nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to obtain an access token for accessing LTI Advantage Services?

Steve.H.432

I am receiving the following error:

{"error":"invalid_client","error_description":"Missing client"}

My curl headers are set:

--request POST

--header "Authorization: Basic B64 Encoded clientID:client secret (this is missing!)"

--header "Content-Type: application/x-www-form-urlencoded"

My URL is set:

https://auth.brightspace.com/core/connect/token?grant_type=client_credentials&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&scope=https://purl.imsglobal.org/spec/lti-ags/scope/score https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly https://purl.imsglobal.org/spec/lti-ags/scope/lineitem&client_assertion=JWTGOESHERE&redirect_uri=https://testing.com

When registering an LTI Advantage Tool, I cannot find the client secret. It only provides the following registration details:

Client Id
Brightspace Keyset URL
Brightspace OAuth2 Access Token URL
OpenId Connect Authentication Endpoint
Brightspace OAuth2 Audience
Issuer

Find more posts tagged with

LTI Advantage (1.3)

Accepted answers

All comments

Jordan.Snider3520

Hey Steve,

Thanks for raising this challenge up to our dev community. This was something I circulated internally before wanting to write a reply. What I think may be happening is malformed data being passed to the auth endpoint when requesting your token.

When you register your learning tool, you see all the value you had included in your original post:

Client Id
Brightspace Keyset URL
Brightspace OAuth2 Access Token URL
OpenId Connect Authentication Endpoint
Brightspace OAuth2 Audience
Issuer

And with some of those values you formulate your request. The IMS specification calls out this part of their documentation to define what you need to send: https://www.imsglobal.org/spec/security/v1p0#using-json-web-tokens-with-oauth-2-0-client-credentials-grant. The structure of what you need to send is a request with the following details:

{

"iss" : "",

"sub" : "",

"aud" : "",

"iat" : "",

"exp" : "",

"jti" : ""

}

We believe your error is a result of the values you are passing in the iss and sub fields. Both the iss and sub must equal the value of client_id from the platform. You receive that from the UI of your tool's registration.

For aud, this is also provided by the platform at tool registration. This value must be set to https://api.brightspace.com/auth/token. Please note that while we set that URL for the aud value, you are still sending the auth request as a whole to https://auth.brightspace.com/core/connect/token.

ian = your timestamp for the JWT

exp = the timestamp for JWT expiration

jti = a unique identifier

Try replacing some of the values coming over in your request and let me know if that does the trick for you!

Steve.H.432

Hi Jordan,

Thanks for the quick response. That got me through the "Missing client!" error.

Now I am running into a new error:

{"error":"invalid_grant","error_description":"Client is not authorized to set a 'kid' claim"}

If I remove the kid claim from the signed jwt, I get the following error:

{"error":"invalid_grant","error_description":"Error validating assertion: KeyId not found in token"}

We need the kid because we cycle our jwks monthly.

Jordan.Snider3520

Hey Steve,

Hmmm tricky. Have you tried running and comparing your requests to the IMS Reference Implementation, or the 1.3 Tsugi test tool? With those working test tools perhaps it will be easier to get your requests working when compared directly to those.

Tsugi is available --> https://github.com/tsugiproject/tsugi

IMS Reference Implementation --> https://lti-ri.imsglobal.org

For this specifically, can you send us over the full payload, header and request you are sending with this new error?

Steve.H.432

Headers

--header "Content-Type: application/x-www-form-urlencoded"

Request

--request POST

https://auth.brightspace.com/core/connect/token

Payload

'grant_type' => 'client_credentials',

'client_assertion_type' => 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',

'scope' => 'https://purl.imsglobal.org/spec/lti-ags/scope/score https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly https://purl.imsglobal.org/spec/lti-ags/scope/lineitem',

'client_assertion' => ''SIGNED JWT IS USED HERE,

'redirect_uri' => 'OUR DOMAIN IS USED HERE',

Jordan.Snider3520

Can you send me your JWT, directly if necessary? We need to see the contents of your payload as I believe it’s something in there that is causing the errors. Thank you!

