Hi all, I've been trying to set up a basic LTI 1.3 integration, and it's mostly working correctly. I have set up a course and attached a resource from my integration using a deep link response containing the following deep-link item:     { "https://purl.imsglobal.org/spec/lti-dl/claim/content_items": [ { "type": "ltiResourceLink", "title": "Deep Link to: Resource2", "url": "https://my.example.tool/launch", "custom": { "name": "Resource2", "value": "value2" } } ] }     Canvas successfully registers the link. Subsequent launches correctly pick up the URL and the custom parameters as specified above. All is well. However, when I then copy this course (by any method), the link isn't copying over correctly: launches happen to the correct URL, but the custom properties are never available in the payload - thus I can never actually resolve my deep link. My expectation was that the custom parameters would be copied over to the new course. Are my expectations incorrect? Or is this a known bug with Canvas' LTI 1.3 deep links and course-copy? (I am aware that, until recently, Canvas did not completely support the custom parameters, and they needed to be added as query-parameters on the `url` in the `ltiResourceLink` item. I'd prefer not to use that approach as it doesn't work in other LTI platforms. However, I can appreciate that it may work more reliably for the interim.) Update: I also tried creating a Page and used the RCE editor_button placements to embed the same Deep Links. In this case, the Deep Links do copy correctly, and bring their custom parameters with them. It seems to be particular to the link_selection placement. Thanks in advance, David ... View more

I am trying to use the Assignment and Grade Services in a tool and am stuck on retrieving an access token. I am following the instructions here to make a post request to /login/oauth2/token with a grant_type of client_credentials. Here is the information contained in the body of the post request: {'scope': 'https://purl.imsglobal.org/spec/lti-ags/lineitem https://purl.imsglobal.org/spec/lti-ags/result/read', 'grant_type': 'client_credentials', 'client_assertion': u'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMDAwMDAwMDAwMTUyOCIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC8iLCJqdGkiOiIxMjM0NTY3ODkwOTg3NjU0MzIxIiwiZXhwIjoxNTk4ODkyOTA4LjkyNjA0OSwiaWF0IjoxNTk4ODg5MzA4LjkyNjA0OSwiYXVkIjoiaHR0cHM6Ly93aWxleS5pbnN0cnVjdHVyZS5jb20vbG9naW4vb2F1dGgyL3Rva2VuIn0.NZOjZ-i-s7HvTiOL-wv50ptPIAiR10RyhaAksmLFqAEjPP0T1cO8TdDR0NXBkV5IupyLzW5Cm8AUgucz_LPyjbLwK48ZCbWqo6Z7_LabpQlzW4clqDh6V4DEBwl8pmRSsLrvNTCJHIQwiTbXFpRR0rGCtSQXAhNbvxh6GqL_HE1WJA2MaBLWtHdYKwMruHlSeEVIvCfb-g0Mw6XnmEodKkhAqO8c29LgZRmL80qSBImNrbLbWx7-DltV4Me-OeqUs_3hWUtzoTGTu2P7G8Wu6we-Hio45Qv9YIK-vcr6YYJO3JInxcUdF5b6cLrScEWQHyCn8c6fUUlMBjJPfiu6tQ', 'client_assertion_type': 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'} Decoded JWT: { "sub": "10000000001528", "iss": "http://localhost:5000/", "jti": "1234567890987654321", "exp": 1598892908.926049, "iat": 1598889308.926049, "aud": "https://wiley.instructure.com/login/oauth2/token" } Using the following public key, I can verify that the signature for the jwt in the client_assertion field is valid by entering it into jwt.io. -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr2kl1OwVx3D6UHFmnVoZ ++9hWqp+c6Fg1mLMLJOIRKIGzh/nzLtbTQm+8+ilY05hHke9P+VO3i2Okece/JkC u9LbJWIIgi4sSPX0ZKgVmTt7rnSEYeg0hRqj1W2NDIyXf91c4jLQH0FbWSd70h50 3z1Q3AxcnUNkjuYP+5wsPhKoGT9Uk6I6aZUvDNlv+0Bm9/caqJDtYUASLZT/DlrE M3dkTCsgdJxW45oCF5cwfNQHV8gAMH0u3+KGxPBnO9WfR4UEKh+JD7iY70b0y3vO pMJFTWOZK1sZ7B0PppEId1zuxNT5arXMftSoJKnyoI6d3MgkRz2e2KO58AbbQK3p oQIDAQAB -----END PUBLIC KEY----- The LTI tool is configured as follows: In the Public JWK field I have the following: { "e": "AQAB", "n": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr2kl1OwVx3D6UHFmnVoZ++9hWqp+c6Fg1mLMLJOIRKIGzh/nzLtbTQm+8+ilY05hHke9P+VO3i2Okece/JkCu9LbJWIIgi4sSPX0ZKgVmTt7rnSEYeg0hRqj1W2NDIyXf91c4jLQH0FbWSd70h503z1Q3AxcnUNkjuYP+5wsPhKoGT9Uk6I6aZUvDNlv+0Bm9/caqJDtYUASLZT/DlrEM3dkTCsgdJxW45oCF5cwfNQHV8gAMH0u3+KGxPBnO9WfR4UEKh+JD7iY70b0y3vOpMJFTWOZK1sZ7B0PppEId1zuxNT5arXMftSoJKnyoI6d3MgkRz2e2KO58AbbQK3poQIDAQAB", "alg": "RS256", "kid": "10000000001528", "kty": "RSA", "use": "sig" } And under LTI Advantage Services I have enabled all permissions. I am stumped why this is not working. When I make the post request to https://<mydomain>/login/oauth2/token all I receive is this: {"error":"invalid_request","error_description":"JWS signature invalid."}  But the signature is valid. ... View more

We are new to Canvas, coming off of Blackboard. I've got to say, I'm kind of shocked and dismayed at how   little can be   accomplished   via the GUI. It seems like just about every thing I ask our implementation team about doing, the answer is always "you'll need to figure out how to do it in the API."  Batch apply/change the Grade Scheme? Do it   via   the API. Batch course-copy material? Do it   via   the API. Batch publish a bunch of courses? Do it   via   the API. I've been sent to this page a number of times:  Canvas LMS API Documentation We do have a programmer on staff who   I know can figure this out. However, he's a busy guy and has limited time to be able to spend on   this. The Canvas LMS API Documentation link above doesn't really give any information on where to   begin...what do we need installed on a PC to make these calls, for example? We've asked Canvas how to do this stuff, for some baseline instruction on how to setup a PC to run the scripts, only to be told "Instructure cannot tell you that, we're not a scripting company." I don't know how they can tell us "we can't tell you how to do this" when the software seems to rely on scripting for damn-near everything.   Can someone point me to   some instruction please? Is there nothing out there, some kind of baseline instruction on how to prep a PC to run a script that can run against a Canvas environment, and how to build one of these scripts, so we can make some of these batch changes that came SO EASILY in Blackboard? Surely there are schools with Canvas who   don't   have an army of programmers at their disposal,   but   still have a need to accomplish tasks that the woefully inadequate GUI can't do. What do they do?! ... View more