Openedx LTI

[fyrlandt]

Hi, we currently have a ficus deployment of openedx and tried using this tool.
We were able to deploy it on Azure and it seems like the ficus version of openedx is still using LTI 1.1 so we decided to use key and secret for LTI 1.1 as stated in the configuration guide.
However when we click the LTI link, we see this error below.

We are using the same account that deployed the tool to Azure. The account is also set as staff in our openedx deployment.
Any idea why this happens and how it could be fixed?

[nehalilani]

Hi @fyrlandt,

Thank you for trying the Learn LTI tool. Based on the above inputs, I believe the following might be of some help.

TroubleShooting

It looks like the GetUserDetails API is failing with a 500 internal server error in your case due to which you are facing the issue in opening the assignment page. I'd request you to please try troubleshooting shared in #71 .

Probable Hypothesis

In case of LTI1.1, in my experience, the error occurs due to the lack of custom_context_membership_url key being sent to Learn-LTI in the LTI-Launch request. This URL is being used by Learn-LTI service to get the details of all participants of the course in order to allow them access to the assignment. For Moodle, setting the LTI Names and Roles Provisioning to Use this service.... enables sending of the context-membership-url. Without this URL, Learn-LTI fails to validate the user as a course member and hence does not allow the user access to the assignment. Unfortunately, I am not sure how to turn ON this setting for OpenEdx, I can do some digging across the docs to see if I find something.

[fyrlandt]

HI @nehalilani,

I have a feeling that I am encountering the same issue as that.
I've been looking for a way to turn on the NPRS setting if there is such a thing in Openedx but I've yet to find it. All I was able to turn on was the sending of username and email and the accepting of grades from the tool.

[leestott]

@fyrlandt

Firstly apologies for the delay in responding, we have been approached by a number of OpenEdx users in relation to support for the Learn LTI application. So been investigating the error you are receiving.

OpenEdx seems to be missing the NRPS setting in the Admin panel due to which we are not receiving the ContextMemebershipUrl in the request params.

Since we do not receive these params, we are unable to get the members of the current course, thereby, failing to validate the enrollment of the current user.

NRPS is something that is a part of LTIAdvantage Spec and needs to be supported by the LMS in order to be able to enable it. Our dev teams have some some investigations to see whether OpenEdx currently supports it or plans to support it in future. Unfortunately this is a missing feature which OpenEdx needs to implement, there’s a group of people in the OpenEdx community who are working towards adding this support to OpenEdx, however, it is not yet functional.

The key issues your facing is the lack of this feature so until we are able to get these entries inside the Request Params, unfortunately, we’d not be able to get Learn-LTI working in OpenEdx.

I would suggest you reaching out to the OpenEdx community in relation to support of this feature. Which Canvas, if Moodle and Blackboard LMS support.

References for LTIAdvantage in OpenEdx
• Is Anyone Working on LTI 1.3? - Development / Collaborative Proposals - Open edX discussions -https://discuss.openedx.org/t/is-anyone-working-on-lti-1-3/798/12
• [TNL-7314] [BD-24] LTI Advantage & other improvements - JIRA (atlassian.net) - https://id.atlassian.com/login?continue=https%3A%2F%2Fopenedx.atlassian.net%2Flogin%3FredirectCount%3D1%26dest-url%3D%252Fbrowse%252FTNL-7314%26application%3Djira&application=jira
• [BD-24] LTI v1.3 Improvements: Advantage Support - Open edX Community - Confluence - (atlassian.net) https://openedx.atlassian.net/wiki/spaces/COMM/pages/1545076784/BD-24+LTI+v1.3+Improvements+Advantage+Support

[leestott]

The OpenEdx Open Source team have been making a number of enhancement to LTI Support see https://github.com/edx/xblock-lti-consumer

[andy-thomas-83]

Hi,

Has anybody tried this with the latest release of the LTI connector on OpenEDX lilac?

It now supports 1.3 with NRPS (and Deep Linking), we have tried to configure it:

We put:

LTI 1.3 Tool Launch URL : Launch URL
LTI 1.3 OIDC URL : Login URL
LTI 1.3 Tool Public Key : Public Key

We have enabled LTI NRPS :

Kept the LTI Assignmend and Grade Service to the default setting:

Then configured the following options:

But when we try and launch it we get this:

The only error I can see in our OpenEDX logs is this:

lti_xblock.py:1149 - Error preparing LTI 1.3 launch for block

[louis-s-29]

Dear @andy-thomas-83 ,

Great to see your message posted to this thread! We, that is a student development team from University College London, are currently investigating the issue of integrating MS Learn content into Open edX. Unfortunately, it appears not to not be very trivial. Please find a response to your post, based on our understanding of how to set up the tool, as well as a short summary of what issues we are currently facing.

Looking forward to hearing from you!

Post response:

The parameters you state for “LTI 1.3 Tool Launch URL”, “LTI 1.3 OIDC URL” and ”LTI 1.3 Tool Public Key” need to be obtained from the LTI Registration Form (having provisioned the MS Learn Functions app) in MS Azure. These should all start with something like “https://connect...”. Based on the second image, we cannot determine whether these are ‘correctly’ filled out. All other such things appear to be in line with our understanding of how to fill out the LTI Connector. With this, we did manage to get the MS Learn LTI application and Open edX to communicate – despite facing another issue which makes it impossible for us to fully set up and interact with the LTI component.

However, one thing is surprising: In our Lilac (12.0.2) productive environment, as well as Openedx Master Branch Dev-Stack environment, we appear not to have the "Request User’s Username" and "Request User’s Email" parametres.

--> Could you please confirm the specific version/distribution of Open Edx lilac with which you are working?

