We have reported these two issues on the opensource repo tracker, but have gotten zero information or responses on them.
Today, canvas will fail to handle the NRPS service in a migrated 1.1 assignment as it tries to use the wrong tool consumer and throws an error.
The same thing happens with oauth_consumer_key_sign. Becuase of their "domain matching" logic, they can find the wrong tool since they just order a list of all tools with matching domains.
Anyone know how to get canvas to look at this or notice? Its technically a security issue as it thinks a tool is actually a different tool.
https://github.com/instructure/canvas-lms/issues/2289
https://github.com/instructure/canvas-lms/issues/2287
