LTI 1.3 OIDC authentication

Rohi145 commented 5 years ago

Hi Martyn,

When we are using your or other private key for OIDC authentication its working fine...when we are using blackboard private key then its unable to validate oidc...Can you please help me in this scenario?

MartinLenord commented 5 years ago

What are you using as the key_set_url for your registration?

Rohi145 commented 5 years ago

https://developer.blackboard.com/api/v1/management/applications/53ff6a48-5896-4d30-8922-83c713dbc2bf/jwks.json

MartinLenord commented 5 years ago

Ok, what is the message in the exception when trying to validate a signature with that key?

Rohi145 commented 5 years ago

Uncaught exception 'IMSGlobal\LTI\LTI_Exception' with message 'Invalid signature on id_token

For your reference ,Please find below my private key

MartinLenord commented 5 years ago

@Rohi145 The incoming LTI request and id_token isn't validated by your private key, it is validated against the public keys at the JWKS endpoint. The endpoint you gave doesn't have any keys in it https://developer.blackboard.com/api/v1/management/applications/53ff6a48-5896-4d30-8922-83c713dbc2bf/jwks.json so it can't find the correct key to validate the request. It may be that your registration has been deleted in blackboard and you need to create a new one

RohitAShirsath commented 5 years ago

Hi Martyn,

Sorry for inconvenience. Please find below new keyset and private key:

https://developer.blackboard.com/api/v1/management/applications/d27856fc-cf33-44a6-83e8-e1b910c87397/jwks.json

MartinLenord commented 5 years ago

@RohitAShirsath what does your implementation of LTI\Database look like? are you just trying to get the example code working or are you using the library in your own code? (i would also advise not putting your private key in public comments as it would allow people to do impersonation attacks)

Rohi145 commented 5 years ago

@Martyn, We are using your library in our project. But signature verification is not done properly. Also, Thanks for your advice. But these are our testing account keys. We are using these keys on the local server.

MartinLenord commented 5 years ago

The signature is done here https://github.com/IMSGlobal/lti-1-3-php-library/blob/master/src/lti/lti_message_launch.php#L287 could you add in some logging to check what is in $this->request['id_token'] and $public_key['key'] at that point?

Rohi145 commented 5 years ago

@Martyn, Is signature verification done on your side using our credentials?

We already go through that process. But we are getting the same error at each time.

MartinLenord commented 5 years ago

The library handles validating the signature, for example $launch = LTI\LTI_Message_Launch::new(new Example_Database())->validate(); When validate is called the library will use the Example_Database to identify the registration, then will fetch the public key from the key_set_url provided and validate the signature. There isn't currently a way to bypass the libraries signature validation. So if you have already validated the JWT manually, the library will do it again

Rohi145 commented 5 years ago

@Martyn,

We are passing key set and priveate key in JWT.But validation failed using that keys.

we are missing something?

MartinLenord commented 5 years ago

You do not validate the id_token with your private key, you validate it with the platform public key that matches the KID from the id_token that is fetched from the key_set_url

The private key is used to sign requests that the tool makes to the platform

Rohi145 commented 5 years ago

@MartinLenord

Yes, we agree with that. When we validate token with the public key, we are getting Signature verification failed error.

Can you please guide me about that?

MartinLenord commented 5 years ago

Can you send me the id_token you are trying to sign and the public key you are using to sign it

MartinLenord commented 5 years ago

hmm, interesting, that JWT is signed with your private key not blackboards, did you resign the request?

MartinLenord commented 5 years ago

Why are you re-signing the request? You can't resign a request from a platform, because you don't know the platform's private key, you can only validate it with the public key

Rohi145 commented 5 years ago

@MartinLenord ,

Means you want to say that,do not use blackboard credentials for JWT authentication?

So what are the use of keyset and private key provided by blackboard to us?

Because we are using that one for JWT creation and authorization.

MartinLenord commented 5 years ago

Each party (tool and platform) has two keys, a public key and a private key. The private key is used to sign requests, the public key is given to the other party so that they can validate that a message is really coming from the first party.

Blackboard gives you a private key for you to sign requests that are going back to blackboard with, it also gives you a JWKS url so that you can get their public key to validate that the incoming request is coming from them.

You only sign outgoing requests with your private key (like requesting a service access token or signing a deep linking response)

Rohi145 commented 5 years ago

@MartinLenord We are doing the following steps please tell us we are correct or not:

Now blackboard provides us private key, keyset url. 2.We are using that private key for JWT creation and validate with the public key generated by keyset url. Also we are using the private key for access token generation. But also not getting any access token using that private key. Please go through these steps and tell me what is wrong in that.

Also,If platform private key is used for JWT authorization .So how to get a platform private key that is decode with key set url.

Rohi145 commented 5 years ago

@MartinLenord

keys.php that is included in return.php is also not existed.

And if we are using your tool private key (i.e. defined in private.key file) in return.php file then its JWT signature is validated using JWK key set. Because of that, we confused about credentials.

1EdTech / lti-1-3-php-library

LTI 1.3 OIDC authentication #18