Community

svickers2 · ‎04-06-2023

If you're getting the same error with an empty array of content items, then try checking the JWT as a whole is properly formed (e.g. check headers). Also try removing the sub and locale claims, adding a nonce claim, and passing the aud claim as a single-entry array.

svickers2 · ‎03-28-2023

I assume your JSON body includes the closing array and JSON brackets (which are missing from the image I can see in your post). The best I can suggest is that you ensure that your public key endpoint is accessible from the Canvas server, and try omitting the elements you are not using (text and resourceId) in case Canvas does not like empty values for these.

svickers2 · ‎01-19-2023

The two things I would suggest you try first are to make the aud claim an array (this is not required but recommended, I believe), and either drop the azp claim (which is optional) or make sure that it is the same value as the aud claim.

svickers2 · ‎01-12-2023

It looks like you are getting a "KidNotFound" error. Have you checked that your public key endpoint is accessible by Canvas and that its response includes a public key with the same kid value as used in the JWT you sent?

svickers2 · ‎01-04-2023

Do the login_hint and lti_message_hint parameter values match those you received from Canvas? Is the URL of "https://psc27765.illuminateed.io/qa27765/ltiadvantage/assessment/" registered as a redirect URI in Canvas?

svickers2 · ‎01-04-2023

What is the URL of the page reporting the 404 error?

svickers2 · ‎01-03-2023

Yes, that is correct, the system at lti.tools/oauth confirms the signature from Canvas. See attached image of the entry forms I used.

svickers2 · ‎01-03-2023

I have been able to confirm the correctness of the OAuth signature being sent by Canvas using the site at http://lti.tools/oauth. So I believe any error must lie at your end. For example, make sure that you are URL-decoding any parameter values (and names).

svickers2 · ‎01-03-2023

Thanks for the details. So are you saying that Canvas has been configured with a consumer key of "clkey1234" and a shared secret of "clkey12345" and a launch URL of "https://leep-syl-canvas-preview.dev7.leepfrog.com/ribbit/?page=lti" for the link being used?

svickers2 · ‎12-27-2022

I am not aware of any other reasons which might cause this signature issue. Are you able to share an example message (including the full URL, POST data parameters and shared secret used to sign it) so that I can take a closer look?

svickers2 · ‎12-22-2022

Yes, I would expect the signatures to match, unless your URL has a query parameter which comprises just a name (no value or equals sign).

svickers2 · ‎12-21-2022

The aud, azp, exp, iat, iss and sub claims should all be included in the payload of your JWT.

svickers2 · ‎12-20-2022

I think the only way to set this property is via the XML configuration of the tool - see https://unh.instructure.com/doc/api/file.tools_xml.html. I also believe there is no way of checking the current value of this property.

svickers2 · ‎12-20-2022

Canvas will only generate a signature which complies with the OAuth 1 spec if you set the tool's "oauth_compliant" property to "true". Without this, any URL which includes a query parameter will have an invalid signature. And even with this any query parameter which comprises just a name (no value or equals sign) will cause Canvas to generate an invalid signature. HTH.

svickers2 · ‎11-17-2022

Whilst I find Canvas can be slow to update its interface when changes are made to the configuration of an App, I have not found an issue when adding an assignment. My LTI tool is called with an LtiDeepLinkingRequest message type as expected. I was using an instance of Canvas hosted by Instructure, so perhaps this is an issue with a local install?

svickers2 · ‎07-21-2022

I do not see any of these parameters in your authentication request: client_id login_hint redirect_uri lti_message_hint (if passed in the Login Initiation request message) Stephen

svickers2 · ‎07-18-2022

Thanks for the sample. This does not look like a valid response to an LTI 1.3 Initiate Login request from a platform. I would expect the response to include the following parameters: client_id login_hint nonce prompt=none redirect_uri response_mode=form_post response_type=id_token scope=openid state lti_message_hint and to be sent to an endpoint at /api/lti/authorize_redirect. See section 5.1.1.2 of the IMS Security Framework specification at https://www.imsglobal.org/spec/security/v1p1 for more details.

svickers2 · ‎07-17-2022

Are you able to share a copy of the request you are sending to the Login Initiation URL so it can be checked for possible reasons?

svickers2 · ‎07-12-2022

I suspect it is the domain of the launch URL which is causing Canvas to think the tool is already installed. Do you have any other tools defined on the same server?

svickers2 · ‎07-11-2022

Yes, the JWKS endpoint is /api/lti/security/jwks. It should return at least one public key. If it doesn't it probably means that you have not defined a private key in your Canvas instance.

