TokenRetriever Class - Githubissues

oxctl / spring-security-lti13

A LTI 1.3 implementation for Spring Security that builds on the OAuth2 support

Apache License 2.0

16 stars 7 forks source link

TokenRetriever Class #10

Closed agarwalneha29 closed 3 years ago

agarwalneha29 commented 3 years ago

Hello Developer, I was trying to use spring-security-lti13 to provide LTI1.3 authentication in our project. I have few questions if you could help me out:

The spring-security-lti13-demo mentioned on the specification, returns a JSON with Public Key and after going through all the references, I came to a conclusion that this Public Key is NOT a Token for authentication. And if it is a Public Key, then how we can fetch the Token.
I need to get the token and authenticate the client, and as per my understanding on spring-security-lti13 code, there is method called getToken(ClientRegistration clientRegistration, String... scopes) from TokenRetriever file, that would help me to fetch the token by providing various parameters.

Please guide if my understanding is wrong in the above two points.

buckett commented 3 years ago

I'm slightly confused about what you are trying to achieve. A public/private keypair is only needed when you are trying to use one of the LTI Advantage APIs for example the Names and Roles Provisioning Service which has basic support in this library or the Assignments and Grade Services which isn't supported at all.

If you are just wanting to launch to the tool you don't need the public/private keypair.

agarwalneha29 commented 3 years ago

Thanks for your reply. I am supposed to implement launch of our third party tool through LTI1.3 authentication. As per "https://www.imsglobal.org/spec/security/v1p0/#openid_connect_launch_flow" i.e. open id connect launch flow, i should receive a id_token, that i would use to redirect to third party tool.

buckett commented 3 years ago

The token is returned in the last part of the login, are you need direct access to the token or just the claims in the token? If you just want to access the claims you should be able access the principal and get at the claims from that.

agarwalneha29 commented 3 years ago

Thanks for your reply. I have gone through the code and understood a lot of things. Actually, earlier I was trying to retrieve the token but now we just need the target link and in between apply the user provisioning. Thanks once again and Have a great day.

buckett commented 3 years ago

Ok, closing the issue for now.