search

jupyterhub / ltiauthenticator

A JupyterHub authenticator for LTI
https://ltiauthenticator.readthedocs.io
BSD 3-Clause "New" or "Revised" License
67 stars 54 forks source link

The token is not yet valid (iat) - lti1.3 #197

Closed bpfrd closed 3 months ago

bpfrd commented 3 months ago

Hello,

It seems that the id_token is not valid from now and there is a couple of seconds delay in my case which causes the token is not valid (iat). I described the issue here https://discourse.jupyter.org/t/the-token-is-not-yet-valid-iat/26342/3 I would like to know how this happens and how I can resolve it.

best,

martinclaus commented 3 months ago

The reason for the problem is an offset in the system clocks of the two systems, the LTI platform and the hub. This may be caused by time zone settings or drift. Best is to use the same ntp server for both systems and to make sure that they regularly synchronise.

The validation of the token is delegated to the pyjwt library which supports the specification of a leeway margin to account for synchronisation or clock drift issues.

You an configure the value of the leeway time in the LTI13LaunchValidator class. It is a positive Integer value that gives the number of seconds that is allowed as a miss match. You can find an example here.

I hope that helps 🤞🏻

bpfrd commented 3 months ago

The reason for the problem is an offset in the system clocks of the two systems, the LTI platform and the hub. This may be caused by time zone settings or drift. Best is to use the same ntp server for both systems and to make sure that they regularly synchronise.

The validation of the token is delegated to the pyjwt library which supports the specification of a leeway margin to account for synchronisation or clock drift issues.

You an configure the value of the leeway time in the LTI13LaunchValidator class. It is a positive Integer value that gives the number of seconds that is allowed as a miss match. You can find an example here.

I hope that helps 🤞🏻

Thanks for the clarification.