Steve.H.432

https://jwt.io/#debugger-io?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImp0aSI6ImMxN2FjOWI3ZTc2MjQ5MmU2M2U5NmQ5YmE1YWU5OWRhIiwia2lkIjoiMGE4YTZlNDNiMTJmZWM3YmQ1YTllYjg0OTg5Mjc4ZGIifQ.eyJpc3MiOiJhYTQzNTAxNi0wMDlhLTRjZWItYTg5ZC0wNzMxNDg5ODE0NWUiLCJhdWQiOiJodHRwczpcL1wvYXBpLmJyaWdodHNwYWNlLmNvbVwvYXV0aFwvdG9rZW4iLCJqdGkiOiJjMTdhYzliN2U3NjI0OTJlNjNlOTZkOWJhNWFlOTlkYSIsImtpZCI6IjBhOGE2ZTQzYjEyZmVjN2JkNWE5ZWI4NDk4OTI3OGRiIiwiaWF0IjoxNTcwMjA3NDA0LCJzdWIiOiJhYTQzNTAxNi0wMDlhLTRjZWItYTg5ZC0wNzMxNDg5ODE0NWUiLCJuYmYiOjE1NzAyMDc0MDQsImV4cCI6MTU3MDIxMTAwNH0.NClRMaCiUpY273wZpU8X9pqQGXKDxpSp1euQ1ame4a9y9N7YWT6HSPsQjiS4ljrDxffA8_CTMxrfQQkKf-sN4B6Dsa0aGPq6ekCLLX-Z9Y6F5HV0jp9lEyd25vJmEj-8LNtnRv4y2H_LRDT2iRADMYFuYCRVbT-SMI8Tq6MvVR1sqqww9KAncTP3U1MXXLWImzqSKIcx7VVHYuee0oSHUg0dKgsxu_YMPL-sXZPs2RJtCy6CcXOEscWH0m73AQnjVjIvQtcqfOYW9YQCrKid_Hiz1lzECZNXPYUVEXHMOYsLCksUErM1slYbVgCBLxgSkLnMTfz7UmZuELtgffdsWg

Jordan.Snider3520

Hey Steve,

I tried comparing your request against the reference implementation that I linked in an earlier comment. I am first off noting some differences in the header and payload data which may be causing the issue. I think the biggest being that kid is defined in the header only, and not in the payload data. I am also seeing the kid visually looks like it's in a different format. What value are you using for your kid? JWKs is a good thing, as we do use those as well.