Our situation:

Please find a summary and corresponding screenshots:

1. We have successfully created a LTI component in Open edX
2. The LTI component in Open edX communicates with the MS Learn Functions App in Azure, however, the Authentication is erroneous (“You are not enrolled in this course”), although the user accessing the content is listed in the Azure Active Directory that hosts the MS Learn Functions App.
3. The “Azure Function Traces” Log indicates that an error occurs after this: “Sending HTTP request GET https://www.ltiopenedx.com/api/lti_consumer/v1/lti/1/memberships

Have you, or anyone else following this thread, an idea as to the possible root cause/ fix for this?

Many thanks and all the best!

[andy-thomas-83]

Thanks for the reply, yes I have lifted the details out of the Azure deployment and they were the ones starting with “https://connect...”. I removed them from the screenshots as I didn't want to commit them into github.

I will go and look at our Azure function trace to see what I have. What does OpenEDX show in the window when you click "View resources in new window"?

The "Request User’s Username" and "Request User’s Email" parameters were configured for this course when we were testing a different LTI integration.

You can turn them on for a course by going into DJANGO admin, go to "XBlock Configuration" then "Course Edit lti fields enabled tags". You will want to "Add course edit lti fields enabled tag and paste the course ID, check enable. We didn't do this for LEARN though - this was for an LTI 1 configuration that we needed some additional information passed.

[andy-thomas-83]

I think we have gotten a bit further. We now get {"Message":"Could not validate request."}. The only error I can see is in the connect function log:

@louis-s-29 I think you might be a step ahead of us. What did you put in for the Issuer in the Platform Registration?

[louis-s-29]

@andy-thomas-83

Hi, we have just set this to "edx.org". Will look into this topic further tomorrow with the rest of the team and also get back to you regarding the previous comment.

Best wishes

[andy-thomas-83]

We have changed it to match the openEDX instance URL but still no change. We still get this error in the logs:

[leestott]

@andy-thomas-83 I spoke with @louis-s-29 today and they are going to document the installation process.

@louis-s-29 can you provide a ETA when you will have this ready?

[louis-s-29]

@andy-thomas-83 I spoke with @louis-s-29 today and they are going to document the installation process.

@louis-s-29 can you provide a ETA when you will have this ready?

@leestott @andy-thomas-83 - We are currently crafting a deployment/guidance document on integrating an MS Learn LTI component in an edC course. We are eager to make a first draft of this available by end of this week. As we are still facing issues with the integration of MS Learn content into edX ourselves, this document will, however, not be final.

I do hope that such a document can already help resolve the issue noted above.

Best wishes

[andy-thomas-83]

Awesome, if we can help at all please let us know.

[leestott]

Dear @andy-thomas-83

Can you test the following Deployment Guide which @louis-s-29 has developed

Deployment Guide

Note: The following online resources/ guides were used to deploy the Microsoft Learn LTI application and Open edX to Azure, respectively:
• https://github.com/microsoft/Learn-LTI/blob/main/docs/DEPLOYMENT_GUIDE.md#deploy-to-azure-subscription-using-the-script
• https://docs.tutor.overhang.io/quickstart.html

Configure the tool

The following guide shows the steps to configure the Open edX LMS to work with the Microsoft Learn LTI application. Regardless of the LMS, the typical workflow should remain the same:

1. Obtain parameters from the deployed Microsoft Learn LTI application’s registration page
2. Configure an LTI tool on the LMS using the parameters from step 1.
3. Obtain parameters from the configured LTI tool.
4. Configure the Microsoft Learn LTI application using the parameters from step 3.
   By now, you should've obtained the following parameters from the Microsoft Learn LTI application’s registration page. If not, follow the deployment guide to deploy Microsoft Learn LTI application and obtain the following parameters from the registration page.
   • Login URL
   • Launch URL
   • Domain URL
   • Public Key
   • Public JWK
   • Public JWK Set URL

If you are not the one who deployed the application, you need to obtain the parameters from that person.
The configuration steps slightly differ depending on the LMS you are using. In general, they will involve registering the Microsoft Learn LTI application as an external tool in the LMS and registering the parameters of external tool back in the Microsoft Learn LTI application's registration page.

Open edX LMS:

LTI 1.3
(https://edx.readthedocs.io/projects/edx-partner-course-staff/en/latest/exercises_tools/lti_component.html#setting-up-an-lti-1-3-component)

1. Sign into Open edX Studio (I.e., the Content Management System of Open edX) with the admin account.
2. Enable the LTI Consumer XBlock in Open edX Studio through the advanced settings based on the following steps:

1. From the main page of a specific course, navigate to Settings -> Advanced Settings from the top menu.
2. Check for the advanced_modules policy key and add "lti_consumer" to the policy value list, per the below figure.
   
3. Click the "Save changes" button.

3. Edit the unit in which you want to add the remote LTI tool and select Advanced from within the Add New Component section. Select LTI Consumer.
4. Select Edit inside the newly created component.
5. In the LTI Version field, select LTI 1.3.
6. Enter the LTI 1.3 settings provided in the Learn LTI Registration form. For basic LTI 1.3 tools, you need to set the following settings:
   • LTI 1.3 Tool Launch URL (can also be called redirect URL)
   • LTI 1.3 OIDC URL (can also be called login URL)
   • LTI 1.3 Tool Public Key (a key provided by the LTI tool) The key will look like this example:

-----BEGIN PUBLIC KEY-----abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345 abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345-----END PUBLIC KEY-----
You should paste the key from the tool directly into the configuration field. For more information about each setting, see the LTI Component Settings.
7. Enable LTI NRPS through setting it to True.

8. Select Save.
9. The Studio page will refresh, and display LTI configuration required by the tool. Copy each of those values and follow the instructions provided by the tool to set them up.
• Client -> Client ID
• Keyset URL -> JWK Set URL
• OAuth Token URL ->Access Token URL
• OIDC Callback URL -> Authorization URL

9. Publish the unit where the LTI Component is located.

You're all set. The Learn LTI tool is now configured on your Moodle LMS and your Educators will be able to use it to bring Microsoft Learn content to their courses. Follow the educator guide to create assignments that use the Learn LTI tool.

