LTI 1.3/Advantage login_required issue

I am trying to implementing LTI1.3 external tool. I have added the tool's URL in canvas and calling Canvas authorization end point https://my_canvas_instance/api/lti/authorize_redirect as get method with the required parameters (login_hint, redirect_uri, client_id, state, lti_message_hint, prompt, nonce, response_type, response_mode, scope).

Once the end point is called, Canvas redirects to Tool's redirect URI with error as 'login_required' and error description as 'Must have an active user session'.

I have verified my client_id. Everything looks fine. But, this error still occurs. Can someone help me out?

Find more posts tagged with

Accepted answers

All comments

unknown

Any update about this issue?

matthew_buckett

LTI 1.3 uses the this part of the OpenID Connect specification, https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin where the Provider (Canvas) initiates the login to the Relying Parting (the tool you are writing). If you are writing a 3rd party tool and wanting users to login to it using their Canvas credentials then you are better off using OAuth 2 and the special scope: https://canvas.instructure.com/doc/api/file.oauth.html#oauth2-flow

matthew_buckett

Using LTI 1.3 you have to use the Third Party Initiated Login and so in that case the user is already logged in and it wanting to access a tool so Canvas doesn't need to present a login screen. This flow is used for when the user is already in Canvas and wants to use some functionality of your LTI 1.3 tool.

If you are wanting to use Canvas as an authentication source for your application then you don't need to do LTI 1.3 and can just use a standard OAuth2 flow with a scope of `/auth/userinfo` as outlined in https://canvas.instructure.com/doc/api/file.oauth.html#oauth2-flow

In that example the user accesses your application and isn't logged in, you send them off to a Canvas instance starting the OAuth2 flow, Canvas prompts them to login (if they aren't already) and then when they return you will get the details about who the user is (but that's all).

matthew_buckett

The scope /auth/userinfo allows the user to select to remember the grant so that they don't get prompted every time they login. You can then send them back to Canvas to grant you a token with permissions to perform actions (when you get the token back you probably want to store it against the authenticated user), that way you can call the API on behalf of the user.

But all this is custom integration for Canvas and doesn't follow a standard so will need to be adapted for any other LMS/VLE (if it's even possible). Sticking to LTI 1.3/Advantage means your enhancements should be applicable to multiple LMS/VLE platforms.

unknown

My issue of login_Required is still not resolved. Can someone please help? As I have to integrate my tool with multiple LMS platforms including Canvas, Blackboard, Moddle.

matthew_buckett

LTI 1.3 is designed for tools embedded inside a LMS (so the user is already logged in), and clicks on a link within the LMS and at that point they are logged into the external tool and shown the content from the tool. If you are trying to use your tool that way could you explain in more detail the request that is failing as from your original description it sounds like you are trying to start the login flow from your external tool.

matthew_buckett

Thanks for the much clearer explanation of the problem, from my reading I can't see anything obviously wrong, it looks very similar to how our LTI 1.3 launches go.

The error message is coming from: https://github.com/instructure/canvas-lms/blob/master/app/controllers/lti/ims/authentication_controller.rb#L101

Are you correctly encoding the parameters in the GET request to /api/lti/authorize_redirect ?

I used Chrome network console to find the request you are talking about and did a "copy as cURL" and after editing this is an example of how our working requests look (very similar to yours). We do use the central LTI endpoints rather than the instance specific onces, but I've had it working on the instance specific ones so don't think your error is related to that.