Here is the working request from the reference implementation: https://jwt.io/#debugger-io?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjA5MDY0NmE5LWYxMjItNDdjNy05YzU5LThmZGU0Mjg1NjQ0OCJ9.eyJpc3MiOiJodHRwczovL3BhcnRuZXJzLmJyaWdodHNwYWNlLmNvbSIsImF1ZCI6ImJlZmYzYjM1LWYwYTYtNGFlNS1hNjQ5LTAyZjJhMmFlMDY5MSIsImV4cCI6MTU3MDQ1NjMyNiwibmJmIjoxNTcwNDU0NTI2LCJpYXQiOjE1NzA0NTQ1MjYsInN1YiI6ImNhNTU3OGQxLWVlNmEtNDM0YS04NDBkLTQwNWQ3Y2MwYjliN18xNjkiLCJnaXZlbl9uYW1lIjoiRDJMIiwiZmFtaWx5X25hbWUiOiJTdXBwb3J0IiwibmFtZSI6IkQyTCBTdXBwb3J0IiwiZW1haWwiOiJqb3JkYW4uc25pZGVyQGQybC5jb20iLCJub25jZSI6ImE3NTQzMjc2YWE2MDBiYWRiZDFmIiwiaHR0cHM6Ly9wdXJsLmltc2dsb2JhbC5vcmcvc3BlYy9sdGkvY2xhaW0vbWVzc2FnZV90eXBlIjoiTHRpUmVzb3VyY2VMaW5rUmVxdWVzdCIsImh0dHBzOi8vcHVybC5pbXNnbG9iYWwub3JnL3NwZWMvbHRpL2NsYWltL3ZlcnNpb24iOiIxLjMuMCIsImh0dHBzOi8vcHVybC5pbXNnbG9iYWwub3JnL3NwZWMvbHRpL2NsYWltL2RlcGxveW1lbnRfaWQiOiIxNGYxN2FiOC03YTBkLTQ2MWYtYjkwYi05YmZiZDgwZjAwZWYiLCJodHRwczovL3B1cmwuaW1zZ2xvYmFsLm9yZy9zcGVjL2x0aS9jbGFpbS90YXJnZXRfbGlua191cmkiOiJodHRwczovL2x0aS1yaS5pbXNnbG9iYWwub3JnL2x0aS90b29scy8zMjUvbGF1bmNoZXMiLCJodHRwczovL3B1cmwuaW1zZ2xvYmFsLm9yZy9zcGVjL2x0aS9jbGFpbS9yZXNvdXJjZV9saW5rIjp7ImlkIjoiMTI5NTk0MzYzOSIsInRpdGxlIjoiSU1TIFJJIExpbmsiLCJkZXNjcmlwdGlvbiI6IkEgdGVzdCBsaW5rIGNyZWF0ZSBhdCB0aGUgb3JnIChnbG9iYWwpIGxldmVsIHRvIHRlc3QgYSAxLjMgbGF1bmNoIHRvIHRoZSBSSSJ9LCJodHRwczovL3B1cmwuaW1zZ2xvYmFsLm9yZy9zcGVjL2x0aS9jbGFpbS9yb2xlcyI6WyJodHRwOi8vcHVybC5pbXNnbG9iYWwub3JnL3ZvY2FiL2xpcy92Mi9tZW1iZXJzaGlwI0FkbWluaXN0cmF0b3IiLCJodHRwOi8vcHVybC5pbXNnbG9iYWwub3JnL3ZvY2FiL2xpcy92Mi9pbnN0aXR1dGlvbi9wZXJzb24jQWRtaW5pc3RyYXRvciJdLCJodHRwczovL3B1cmwuaW1zZ2xvYmFsLm9yZy9zcGVjL2x0aS9jbGFpbS9jb250ZXh0Ijp7ImlkIjoiMTAyODIiLCJsYWJlbCI6IkpvcmRhbiBTbmlkZXIgQ291cnNlIDMiLCJ0aXRsZSI6IkpvcmRhbiBTbmlkZXIgQ291cnNlIDMiLCJ0eXBlIjpbImh0dHA6Ly9wdXJsLmltc2dsb2JhbC5vcmcvdm9jYWIvbGlzL3YyL2NvdXJzZSNDb3Vyc2VPZmZlcmluZyJdfSwiaHR0cHM6Ly9wdXJsLmltc2dsb2JhbC5vcmcvc3BlYy9sdGkvY2xhaW0vbGlzIjp7ImNvdXJzZV9vZmZlcmluZ19zb3VyY2VkaWQiOiJwYXJ0bmVycy5icmlnaHRzcGFjZS5jb206Sm9yZGFuIFNuaWRlciBDb3Vyc2UgMyIsImNvdXJzZV9zZWN0aW9uX3NvdXJjZWRpZCI6InBhcnRuZXJzLmJyaWdodHNwYWNlLmNvbTpKb3JkYW4gU25pZGVyIENvdXJzZSAzIn0sImh0dHBzOi8vcHVybC5pbXNnbG9iYWwub3JnL3NwZWMvbHRpL2NsYWltL2xhdW5jaF9wcmVzZW50YXRpb24iOnsibG9jYWxlIjoiZW4tdXMifSwiaHR0cDovL3d3dy5icmlnaHRzcGFjZS5jb20iOnsidGVuYW50X2lkIjoiNDFiNjMyYjYtZmY3NC00Mjg4LWIzZjEtN2ZmYjZlYjE0YmI0Iiwib3JnX2RlZmluZWRfaWQiOiIifSwiaHR0cHM6Ly9wdXJsLmltc2dsb2JhbC5vcmcvc3BlYy9sdGktYWdzL2NsYWltL2VuZHBvaW50Ijp7InNjb3BlIjpbImh0dHBzOi8vcHVybC5pbXNnbG9iYWwub3JnL3NwZWMvbHRpLWFncy9zY29wZS9saW5laXRlbSIsImh0dHBzOi8vcHVybC5pbXNnbG9iYWwub3JnL3NwZWMvbHRpLWFncy9zY29wZS9saW5laXRlbS5yZWFkb25seSIsImh0dHBzOi8vcHVybC5pbXNnbG9iYWwub3JnL3NwZWMvbHRpLWFncy9zY29wZS9yZXN1bHQucmVhZG9ubHkiLCJodHRwczovL3B1cmwuaW1zZ2xvYmFsLm9yZy9zcGVjL2x0aS1hZ3Mvc2NvcGUvc2NvcmUiXSwibGluZWl0ZW1zIjoiaHR0cHM6Ly9wYXJ0bmVycy5icmlnaHRzcGFjZS5jb20vZDJsL2FwaS9sdGkvYWdzLzIuMC9kZXBsb3ltZW50LzE0ZjE3YWI4LTdhMGQtNDYxZi1iOTBiLTliZmJkODBmMDBlZi9vcmd1bml0LzEwMjgyL2xpbmVpdGVtcyJ9LCJodHRwczovL3B1cmwuaW1zZ2xvYmFsLm9yZy9zcGVjL2x0aS9jbGFpbS9jdXN0b20iOnsidXNlcl9pZCI6MTY5LCJ1c2VybmFtZSI6IkQyTFN1cHBvcnQifX0.utsE0zV9uwIl0P9LKykmazKS4L9_W3NidO6i2zAfTL_9-WjL_JXNs0bU17pTPStK1YVL8RsCYgrUiHEkUEdMJ8X0GvhTHv-aZlL2UPQQx6WMVSE9C0UPBykzAib3p5vYSHIdORfmkOXs6wF8Nc2fftnstV3G8Y6m3xMTirXlRX_IaO_Ziq5FCmcmS9mkRgFi-4X1oiqtwG4cUBsvyf5A5H4EpRXmgoZNj_Nc51aGptFqn3jWZP1ghqdPxX-AZG1psJicU24KjbYpaYp8yPk92jmPAyzrUE1D8z0zZTjSKawJv6g9OLPYDm5MFiU1k2KhSgyMAjwbAy2TciXahXIg8g

Thank you,

Steve.H.432

Hey Jordan,

Passing kid in the payload was the issue. Thanks. I removed it and it is working now.

