Open edX as an LTI provider with Canvas

Zachary_Trabookis · September 22, 2023, 1:48pm

@pdpinch @sambapete
Have you figured out how to get this to work with edX authentication for Canvas or other external LMS?
4.20.5. Configuring Open edX User Authentication for LTI — Installing, Configuring, and Running the Open edX Platform documentation

I’ve setup a TPA > LTI Provider Configuration but I don’t see the registration page whenever I attempt to load an LTI external link from Canvas.

It appears that the LTIUser doesn’t exist the first time and therefore this create_lti_user gets called.

github.com

openedx/edx-platform/blob/master/lms/djangoapps/lti_provider/users.py#L31-L38


      
          try:
              lti_user = LtiUser.objects.get(
                  lti_user_id=lti_user_id,
                  lti_consumer=lti_consumer
              )
          except LtiUser.DoesNotExist:
              # This is the first time that the user has been here. Create an account.
              lti_user = create_lti_user(lti_user_id, lti_consumer)

Seems like if the TPA > LTI Provider Configuration authentication worked that the request.user would be the TPA LTI user. This logic below switches the to the LTI User if it notices that the lti_user is not the request.user. I only see the lti_user being created during the lti_launch method and nowhere else.

github.com

openedx/edx-platform/blob/master/lms/djangoapps/lti_provider/users.py#L40-L44


      
          if not (request.user.is_authenticated and
                  request.user == lti_user.edx_user):
              # The user is not authenticated, or is logged in as somebody else.
              # Switch them to the LTI user
              switch_user(request, lti_user, lti_consumer)

You’d think that somewhere in this authentication logic for LTIAuthBackend that it would create that lti_user if it didn’t exist to avoid switching the logged in user if they authenticated over this third-party LTIAuthBackend.

github.com

openedx/edx-platform/blob/master/common/djangoapps/third_party_auth/lti.py#L28


      
          )
          from social_core.backends.base import BaseAuth
          from social_core.exceptions import AuthFailed
          from social_core.utils import sanitize_redirect
          
          log = logging.getLogger(__name__)
          
          LTI_PARAMS_KEY = 'tpa-lti-params'
          
          
          class LTIAuthBackend(BaseAuth):
              """
              Third-party-auth module for Learning Tools Interoperability
              """
          
              name = 'lti'
          
              def start(self):
                  """
                  Prepare to handle a login request.

I even pushed up the common.djangoapps.third_party_auth.lti.LTIAuthBackend to the top of the AUTHENTICATION_BACKENDS list to see if that authentication would run first. This Django documentation mentions that the order of these authentication backends matters because it tries the first one on the list, then if that doesn’t work it goes to the second one until a successful authentication or not is achieved.

# We have this setting enabled.
>>> settings.FEATURES['ENABLE_THIRD_PARTY_AUTH']
True

# Here is our settings for authentication backends. LTIAuthBackend is at the front of the list.
>>> settings.AUTHENTICATION_BACKENDS
['common.djangoapps.third_party_auth.lti.LTIAuthBackend', 'social_auth_backend_bigcommerce.backend.BigCommerceCustomerTrustworksAuth', 'social_auth_backend_bigcommerce.backend.BigCommerceCustomerDefaultAuth', 'social_core.backends.google.GoogleOAuth2', 'social_core.backends.linkedin.LinkedinOAuth2', 'social_core.backends.facebook.FacebookOAuth2', 'social_core.backends.azuread.AzureADOAuth2', 'common.djangoapps.third_party_auth.appleid.AppleIdAuth', 'common.djangoapps.third_party_auth.identityserver3.IdentityServer3', 'common.djangoapps.third_party_auth.saml.SAMLAuthBackend', 'rules.permissions.ObjectPermissionBackend', 'openedx.core.djangoapps.oauth_dispatch.dot_overrides.backends.EdxRateLimitedAllowAllUsersModelBackend', 'bridgekeeper.backends.RulePermissionBackend', 'lms.djangoapps.lti_provider.users.LtiBackend']

It appears the edX Authentication may have been removed in favor of the anonymous authentication. I cannot be for certain about that but I’m looking into what was removed with this commit as this one made it anonymous authentication.

github.com/openedx/edx-platform

This change cleans up the work in progress request at #8176

committed 02:21PM - 12 Jun 15 UTC

mcgachey

+413 -23

This is an initial authentication implementation that allows LTI users to log in… transparently to edX. The behavior is driven by pilot users at Harvard; this was the most requested feature. The patch creates a new database model that maps users' LTI identifiers to newly-created edX accounts. If an LTI launch comes in with a user_id field that is not in the database, a new edX account is created with a random user name and password. This account is then stored in the database, so that it is permanently associated with the LTI user ID. This patch takes a simplistic approach to session management. If a user is logged in with a different account when they perform an LTI launch, they will be logged out and then re-logged in using their LTI account. In order to keep the patch simple, I have split out some refactoring that needs to be done into a separate branch that I'll post once this has been merged. Since we no longer redirect to the login page, we don't need to maintain two separate LTI endpoints (one for the LTI launch and one for authenticated users), or deal with the session management that requires. There are also multiple fetches of the LtiConsumer object (one in the view, one in the signature validation) that the later patch will consolidate into one. This branch fixes the previous conflicts with the test refactoring carried out in PR 8240.

Topic		Replies	Views
A question about LTI provider support in Open edX Architecture	9	2090	September 21, 2021
Open edX as LTI Provider -- Anonymous Authentication 500s Site Operators lti	2	233	October 12, 2023
LTI Provider in Nutmeg and future releases? Site Operations Help tutor	14	1143	September 30, 2022
Open edX as an LTI Provider? Site Operators	13	1374	June 15, 2023
LTI issue with Lynda (LinkedIn Learning) Development koa	3	817	February 10, 2022

Open edX as an LTI provider with Canvas

Related topics