Issue in launching external app in self hosted canvas LMS

[ArunShankar]

We created a self hosted instance for canvas LMS(https://canvas-loree.crystaldelta.net) with AWS. But while integrating an app it throws Authentication error.
The External app with the client and secret key was configured and the platform is registered successfully but after the "authorize_redirect" process it redirects it to our API with no id_token. The Authentication process gets cut-off and internally it throws error and showing blank page.

This is our public JWK URL with RSA algorithm, https://canvas-loree.crystaldelta.net/api/lti/security/jwks.

Is there anything we missed during the app integration process?

[svickers2]

Your public JWK URL is not returning any public keys, so perhaps you have not yet defined a private key for your instance.

[rajas]

Thank you very much for your reply, @svickers2. Could you please guide us through configuring the JWK keys in our Canvas instance?

Here are the steps we've taken so far, but it’s not working as expected:

1. Place the jwks.json File: We saved our jwks.json file in a directory accessible by Apache, e.g., /var/www/canvas-loree/api/lti/security/.

2. Configure Apache to Serve the File:

   • We opened the Apache configuration file for our site (e.g., /etc/apache2/sites-available/canvas-loree.conf).

   • Add an Alias Directive: We added an alias to the file, configuring Apache to serve it as JSON at the desired URL endpoint.

[svickers2]

Sorry, this is not something which I have done, but I believe the keys are stored in the config/dynamic_settings.yml file - see the lti-keys section.

[rajas · Accepted solution]

Thanks  @svickers2 . I have resolved the issue by generating a new key and updating it in the config/dynamic_settings.yml file. The LTI is now working correctly.


The Steps involved in generating a new JWT token

1. Open the Canvas console using bundle exec rails console

2. Run the following code to generate the token

key = OpenSSL::PKey::RSA.generate(2048)

jwk = key.to_jwk(kid: Time.now.utc.iso8601).to_json

puts jwk

3. Copy the JSON key and stringify it using JSON formatter.

4. Update the key in config/dynamic_settings.yml in the file.

5. Once the file is updated, restart the canvas service. Now the LTI works as expected in self-hosted in canvas instance.

[JimFoscue]

Hey I also deploy the canvas lms from github into AWS.  We support a large group of users including professors and students.  

I'm looking for someone that has some knowledge on building Canvas from github.  We have noticed that it uses outdated node/yarn libraries that have vulnerabilities in them.  Does anyone know anything about building Canvas with updated node/yarn libraries?

[rajas]

Yes, @JimFoscue, we can use the updated Node and Yarn libraries to configure the self-hosted Canvas LMS. Could you please proceed with the setup and let me know if you face any issues?

[JimFoscue]

I'm sorry what specific setup are you referring to?  We are trying to use the latest version of Canvas from https://github.com/instructure/canvas-lms.git. We are actually building a docker container for it.