curl 'https://canvas.instructure.com/api/lti/authorize_redirect?response_type=id_token&client_id=122010000000000038&scope=openid&state=9a7c9a316772b15e&redirect_uri=https://lti.canvas.ox.ac.uk/lti/login&login_hint=5de1538afb8f1cab07a03c891df215badaa4d7f7&lti_message_hint=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ2ZXJpZmllciI6IjVkZDBlN2U2YThlYjYyNWYxMmQ1NDA3Y2ZlMTMzY2IyMjZiYWUyYjM1YTk3Y2E1YzZmYjNmMjFlMzNlMTJkMjlhZGY0NzJiYmM5ZDc5MGU0Y2UyNWE3Nzg1NTE0MDhjMGJhMjAxOGI5ZmEyZjBkZmNlMDQ4NmM0NzU2YjE4NWM1IiwiY2FudmFzX2RvbWFpbiI6ImNhbnZhcy5veC5hYy51ayIsImNvbnRleHRfdHlwZSI6IkFjY291bnQiLCJjb250ZXh0X2lkIjoxMjIwMTAwMDAwMDAwMDAwMDEsImV4cCI6MTYxMTY2NjQ1M30.xtzccyfzahiJt1hUFamgj8HKXEHYXNdPEWT_plP2SOA&registration_id=universityofoxford-sa&nonce=9ab33dba-f0ca-4338-ab7f-746f545863ff&prompt=none&response_mode=form_post'

It doesn't work any more (because the JWT in the lti_message_hint is expired), it will give an error of:

{"status":"bad_request","message":"Invalid lti_message_hint"}

matthew_buckett

Using https://canvas.instructure.com only works if you are an Instructure customer using their hosted service.

If you are running your own instance of Canvas one gotcha I've come across is not running redis, Canvas will startup with just a database, but some functionality (OAuth2, probably LTI 1.3) doesn't work unless it can also connect to a redis instance.

matthew_buckett

My guess is that you don't have redis correctly configured, or you are retrying the same launch repeatedly and Canvas can't find the LTI launch in the cache (redis).

Looking at the code I think it's failing around https://github.com/instructure/canvas-lms/blame/master/app/controllers/lti/ims/authentication_controller.rb#L149 but you're running an older version of Canvas before https://github.com/instructure/canvas-lms/commit/31335da31f46495f748079baf7533220c60fbcf5 where is didn't display a nice error, but instead generated the 500(?) error you are seeing.

YStudent

I did the exact same thing but can't solve it.

Platform/Issuer ID:.
Client ID:.
Deployment ID:
Authentication request URL:
Access Token service URL:
Public Keyset URL:

All of the above is perfect. However, my saLTIre says "Verification (strict mode): Failed (login_required: Must have an active user session)".

Is there any solution other than writing dynamic_settings.yml ?. Is there any other solution than writing dynamic_settings.yml?

Unanswered Questions

Concluded Course and Canvas Data Services
Canvas Data Services sent out an alert that a course was concluded (because the course was concluded) and the status of each user in the UI is set to complete, however, the enrollments API endpoint shows the status of each user in the course as active. Is this a common issue? Have I misinterpreted how the individual…
Canvas Media Question
How can one track Canvas Media use without having the reports available from Canvas Studio? Checking API endpoints and the Data 2 schema, there do not seem to be dedicated Canvas Media endpoints. Am I missing some? A method I've considered is using the body field of the wiki_pages table, as this contains the html code of…
Canvas Catalog API - Completed Certificates
Hello, I'm trying to utilize an API call to pull completed certificates and was hoping to download and store the certs as a backup. I can successfully run the API call but it will not allow me to view the certificate unless I access the URL while signed into an account where it's "my" cert. Is there a permissions setting…
UI for weekly progression idea
UI for weekly progression idea that rest in the Schedule tab of the **K-12 UI** of Canvas it's incomplete and I really would not take it and push it into instance but I am going to post it here because in the past people like @James && @robotcars || @Steve_25 have had terrific input in the past... maybe w/their eyes and…
Canvas integration with React + Flask webapp - initially for authenticaiton
I have a new React + Flask webapp. It has its own login for users to start using the app. I have added this as an external tool in Canvas. What I want initially is to see of canvas users can start using the webapp without having to login if they click on the external tool link in a canvas course. I have 2 methods…