Note: This guidance document is in an early draft stage. Currently, technical issues exist which may make the integration of the MS Learn LTI application into Open edX technically impossible. A solution is already being worked on.

[xiaomo728]

Following up on the above thread with @leestott, @andy-thomas-83 and @louis-s-29:

Hello! I am part of the UCL student development team focused on enabling the integration of MS Learn content into Open edX.

Background

As described, we have encountered an error issue when trying to configure the Microsoft Learn LTI application in Open edX. Per the previous descriptions, the below issue appears when accessing the LTI (MS Learn) component in edX as an authorized and enrolled user.

In fact, this error message is also mentioned in the troubleshooting of Microsoft Learn LTI, but none of the solutions listed there solved the error:

• We ensure that MS Azure SSO for Open edX was enabled, and we were signed into Open edX with an AAD account.
• We ensure that the emails of the user in the Open edX and AAD match.
• We ensure that the user is active (enrolled) on the course.

After trying various methods to no avail, we tried began investigating the root cause by analyzing the source code of the Microsoft Learn LTI application.

Search Track

When this error occurs on the web browser, Learn LTI's Azure's activity log (Function traces) will record the error.

We found the applicable source code in the Learn LTI Application which prints this error.

(Location: Learn-LTI/backend/Functions/Edna.Users/Edna.Users/UsersApi.cs)

Here, the logger will log error info "User not enrolled" when the variable member is null. Meanwhile, the member is the return value of the GetByEmail() function, this function has 4 parameters: the ClientId, AccessTokenUrl, ContextMemberUrl and userEmails. In other words, the reason for this error is that the GetByEmail() method returned an empty member. In order to try to find out why this method returns a null value, we first modified the code so that logger prints out the contents of the four incoming parameters in the log, as shown below.

Also, we checked what was happening inside the GetByEmail() function.

(Location: Learn-LTI/backend/Bindings/Edna.Bindings.LtiAdvantage/Services/NrpsClient.cs)

The GetByEmail() function calls the Get() function by passing the ClientId, AccessTokenUrl, ContextMembershipUrl and gets the return value of it called allMembers, which is an enumerable list that includes all member instances. Then, the function will check if there is any email of a member in allMembers that matches the email in the userEmails. The function will return a list of members that match.

The Get() function sends an HTTP request to the NRPS Context Memberships Endpoint on Open edX, then Open edX will send back a respond that contains information (id, username, name, email, enrollment mode and role) of users enrolled in the given course. This respond is stored in a local variable, processed by the function and finally returned by the Get() function as a Task<IEnumerable> object (that is, the allMembers).

We have also modified the code inside these two functions to allow the logger to print out more important information such as the details of the ContextMembershipUrl, as shown below.

Findings

After modifying these, we reproduced the “user not enrolled” error once more and then checked the Azure logs. Using the logs, we found the following reason for this problem:

The list of allMembers enrolled in the edX course returned by the HTTP Request via the ContextMemberUrl in Get() function does list all enrolled members; however, the emails returned for each member are are null/empty. Therefore, the GetByEmail() method will not correctly match whether the email of the currently logged in user is in this course list and will return null, as shown below.

Tips: 1 - The LTI App correctly get the login email;
2 - The details of ClientId, AccessTokenUrl, ContextMembershipUrl and userEmails (user email is just the login email in step 1);
3 - The details of the HTTP request response of ContextMembershipUrl in Get() function;
4 - List all members that have been retrieved at step 3. No email addresses exist here.

Next Steps

Next, we will investigate the edX source code to understand why the ContextMembershipUrl returns no email addresses. Based thereon we plan to find a way to fix this bug, thereby enabling the integration of MS Learn LTI content into edX.

Please do not hesitate to reach out and comment in case of any questions or concerns. Similarly, please let us know if you have any ideas on how to approach the above-described issue.

Thank you very much.

Best wishes.

[thomas-skillup]

Hello,

My name is Thomas Schweich, and I am a software developer at @SkillUpTech.

Thanks so much to everyone for such detailed posts. We are also interested in integrating MSLearn with an OpenEdx deployment.

After an attempt at connecting using the preliminary guide mentioned by @leestott, we encountered the same issues as described by @andy-thomas-83. We have not yet been able to get to the point described by @xiaomo728 above, however. I think this is just an issue with our Azure SSO configuration, though, so I will update if/when we're able to move past this point. If we're able to do so, we would love to lend a hand in triaging the issue in the EdX Platform described by @xiaomo728 above.

I do have one question, though (apologies for being out of the loop here)--was anyone ever successful in linking MSLearn via LTI1.1/1.2, or has everyone focused their efforts on LTI 1.3 integration?

Thanks again.

[louis-s-29]

Hi @thomas-skillup - thank you for reaching out!

So far the focus was mostly on LTI 1.3. Reason for this is that Microsoft Learn requires to check the course enrolment of a given edX user. This is achieved based on requesting a full posting of all course enrollments (in particular enrolled users' email addresses), a functionality that edX started supporting with the introduction of LTI NRPS (Names and Roles Provisioning services).

Will check again, but so far we were unable to get it to work with LTI 1.1. Could you please send a screenshot/ extract of relevant error logs and messages you see when trying to connect MS Learn and edX?

[louis-s-29]

Hi @andy-thomas-83 and @leestott,

please find the following relevant configurations that are required to be made in the CMS Admin panel, in order to enable the transfer of PII (incl. email) between an edX LTI Xblock component and the MS Learn Functions App.

1. To enable exposing PII information, add a course waffle flag from http://EDX-LMS-URL/admin/waffle_utils/waffleflagcourseoverridemodel/.
2. Set waffle flag to - lti_consumer.lti_nrps_transmit_pii and set course key to your course key. : YOUR-COURSE-ID.
3. Make sure to set the override choice option to - Force On
4. For security reasons, edX only allows to transmit enrolment PII for courses with less than 1000 students per default. To change this set the LTI_NRPS_ACTIVE_ENROLLMENT_LIMIT Django setting to a lower/higher value.

