Community

Hi! I'm working on generating an access token in order to utilize the LTI 1.3 Advantage Services, but I'm a bit confused about one aspect of this grant flow and I'm hoping someone can provide some clarity. As described under 'Step 2: Request an access token' here: https://canvas.instructure.com/doc/api/file.oauth.html#developer-key-setup I'm trying to 'request an LTi access token using the client_credentials grant'. The link takes me here: https://canvas.instructure.com/doc/api/file.oauth_endpoints.html#post-login-oauth2-token Where the instructions state that I must create a request which is 'signed by an RSA256 private key with a public key that is configured on the developer key…'. The problem is, I can't figure out how to access the private key or use it to sign my request. I can create a JWT and an algorithm without issue, and the code looks like this: myUrl = "https://canvas.test.instructure.com/api/lti/security/jwks"; JwkProvider provider = new UrlJwkProvider(new URL(myUrl)); Jwk jwk2 = provider.get(decodedJWT.getKeyId()); Algorithm algorithm2 = Algorithm.RSA256((RSAPublicKey) jwk2.getPublicKey(), null); claimToken = JWT.create() .withAudience("https://"+CanvasApi.getCanvasURL()+"/login/oauth2/token") .withSubject(audComp) .withIssuedAt(jwtDate) .withIssuer(ltiURL) .sign(algorithm2); The problem seems to be that I can't create an algorithm for signing a JWT without a private key, and I can't figure out how to access the private key from the Public JWK found at https://canvas.test.instructure.com/api/lti/security/jwks . Can anyone please explain to me how I am supposed to use the JWK private key to sign my request for the grant_type 'client_credentials'? ( I should mention that I did try sending along the same JWT I received during step three of the LTI launch (as described here: https://canvas.instructure.com/doc/api/file.lti_dev_key_config.html#step-3 ), but the values for 'sub' and 'aud' were not correct. ) I suspect that I'm missing something obvious here, so please feel free to reply with any tips or hints that might be relevant. Thanks! -David ... View more

Good morning!   I'm attempting to make the https call referred to as the 'Authentication Request' on step 2 of these instructions: https://canvas.instructure.com/doc/api/file.lti_dev_key_config.html#step-2 but the Authentication Response is not being sent when I make the call from within my code, despite the fact that I'm getting a 'success - 200' response from the call.  If I copy/paste the same exact URL into a browser window, that does provoke the response which I receive at a servlet I set up for this purpose.  So the problem does not appear to be the format or syntax of the call itself, but something related to how it is being sent (perhaps a missing header element or request property?).  I've kept the code minimal to avoid issues, so I think it's likely that something needs to be added here, but I can't figure out what that might be.  Here's the relevant code: myUrl = "https://canvas.test.instructure.com/api/lti/authorize_redirect"; myUrl += "?scope=openid&response_type=id_token&client_id="+clientID+"&redirect_uri="+redirectURI+"&login_hint="+loginHint+"&state="+sessionID+"&response_mode=form_post&nonce="+sessionID+"&prompt=none&lti_message_hint="+messageHint; authUrl = new URL(myUrl); HttpsURLConnection authCon = (HttpsURLConnection)authUrl.openConnection(); authCon.setRequestMethod("GET"); int status = authCon.getResponseCode(); Does anyone happen to know what I need to add to this in order to execute the call successfully?  Since it works in a browser window, I assume there is an element present in those calls which I am missing here.  Any insight or advice would be greatly appreciated. Thanks! -David Rios Canvas Administrator Oregon State University ... View more

Hello everyone! We are in the process of migrating our custom LTI tools to another server, and I'm having some trouble getting a tool to launch from the new server.  We are using Tomcat for deployment, having upgraded to Tomcat 9 (from 7) as part of the migration, and put up an Apache front end as well.  The tool development is done in Eclipse using Java, HTML, and Javascript. I think the most important piece of information for troubleshooting this comes from the access log, which shows the initial POST call for a tool launch just like it used to (and nothing else): "POST /course_info/launch HTTP/1.1" 302 – However, the first thing that should happen after this call is a line should be written into the log, which is not happening.  So this suggests that the launch itself has reached out to the proper server with the proper request (meaning the dev key URI is correct), but then nothing happens after that point.  When I attempt to launch the tool, I get the message "Sorry, there was an error connecting you to the application".  I've triple checked the consumer id and key in the tool config, along with the client and secret in the xml config file. Is there some additional configuration required to allow the Apache front end to pass the request properly?  Do we need to change something about how we configure/build/deploy the tool given that we upgraded Tomcat to version 9?  Does anyone have any idea what I should even be looking at to troubleshoot this? Thanks! -David Rios Canvas Administrator ... View more

I've written a script to generate and download reports for all quizzes in a course, but it turns out that reports generated this way do not include the sis_id for the students.  If the report is generated manually, this appears as the third column, but I can't figure out a way to get the same data in the API generated version.  I've tried adding 'quiz_report[include]=sis_user_id' (and just 'sis_id'), but that did not seem to do anything.  Does anyone know how to get the sis_user_id in the api generated quiz report? Thanks! -David Rios ... View more

Hello!     We’ve created a tool to allow instructors to cross list courses, and some interesting behavior has been observed.  Immediately after the sections are cross-listed into the ‘master’ course, the instructor loses access to those added sections.      While acting as the instructor: 1)   In Settings -> Sections, the added sections appear in the list but are not selectable.  The section corresponding to the ‘master’ course is selectable (see screenshot ‘sections’).  2)    In the People page, only the students in the section corresponding to the ‘master’ course are visible, although the instructor is enrolled in every section, as you would expect (see screenshot ‘people’).  3)   The instructor is unable to create assignments or quizzes for any of the added sections, instead there is an error message displayed indicating that the added section id is unknown.      As an admin, I am able to access all sections within the course and see all enrollments from all sections in the people page.     In production, this goes away after some time passes, and the instructor suddenly has access to all sections and can see enrollments in all sections, just as you would normally expect.  In test, this never happens, so I set out to determine why.  After a few dead ends, I managed to fix the problem in test by running an enrollment import which essentially re-enrolled the instructor in all the sections with the ‘limit_privileges_to_course_section’ attribute set to ‘false’.  At this point, I thought I had it figured out, but there is a twist: I ran the enrollment import again, this time setting the attribute back to ‘true’, and it had no effect!  The instructor was still able to access all sections and see all people.  So, even though changing the attribute to ‘false’ fixed the problem, changing it back to ‘true’ did not re-create the problem.  This leads me to believe that there is an element to this that I don’t understand, so I am hesitant to apply this ‘fix’ to the tool.     I’ve compared the details of the enrollments, course info, course settings, course permissions, and section info using the Live API and there aren’t any differences that seem relevant.  This is true for settings before and after the cross-list, and before and after the enrollment import.       Does anyone have any insight into this situation that might help me understand what exactly is happening, and whether or not this does represent a viable solution?   Thanks! David Rios Oregon State University ... View more