Jordan.Snider3520

Hey @Steve Hellauer ,

That is awesome to hear! Really glad moving kid over to the header and out of the JWT header helped resolve the issue. In order to help future vendors avoid a similar issue in the future, you would be willing to share with us your final working request example? I will be sure we carefully documented the smyptoms, root cause, and resolution of the issue to ensure that we are able to help future LTI developers get through similar challenges. We are producing an FAQ for LTI, and would love to include this community post in it

Thank you for helping us to improve our Dev community!

Steve.H.432

Yes, of course! Below is the correctly formatted JWT:

https://jwt.io/#debugger-io?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjZjYjEyZmJlMTEyNDZjNGU4ZDZmYzQ5YTFmMTk3YTFkIn0.eyJpc3MiOiJhYTQzNTAxNi0wMDlhLTRjZWItYTg5ZC0wNzMxNDg5ODE0NWUiLCJhdWQiOiJodHRwczpcL1wvYXBpLmJyaWdodHNwYWNlLmNvbVwvYXV0aFwvdG9rZW4iLCJqdGkiOiI0Y2EzYjExY2Q4NDM3ZmI1YzhlN2JlNzU3YzA2YjQ0MiIsImlhdCI6MTU3MDQ2OTAxMSwic3ViIjoiYWE0MzUwMTYtMDA5YS00Y2ViLWE4OWQtMDczMTQ4OTgxNDVlIiwibmJmIjoxNTcwNDY5MDExLCJleHAiOjE1NzA0NzI2MTF9.Byf3gNzGD7YF4UsZIH-OSvi0Jega6voq8wyx5wzr8UnGuq8gNf8l75RBB_7kR7WNU642b8WKJCRQpX2pNXaWyB-xDdp2L_TWSnHKlNFSEIR0ykgE8Y7Xn1ZMznngBom3Sl8CEyisoXPF1BpMNHpWeE6VdZRFlLvaByTRiaLerfy-DwO8R9Z29YODdb4bAzVg2rbg9RDoDclloF0RYThcrZuET7egC5bC5bsayNF906Dhbp30smgetdeJA6G9q6-EOe7NntZDQXsrdbLDwWXf1eUMJgBzGDH2byDI9s3534XJhG-VjXr9rbCmabQN6wdAx-m5bxBdG66UQsvyhWY-yA

Jordan.Snider3520

Brilliant, thank you so much for sharing with our community! This will go a long way to help many many developers in the future.

Khalil.Mirza3597

Hi,

I am able to all steps.

I am right now creating json web token.

Can you point ouy how to use jwks url to construct private and public keys.

I am able to create public keys only from jwks url.

Steve.H.432

Not sure if this helps but below shows a PHP snippet of how I am doing it. @Khalil Mirza

$kid = md5();

$config = [

'digest_alg' => 'sha256',

'private_key_bits' => 2048,

'private_key_type' => OPENSSL_KEYTYPE_RSA,

];

$res = openssl_pkey_new($config);

openssl_pkey_export($res, $privKey);

$pubKey = openssl_pkey_get_details($res);

$pubJWK = [

'kty' => 'RSA',

'e' => rtrim(str_replace(['+', '/'], ['-', '_'], base64_encode($pubKey['rsa']['e'])), '='),

'n' => rtrim(str_replace(['+', '/'], ['-', '_'], base64_encode($pubKey['rsa']['n'])), '='),

'kid' => $kid,

'alg' => 'RS256',

'use' => 'sig',

];

$pubKey = $pubKey['key'];

$data = [

'publickey' => $pubKey,

'privatekey' => $privKey,

'publicjwk' => json_encode($pubJWK),

'kid' => $kid,

'timecreated' => time(),

];

Khalil.Mirza3597

Thanks for your help.

I am now getting the current JWT token but I am having another error when making request.

{

"error": "unauthorized_client",

"error_description": "This client does not have a registered JWKS endpoint"

}

I have checked the client id is registered and enabled.

Steve.H.432

Make sure your registered LTI Advantage Tool has a Keyset URL assigned to it, which is a publicly hosted endpoint for your tool's public key access. @Khalil Mirza