--> adapted from - openedx/xblock-lti-consumer#124

I hope this helps. Please do let me know if this allowed you to proceed with setting up the MS Learn LTI component in edX.

Best,
Louis

[thomas-skillup]

Hi @louis-s-29, thanks so much for the response. I have added information about our current progress below.

Currently I am not able to find any errors in the Connect function logs. Please see the output below:

2021-08-02T16:45:54  Welcome, you are now connected to log-streaming service. The default timeout is 2 hours. Change the timeout with the App Setting SCM_LOGSTREAM_TIMEOUT (in seconds).
2021-08-02T16:46:05.710 [Information] Start processing HTTP request GET https://platforms-xxxxxxxxx.azurewebsites.net/api/platforms/ff6f769a
2021-08-02T16:46:05.710 [Information] Sending HTTP request GET https://platforms-xxxxxxxxx.azurewebsites.net/api/platforms/ff6f769a
2021-08-02T16:46:06.326 [Information] Received HTTP response after 615.9786ms - OK
2021-08-02T16:46:06.326 [Information] End processing HTTP request after 616.5157ms - OK
2021-08-02T16:46:06.327 [Information] Executing 'OidcLogin' (Reason='This function was programmatically called via the host APIs.', Id=c13a1b12-9fed-4726-8560-a6e112431d62)
2021-08-02T16:46:06.328 [Information] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: Function 'SaveState (Orchestrator)' scheduled. Reason: NewInstance. IsReplay: False. State: Scheduled. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 62.
2021-08-02T16:46:06.384 [Information] Executing 'SaveState' (Reason='(null)', Id=a4b2824b-c212-45a8-9a1e-7034bb0a846b)
2021-08-02T16:46:06.384 [Information] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: Function 'SaveState (Orchestrator)' started. IsReplay: False. Input: (380 bytes). State: Started. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 63.
2021-08-02T16:46:06.385 [Information] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: Function 'SaveState (Orchestrator)' is waiting for input. Reason: WaitForEntityResponse:79f7a1a7-c7dc-5bd3-a765-e15bea5221ca. IsReplay: False. State: Listening. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 64.
2021-08-02T16:46:06.385 [Information] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: Function 'nonce (Entity)' scheduled. Reason: SaveState. IsReplay: False. State: Scheduled. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 65.
2021-08-02T16:46:06.385 [Information] Executed 'SaveState' (Succeeded, Id=a4b2824b-c212-45a8-9a1e-7034bb0a846b, Duration=1ms)
2021-08-02T16:46:06.386 [Information] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: Function 'SaveState (Orchestrator)' awaited. IsReplay: False. State: Awaited. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 66.
2021-08-02T16:46:06.412 [Information] Executing 'Nonce' (Reason='(null)', Id=4044580c-3b1b-42a6-ab0c-1084e747b463)
2021-08-02T16:46:06.413 [Information] @nonce@xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx: Function 'nonce (Entity)' completed 'SetState' operation 79f7a1a7-c7dc-5bd3-a765-e15bea5221ca in 0.4054ms. IsReplay: False. Input: (null). Output: (null). HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 67.
2021-08-02T16:46:06.413 [Information] @nonce@xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx: Function 'nonce (Entity)' started. IsReplay: False. Input: (null). State: Started. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 68.
2021-08-02T16:46:06.413 [Information] @nonce@xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx: Function 'nonce (Entity)' completed. ContinuedAsNew: True. IsReplay: False. Output: (192 bytes). State: Completed. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 69.
2021-08-02T16:46:06.413 [Information] Executed 'Nonce' (Succeeded, Id=4044580c-3b1b-42a6-ab0c-1084e747b463, Duration=1ms)
2021-08-02T16:46:06.420 [Information] Executing 'Nonce' (Reason='(null)', Id=e2ef7817-5e26-4b70-922b-c444bb1fde25)
2021-08-02T16:46:06.420 [Information] Executed 'Nonce' (Succeeded, Id=e2ef7817-5e26-4b70-922b-c444bb1fde25, Duration=0ms)
2021-08-02T16:46:06.453 [Information] Executing 'SaveState' (Reason='(null)', Id=99f57861-f18f-4a9d-8acd-1447ccb8b584)
2021-08-02T16:46:06.454 [Information] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: Function 'SaveState (Orchestrator)' received an entity response. OperationId: 79f7a1a7-c7dc-5bd3-a765-e15bea5221ca. State: ExternalEventRaised. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 70.
2021-08-02T16:46:06.454 [Information] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: Function 'SaveState (Orchestrator)' completed. ContinuedAsNew: False. IsReplay: False. Output: (null). State: Completed. HubName: connectxxxxxxxxx. AppName: connect-xxxxxxxxx. SlotName: Production. ExtensionVersion: 2.2.2. SequenceNumber: 71.
2021-08-02T16:46:06.454 [Information] Executed 'SaveState' (Succeeded, Id=99f57861-f18f-4a9d-8acd-1447ccb8b584, Duration=1ms)
2021-08-02T16:46:07.376 [Information] Executed 'OidcLogin' (Succeeded, Id=c13a1b12-9fed-4726-8560-a6e112431d62, Duration=1666ms)

EDIT: Upon further investigation, I was able to find the following in the "Invocation Details" of the Launch function in the Azure portal:

In the OpenEdx LMS logs, I have the following warning:

