Keyset URL cannot be reached

Question

I'm trying to setup an LTI advantage link with Mahara on our test environment but after completing all the details as instructed on the Mahara help pages here:

https://manual.mahara.org/en/21.10/external/lti_brightspace.html#ltiadvantage-brightspace

Brightspace returns a Keyset URL cannot be reached error.

Any ideas what I might be doing wrong?

Jeff.C.963 · Answer

My server was also using TLS 1.3. Originally I had "SSLProtocol TLSv1.2 TLSv1.3" line in my apache default.conf file. Even though requests should have automatically assigned the correct TLS version based on the request, it was defaulting to version 1.3. Once I changed the apache default.conf file to remove the TLSv1.3 it worked. The final directive in the .conf file that worked was:

SSLProtocol TLSv1.2

Andy.G.943 · Answer

For me it was because my server only supports TLS 1.3 and Brightspace doesn't support TLS 1.3.  I had to host my JWKS somewhere else.

Scott.H.223 · Answer

In case anyone runs into a similar problem in the future.  Our Mahara test site was hosted on a LAN which our Brightspace test server couldn't contact.  We had to move the Mahara test site to a publicly accessible server before we could complete the Mahara LTI integration.