When requesting an access token, the client assertion JWT iss and sub must both be the OAuth 2 client_id

[kochen]

Hello, we have made several connection from various LTI Platforms (LMSs) to our LTI Tool, including (among other things):

• OIDC initiation
• Score publishing
• and the obvious base operation "get access token"

In a recent integration, we encounter an error message coming from the LTI Platform, indicating that an access token was not obtained. Further investigation with the developers of the Platform, we discovered that the iss and sub sent on the access token request are not matching the expected values.

Looking at the code, and specifically the LtiServiceClient, it's clear that the iss is set for the audience and the sub is set for the client_id:

                    MessagePayloadInterface::CLAIM_ISS => $registration->getTool()->getAudience(),
                    MessagePayloadInterface::CLAIM_SUB => $registration->getClientId(),

Reading the LTI documentation, it is stated that:

When requesting an access token, the client assertion JWT iss and sub must both be the OAuth 2 client_id of the tool as issued by the learning platform during registration.

We tested it out and indeed setting both the iss and the sub to the client_id resolved the issue, but also did not affect any other existing connection!

Should this be indeed fixed here?

M.

[kochen]

@wazelin could you take a look at this?

[wazelin]

Resolved in https://github.com/oat-sa/lib-lti1p3-core/releases/tag/7.0.3.

Thank you for your contribution, @kochen! Much appreciated.