2021-08-02 16:46:07,571 WARNING 8 [lti_consumer.lti_xblock] [user 4] [ip 98.203.254.130] lti_xblock.py:1149 - Error preparing LTI 1.3 launch for block 'block-v1:SpinupX+LTI201+2021_Q3+type@lti_consumer+block@xxxxxxxxxxxxxxxxxxxxxxxxx:
lms_1            | [pid: 8|app: 0|req: 75/232] 172.18.0.5 () {72 vars in 4527 bytes} [Mon Aug  2 16:46:07 2021] GET /api/lti_consumer/v1/launch/?response_type=id_token&response_mode=form_post&redirect_uri=https%3a%2f%xxxxxxxxxxxxxxxxxxxx%2fapi%2flti_consumer%2fv1%2flaunch%2f&scope=openid&login_hint=block-v1%3aSpinupX%2bLTI201%2b2021_Q3%2btype%40lti_consumer%2bblock%402f773ed81b854d268fda4c5b097e8c93&prompt=none&lti_message_hint=&client_id=mslearnlti&nonce=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&state=ca7898e8-e332-4266-8b74-8fb0d8da33c6 => generated 433 bytes in 132 msecs (HTTP/1.0 400) 5 headers in 303 bytes (1 switches on core 0)

Upon accessing the LTI module as an enrolled learner, I receive the following message:

{% load i18n %}
{% trans "There was an error while launching the LTI 1.3 tool." %}
{% trans "If you're seeing this on a live course, please contact the course staff." %}

Is this enough to give an idea of the issue? Thanks again.

EDIT 2: I have made some progress, and am now up to the point where I have the {"Message":"Could not validate request."} issue. Here are the relevant logs from the LTIAdvantageLaunch function:

Could not validate request. Microsoft.IdentityModel.Tokens.SecurityTokenInvalidIssuerException: IDX10205: Issuer validation failed. Issuer: 'System.String'. Did not match: validationParameters.ValidIssuer: 'System.String' or validationParameters.ValidIssuers: 'System.String'. at Microsoft.IdentityModel.Tokens.Validators.ValidateIssuer(String issuer, SecurityToken securityToken, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateIssuer(String issuer, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateTokenPayload(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken) at Edna.Bindings.LtiAdvantage.Utils.LtiAdvantageExtensions.GetValidatedLtiLaunchClaims(HttpRequest request, String jwkSetUrl, String clientId, String issuer) in C:\Users\XXXXXX\Documents\lti_repo\lti\Learn-LTI\backend\Bindings\Edna.Bindings.LtiAdvantage\Utils\LtiAdvantageExtensions.cs:line 45 at Edna.Bindings.LtiAdvantage.Services.LtiResourceLinkRequestClient.GetLtiResourceLinkRequest(String jwkSetUrl, String clientId, String issuer) in C:\Users\XXXXXX\Documents\lti_repo\lti\Learn-LTI\backend\Bindings\Edna.Bindings.LtiAdvantage\Services\LtiResourceLinkRequestClient.cs:line 25 at Edna.Connect.LtiAdvantageApi.LtiAdvantageLaunch(HttpRequest req, ILtiResourceLinkRequestClient ltiRequestClient, INrpsClient nrpsClient, Platform platform, IAsyncCollector`1 assignmentsCollector, IDurableEntityClient entityClient, String platformId) in C:\Users\XXXXXXX\Documents\lti_repo\lti\Learn-LTI\backend\Functions\Edna.Connect\LtiAdvantageApi.cs:line 86

[xiaomo728]

Hi @andy-thomas-83 and @leestott,

Here are some updates after editing the configurations about CMS Admin panel that provided by @louis-s-29 above.

After we editing these configurations and enable the PII function, our MS Learn LTI application integrated in Open edX no longer has the issue of "user not enrolled". Not only is the issue not reported in the web browser, but also the issue is no longer logged in the activity log of the monitor in Getuserdetails on the Azure server (the following figure is the screenshot of the log). In other words, the ContextMembershipUrl has successfully fetched the user's email address from Open edX, the currently logged-in user has been successfully authenticated and the "user not enrolled" issue has been solved successfully.

But we have also encountered a new problem. Although the user has been identified as enrolled, the browser is unable to display the MS Learn courses that should appear. The browser web-page stays at the "loading assignment", as shown below.

On this page, there are one 404 error when opening the inspector in the browser, as shown below.

Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)

We are currently investigating the cause of this error and we have looked into the activity logs of the application on the Azure server and have not found any obvious error messages in the logs at this time. However, we initially suspect that this is an issue on the part of Open edX. One important thing is that we think this 404 issue must not be caused by the PII configuration we edited - our group had encountered this 404 issue before with "user not enrolled" issue, but this issue was thought to be caused by "user not enrolled" and was not taken seriously.

These are the progress we have made so far, thank you very much.

[xiaomo728]

Hi @thomas-skillup,

Thank you so much for your response! Wish you all the best for your deployment and integration on the MS Learn LTI and Open edX. Our team will continue to update this Issue page with our solutions and look forward to your help in resolving some of the blocks we have encountered. Thank you very much.

[leestott]

@xiaomo728 @louis-s-29 have a look at #134 (comment)

[thomas-skillup]

Hello again, I am wondering if @andy-thomas-83 was able to resolve the "Issuer validation failed" problem--as of now, this is also where we're stuck. I pasted the complete error log in an edit at the end of my last post.

Our app does use HTTPS with a valid certificate, and the users we have tried connecting with are enrolled and do use their AD accounts. Despite this, we are still seeing the issuer validation error.

We have also made the changes in the Django Admin page for the CMS mentioned by @louis-s-29 which enable PII transfer, however I think this solves a problem which we have not yet encountered--this change did not have any effect for us. This is probably because there is still a failure in the connection itself, so our deployment never even manages to progress to running the "users-" functions.

I am wondering what we are still missing in our configuration. It seems that @xiaomo728 is well past this error, and I can't tell if @andy-thomas-83 was ever able to resolve this. Does anyone have any insight into what might be causing this issue? Thanks.

[louis-s-29]

Hi @thomas-skillup - based on your description that the Launch itself is failing prior to the users function being executed, the most likely explanation appears to be that the MS Learn LTI App is configured incorrectly, or the LTI component inside edX.

For the issuer field in the MS Learn LTI App, we have entered https://domain-of-your-edx.com [no trailing "/"]. The other fields, such as 'JWK Set URL' or 'Access Token' can be retrieved from within the edX LTI component. Please double check with this comment: #103 (comment) - it also includes a mapping of fields in edX to those in the MS Learn LTI App and vice versa.