Post Details	Date Published	Views	Likes
Confusion with the LTI LineItem service The more I test the LTI LineItem service in Canvas, the more confused I seem to become. I have already reported in a separate post about line items I create not being visible within the Canvas ...	05-11-2022	858	2
LTI LineItem not visible in Gradebook When I use the LTI LineItems service to create a line item associated with a resource link ID, the line item is created (it is returned when making a GET request to the LineItems service endpoint) bu...	05-11-2022	507	0
LTI Course Groups service The LTI Course Groups service is currently at the IMS Candidate Final stage. Does anyone know whether Canvas plans to implement this specification and, if so, whether there is any expected time...	04-05-2022	531	3
Is there a timeline for ceasing support for LTI 1.1? With IMS deprecating the OAuth 1.0A authentication mechanism used by LTI 1.0/1.1/1.2/2.0 last year (certification ceased 1 July 2021, see https://www.imsglobal.org/deprecation-notice-oauth-10a), I wa...	03-17-2022	816	3
500 Internal Server Error with LTI Public JWK URL Just a heads-up in case anyone else encounters this issue. I was getting a 500 Internal Server Error from Canvas when a user returns from an LTI tool with an LtiDeepLinkingResponse message. T...	01-19-2022	519	1
500 Internal Server Error with empty deep linking responses In my tests, when a user is returned to Canvas with a deep linking response message which does not contain a content_items parameter (or an https://purl.imsglobal.org/spec/lti-dl/claim/content_items ...	01-18-2022	869	0
Bug with accessing LTI tool's public key set? My explorations suggest that Canvas is failing to find a public key from a URL which returns a JWK Set with a content-type header of "application/jwk-set+json" as per the JSON Web Key (JWK) spec (see...	01-15-2022	950	1
Plagiarism Detection Platform I came across a description of this framework at https://ecpi.instructure.com/doc/api/file.plagiarism_platform.html and notice that it is implemented using LTI 2 which has been deprecated by IMS.&nbs...	04-04-2021	1091	1
LTI messages are not equivalent across different security models LTI launch messages signed with OAuth 1.0A included the following custom parameters by default (i.e. without asking): custom_canvas_api_domain custom_canvas_course_id custom_canvas_enrollment_sta...	07-25-2020	662	2

Posts	105
Solutions	10
Likes given	0
Likes received	58
Member Since	‎07-26-2018

Community

Have a Canvas Question?

Have a Mastery Question?

Have an Elevate Question?

Have an Impact Question?

Re: Error while creating line items

Re: Error while creating line items

Re: Getting 400 Server Error in LTI 1.3 Deep Linki...

Re: LTI 1.3 | JWT Error

Re: LTI 1.3 - Page not found error

Re: LTI 1.3 - Page not found error

Re: LTI OAUTH 1.0 Signature Mismatch

Re: LTI OAUTH 1.0 Signature Mismatch

Re: LTI OAUTH 1.0 Signature Mismatch

Re: LTI OAUTH 1.0 Signature Mismatch

Re: LTI OAUTH 1.0 Signature Mismatch

Re: LTI 1.3 Deep Linking Response Error "Client no...

Re: LTI OAUTH 1.0 Signature Mismatch

Re: LTI OAUTH 1.0 Signature Mismatch

Re: Assignment Selection set as LTI Deeplink, laun...

Re: Canvas LTI 1.3 OpenID Login Initiation Url no...

Re: Canvas LTI 1.3 OpenID Login Initiation Url no...

Re: Canvas LTI 1.3 OpenID Login Initiation Url no...

Re: This tool has already been installed in this c...

Re: LTI 1.3 link selection (module) setup

Canvas Developers Group