RSA", "use": "sig" }

[alousseni]

Hello !

I seem to have exactly the same issue, however the link on your post is dead,

Do you know what the steps to resolve the issues were ?

Thank you !

[rohits_paktolus]

 @haeven ‌,

Can you please give me all the parameter names(ex.iss,login_hint etc) that are getting from the canvas when initiated login?

[hinal_pandya]

parameter names - iss, login_hint, client_id, target_link_uri, lti_message_hint and canvas_region

[rohits_paktolus · Accepted solution]

Hi Hinal,

Thanks for your response.

 Can you please tell me the following which LTI advantage services are supported now in Canvas?

1.Deep Link

2.Assignment And Grade Services

3.Names and roles provision services.

[hinal_pandya]

 endpoints are currently supported:

https://canvas.instructure.com/doc/api/file.oauth.html#use-access-token

[rohits_paktolus]

Hi Hinal,

I have one question please guide me about this:

how many LTI 1.3 tool can be created in the canvas of the same domain?

[krishnalallk]

@all I am also facing the same issue. Is this issue still open?

Help is much appreciated.

My case is different. I am only facing this issue when I try to launch my external tool inside canvas through iFrame using Safari browser. In all other browsers it's working fine.

I am getting error response as follows for the OIDC Login Request

error: login_required
error_description : Must have an active user session.

Safari version is

[krishnalallk]

@all;

 

After enabling cross-site tracking in the safari app. Now I am bale to access my external app. Looks like the fix needs to be done from the Canvas side.

[karl]

Take a look at this post for some advice on working with Safari and cross-site tracking. Safari 13.1 and LTI Integration