If this issue persists, feel free to add a screenshot of the MS Learn LTI App to this thread (without any confidential data shown).

Best,
Louis

[leestott]

@louis-s-29
@xiaomo728
@andy-thomas-83
@thomas-skillup

new PR was merged today
this.errorContent = { errorMsg: 'Please add a name for the user.', icon: 'BlockContact' };

Based on OpenEdx, we are missing the name for the student which is a requirement inside the client code. Since student don't have a name in the implementation, we end up not moving forward to the next step. Unfortunately, the error handling does not take care of this appropriately.

We have added a new catcher for this inside Learn-LTI

Add an error string when user is missing a name, prevents infinite spinner by adbindal · Pull Request #151 · microsoft/Learn-LTI (github.com).

[thomas-skillup]

@louis-s-29 Thank you so much! The problem was, in fact, the format of the issuer URL (the correct format was, as you said, https://our.lms.domain with no trailing /). We are now able to progress to the permanently spinning page (I have not yet upgraded to the version with new error handling logic mentioned by @leestott above--that will be our next change).

Hopefully we can find a way to include users' names in the LTI requests and solve this once and for all! Thanks again.

[thomas-skillup]

@louis-s-29
@xiaomo728
@andy-thomas-83
@leestott

I believe I have determined how we can include users' names in the LTI requests to solve this issue. By default, the LTI Consumer XBlock does not support the inclusion of user information such as names (even with the lti_consumer.lti_nrps_transmit_pii feature flag enabled). See here for further information on that.

However, the LTI Consumer XBlock (should) support additional parameter processors (in the form of Python functions) so that this behavior can be customized. As it turns out, the devs at @appsembler have created a parameter processor library, Tahoe LTI, for exactly this purpose.

So, I went ahead and added the Tahoe LTI extensions and rebuilt my edxapp images (I'm testing this on a fresh Tutor deployment of OpenEdx Lilac). Ideally, this process should be automated through a Tutor plugin (this has already been discussed here on the Tutor forums--and this forum post also describes the final road-block we face which I will discuss at the end of this comment).

But as I was merely trying to determine whether or not the plugin works, I went ahead and added the settings manually for now using the following procedure (from the machine running the local Tutor deployment):

Add the Tahoe LTI dependency

echo "git+https://github.com/appsembler/tahoe-lti.git" >> "$(tutor config printroot)/env/build/openedx/requirements/private.txt"

Rebuild the OpenEdx images

tutor images build openedx
tutor local stop
tutor local start --detach

Configure the new parameter processors**

Open $(tutor config printroot)/env/apps/openedx/config/lms.env.json in your editor of choice, and add an "lti_consumer" key to the XBLOCK_SETTINGS object (creating it if it doesn't yet exist):

  "XBLOCK_SETTINGS": {
    "lti_consumer": {
      "parameter_processors": [
        "tahoe_lti.processors:basic_user_info",
        "tahoe_lti.processors:personal_user_info"
      ]
    }
  }

You may also need to add this in cms.env.json which is in the same directory--I'm not yet sure if this is necessary.

Restart the containers to apply the settings changes

tutor local reboot --detach

The new problem

After making these changes, you will probably see no change (at least if you are following these steps near the time of writing) to the issue. That is because the LTI Consumer XBlock never actually calls the custom parameter processors! This is a known issue and is being fixed in this PR.

So, my plan from here is to try manually including the PR in my dev instance. This will then allow the Tahoe LTI parameter processors to function, which in turn should provide enough information to satisfy MSLearn. I will update when I am able to do so.

Hope this helps!

** Important note: manually editing the environment this way in a Tutor deployment is not supported. The correct way to do this is using a Tutor plugin. As a result, if you run tutor local quickstart or tutor config save on this deployment, any settings you manually entered will be overwritten. So, I will try to follow up with a Tutor plugin as well once I'm sure everything is working.

[giovannicimolin]

Hey everyone!
I've implemented a good portion of LTI 1.3 in the Open edX platform and can help you figure out issues and fix bugs in the Open edX side.

In the LTI-NRPS implementation, PII sharing will add two fields to the NRPS response (name and email - code is here).
To enable PII on NRPS, you need to enable CourseAllowPIISharingInLTIFlag (note that it's not a CourseWaffleFlag, but a ConfigurationModel (this only applies for the Maple release - the lilac version still uses the lti_consumer.lti_nrps_transmit_pii CourseWaffleFlag).

[xiaomo728]

Hi @thomas-skillup,

Thank you very much for your solution! It is quite useful and meaningful. And also, lucky, the Pull Request that you mentioned (openedx/xblock-lti-consumer#150) has been finished and merged to XBlock's master 1 hour ago, i.e. we can try to use this method now and to see if it works or not.

We are now building the edX Docker image by following your instructions. If there is any update, we will post here.

[louis-s-29]

Hi all - @thomas-skillup @giovannicimolin @leestott @andy-thomas-83 ,
Thank you so much for all the support so far! I wanted to share an update with you, which should enable the integration of MS Learn content into Open edX Lilac.

As pointed out above, the final issue that was encountered was the username (Given Name, Last Name) not being sent from edX to MS Learn LTI application. As a workaround solution for this, we propose for individuals facing this issue who have deployed edx lilac.1/2 to do the following: Create a fork of the official MS Learn LTI (https://github.com/microsoft/Learn-LTI/ ) and make the changes displayed in the screenshot:

This will "force the username" to be equal to the user's email address (excluding everything after the "@" symbol in the email address). You should then build the adapted/ forked repository and deploy it to Azure functions per the official guide (https://github.com/microsoft/Learn-LTI/blob/main/docs/DEPLOYMENT_GUIDE.md)

In the medium-term this workaround should no longer be required due to the following:
One plugin/ solution for the above problem is the tahoe_lti component by appsembler, however, for this to work an adaptation in the https://github.com/edx/xblock-lti-consumer needs to be made. With this PR (openedx/xblock-lti-consumer#150) recently being approved and released in most recent xblock_lti_consumer release 3.0.3, the next edx-platform release which leverages this version, should fully support the tahoe-lti consumer. Note: edx-platform version 'lilac.2' just got released, however, it still references the xblock-lti-consumer in version 2.9.1. With the next named lilac release, or the next edx-version ('Maple') - which ever first references the lti-xblock-consumer 3.0.3 inside the base.txt / base.in requirements file - this issue should be resolved.

We are currently validating the latter point and will post our findings to this thread alongside some finalised deployment guidance. Up until then, we hope the above workaround helps and would be very grateful for thoughts/feedback on this.

All the best,

Louis, @xiaomo728 @YankeZhang @xinyuanZhuang

[YankeZhang]

Hi, everyone! @leestott @giovannicimolin @andy-thomas-83 @thomas-skillup

I'm a member of the same team with @louis-s-29 and @xiaomo728. We just tested the latest version of xblock-lti-consumer(the version that has merged this PR). But unfortunately, it seems tahoe-lti only supports sending extra parameters for Lti 1.1. So our team needs to find another way to make it work.

We tried to modify the code in the NRPS Context Membership Service endpoint on a forked version of xblock-lti-consumer. The idea of the code is to add given_name and family_name for every user in data(a dictionary returned by compat.get_course_members(course_key)). We have tried these several lines of code on our local IDE, and they have no error.

However, when we tried to connect to MS Learn Lti provider, we received a 500 server error and we are not sure what went wrong. @giovannicimolin Do you see any problem if we manually add the given_name and family_name here?

We are also going to check out the integration between MS Learn Lti and Open edX with Lti 1.1 using the latest version of xblock-lti-consumer and tahoe-lti. We will keep on updating our findings here as long as we make any progress. Thank you very much!

[giovannicimolin]

@louis-s-29 @xiaomo728 I think I see the issue now: Learn-LTI is expecting given_name and family_name while the xblock-lti-consumer only sends the full name through the name attribute.

Do you see any problem if we manually add the given_name and family_name here?

My main issue with splitting the name is that it might cause incorrect name/family name splits to happen. Open edX stores it as a single full name field IIRC.

Aside from modifying that code, you'll also need to change the serializer to support these new attributes on your fork. Can you post an error log for the 500 errors you're facing?

---

As a side note, let me quote the IMS spec regarding parameters in the LTI NRPS response:

The Platform may delegate that consent to the actual member, therefore a Tool should never rely on additional member attributes to be present.

I've implemented the current information based on the assumption that tools wouldn't break with missing attributes (as the spec mentions).

[YankeZhang]

Hi @giovannicimolin Thank you for your quick reply!

Aside from modifying that code, you'll also need to change the serializer to support these new attributes on your fork.

Yes, we actually updated the LtiNrpsContextMemberPIISerializer in serializer.py. We also set the Waffle flag course overrides and Course edit lti fields enabled flags when we testing the Lti integration. But it didn't work. We haven't used the serializer class before, so we are not sure if the code in the screenshot is valid.

For the error log, we tried to get the log by using tutor local logs, but we found a lot of errors displayed in the terminal. Is this the correct place to see the error logs? If not, would you like to tell us where should we find the related logs? Thank you very much!

[YankeZhang]

Hi! @giovannicimolin. We tried to extract the log from Tutor by using tutor local logs --tail=0 -f. Since the log file is quite long, so I uploaded that to google drive, you can have a look at this link.

The messages in the file are logged after we click the view resource in a new window here. We also noticed that the RuntimeError: Context is already bound to a template error is repeating endlessly, so we manually abort the log. Also, I think the IndexError: list index out of range is caused by the split method since some of the names may not contain any space.

@leestott @giovannicimolin @andy-thomas-83 @thomas-skillup
A quick update, we just fixed the index error by modifying the view.py file. And it actually works!

We will continue to work on the parsing of different styles of names.

[xiaomo728]

Hi @leestott @giovannicimolin @andy-thomas-83 @thomas-skillup,

Here is the latest progress from our team (@xiaomo728 @louis-s-29 @YankeZhang).

About Learn LTI 1.3 Integration - Successful

We have edited the xblock-lti-consumer's code by forking the original repository, and successfully deployed it on our forked edx platform (many thanks to the useful help from @giovannicimolin): as @YankeZhang mentioned earlier, we have modified parts of view.py and serializer.py to ensure that Open edX sends the given names and family names to users when they log in to the integrated LTI Application using their account.

The following are the code segments we have added in the xblock-lti-consumer, you can check more details from this link:

serializer.py

view.py

Here, we deal with the problem of edx recognising the full name of users. Since the Open edX only asks for the full name of the user during registration, we can only retrieve (or guess) the given and family name from this information by splitting the first comma or space in the full name.

We would have liked to get the user's given and family name in a perfect correct way, but to do this we need to modify the logic in edX itself in registration (i.e., asking for the given name and family name instead of full name). However, to do so it would have been beyond the scope of our works on xblock-lti-consumer.

After our simple tests, there are no problems so far, user can access to the integrated Learn LTI (version 1.3) webpage successfully in the Open edX website.

About Learn LTI 1.1 Integration - Failed

We also tried to use Tahoe LTI to integrate LTI 1.1 in Open edX. However, it doesn't work at all. As we couldn't find a tutorial on how to configure LTI 1.1 for edX, we made this attempt by referring to how Moodle configure LTI 1.1.

We set the LTI Passports as "LTI_id:LearnLTI:LearnLTI" with lti-consumer and fill the correct domain URL when configuring, but it returned the 500 error in the LTI webpage, as shown below.

We have also checked the logs on Azure Function App, and found out the error here:

Object reference not set to an instance of an object.

We don't know the exact cause of the error yet.

We will continue to keep on updating our findings here as long as we make any progress. Thank you very much!

[giovannicimolin]

@xiaomo728 Kudos for the work and persistence in getting this working!

There are two possible approaches in getting this fixed for good now:

1. Improve LearnLTI to accept full_name if the separated name isn't available (or maybe not require it, and only use email)
2. Modify xblock-lti-consumer to "guess" and send first and family names (not ideal, but will enable out-of-the-box support for LearnLTI and possibly other tools).

There is an big implication in using the full_name to create a user account though: a user can change his full name in the Open edX platform at any time, possibly breaking the LearnLTI integration and losing submitted data.

Can someone with more context on the LearnLTI codebase explain where and why given and family names are being used and if it's possible to make them optional (or at least non-breaking)?

[xiaomo728]

Thank you very much @giovannicimolin 😄 and here are some contents that I can answer for your questions.

1. About addressing the given_name and family_name issues in Learn LTI.
Our team have contacted the relevant developers at Microsoft when we discovered this issue between edX and Learn LTI, and Microsoft has made some updates on it. For now, Learn LTI requires to given and family name to display user information on the webpage. Therefore, the way they have handled this is that when detecting that the user data does not contain the given_name and family_name, Learn LTI will throw an error to warn:

As @leestott said earlier in this post:

new PR was merged today
this.errorContent = { errorMsg: 'Please add a name for the user.', icon: 'BlockContact' };

Based on OpenEdx, we are missing the name for the student which is a requirement inside the client code. Since student don't have a name in the implementation, we end up not moving forward to the next step. Unfortunately, the error handling does not take care of this appropriately.

We have added a new catcher for this inside Learn-LTI

as well as shown in this commit in Learn LTI: 9ea8fc9.

Our team also tried to modify the source code of Learn LTI to solve this problem by cutting all the characters before the "@" character in the email address as the first name of the user after we had obtained the user's email.

2. About modifying xblock-lti-consumer to "guess" and send given_name and family_name
We think we have achieved this for now. As I said in my previous post, we have added some code to the view.py file of xblock-lti-consumer that it now can "guess" and fill in the given_name and family_name of the user by splitting the comma (",") or space (" ") in the user's full_name. We don't need to split the full name necessarily if there has no comma or space in the full name because Learn LTI only needs given name and can have family name blank ("").

File path for the changed view.py is here.

Although, as you said, this approach is not perfect, it does solve current problem. Do you think this approach is appropriate/feasible for now?

[thomas-skillup]

Hello again everyone,

I was able to whip up a possible alternate implementation of the changes to the XBlockLTIConsumer described by @xiaomo728 above (which is excellent and has been immensely helpful) that attempts to mitigate some of the potential issues with name uniqueness, and also allows the feature to be toggled per-course.

For generating a given_name and family_name parameter, I went with the approach @louis-s-29 mentioned which uses the email address split at the '@' character to generate the given_name (but from the EdX side this time), and have set the family_name to a constant.

To get around having to modify the view to manually iterate over and modify parameters per-user, I chose to subclass LtiNrpsContextMemberPIISerializer. The subclass, LtiNrpsContextMemberExtendedPIISerializer (try saying that five times fast), uses SerializerMethodFields to dynamically create the parameters when rendered.

From there, all that was needed was to modify the get_serializer_class function in lti_consumer.plugin.views to choose the new serializer when appropriate. For this, I created an optional Django setting, LTI_EXTENDED_PII_COURSES, which can be set to a list of regular expressions (and hence can also be set to a simple list of strings) which, when matched to a course's name, cause the additional parameters to be populated.

So if you want to enable this feature for a course named my_course, you can update your lms.env.json to include:

"LTI_EXTENDED_PII_COURSES": ["my_course"]

Or if you want it enabled for all courses:

"LTI_EXTENDED_PII_COURSES": [".*"]

The implementation can be found at https://github.com/SkillUpTech/xblock-lti-consumer/tree/inferred_unique_name.

I have written some basic tests against the view which succeed (I have not yet finished any for the model), but I am currently unable to actually test the implementation on a deployment. This is because I attempted to redeploy my MSLearn application in Azure to reflect the latest changes, but have been encountering some problems with deploying the back-end.

As this is still essentially a stop-gap solution, I'm not sure if it could be made viable as a contribution to the XBlockLTIConsumer project (perhaps @giovannicimolin would have some insight there), but it would (hopefully) work as a fairly solid hold-over solution for deployments which are eager to implement the feature now.

If anyone would like to test out the implementation, that would be great! Please create an update here if you do. Hopefully I can test it out soon--I just need to figure out where I'm going wrong with the MSLearn redeployment first (I'm getting a name collision in the Azure KeyVault when I deploy with the .bat shim, but when I try to manually deploy with a custom resource group and application name, I run into an issue with my .NET SDK installation).

Thanks.

cc: @leestott, @YankeZhang, and @andy-thomas-83

[louis-s-29]

Hi @thomas-skillup,

This solution is very promising. I am interested to see if, in some form, this will be reflected in upcoming iterations of the Xblock-Lti-Consumer. Thinking more long term, it may also be feasible for edX to capture users' first/ last names at sign-up, such that these parameters can be 'properly' obtained and sent to LTI providers who request them.

For the time being, we have agreed on the following solution with @leestott:
-> MS Learn LTI will be adapted such that it re-uses the user's email address for the UI/UX customisation, in case the first/ last name params are not available. We have made sure that this works across LMS'. Of course, this work-around is not perfect, but it means that edX users can integrate and launch MS Learn without having to modify the edX source code.

We will update this issue thread once the PR has been made and been approved/ merged to Master.

All the best and many thanks,

Louis

[leestott]

Openedx test build now available see #158 please validate this works from the repo on the PR https://github.com/edX-MSLearn-LTI-Integration/Learn-LTI/tree/email-name-test

Please make comment back to the Pull Request on any issues.

Key requirements is that OpenEdx Lilac is required.

[leestott]

OpenEdx Lilac support now added