nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to link a service user to an oAuth tool

Arald.d.320

In the release noets for the november release the Service Users are announced. The release notes tell you wher to find them and how to create them but I mis documentation about how to link them to an oAuth2.0 tool. Ther doesn't seem to be any documentation about that part.

Find more posts tagged with

Documentation

APIs

Accepted answers

Jerome.N.9145

Hello @Arald.d.320,

I have received an update from our internal teams regarding your inquiry with Linked Tool.

At this time, service users cannot be linked to apps / tools. This functionality is coming in the future. Only D2L will be able to link service users to tool (some examples of this today include IPSIS, and LTI AGS, both of these may be migrated to use the new service users tool in the future).

Customer (and integration developers), will be able to create and link service users to applications that use our upcoming server-to-server client credential OAuth2 client, coming in December.

Thank you,

Jerome

All comments

Jerome.N.9145

Hi @Arald.d.320, thank you for your question! I’m currently looking into this and will get back to you as soon as possible. I’m aiming to provide a full response by tomorrow. Thank you for your patience!"

Jerome.N.9145

Hi @Arald.d.320,

It looks like the process for using Service Users with LTI is covered in a separate resource. You can find detailed instructions in this community article:

https://community.d2l.com/brightspace/kb/articles/33349-managing-brightspace-api-access-for-server-to-server-integrations

Thank you

Arald.d.320

Dear Jerome,

The probleem is that there is no documentation about how to link a service user to a tool. The documentation describes hou to create and activate a service uses and how to configure the permissions and org unit access but not how to link a tool to this user. How can you get your tool to show up onder "Used by"

Jerome.N.9145

Hello @Arald.d.320,

I have received an update from our internal teams regarding your inquiry with Linked Tool.

Customer (and integration developers), will be able to create and link service users to applications that use our upcoming server-to-server client credential OAuth2 client, coming in December.

Thank you,

Jerome

Randall.S.394

Hi @Jerome.N.9145,

It is now well past December. I still cannot figure out how to replace my applications that are currently using real user accounts that I create for the Server-Server applications to start using the Service

I have read the link provided by @Arald.d.320 and I have created a new service and cannot figure out how to regenerate authentication tokens using service users credentials. How do you get credentials for the service user?

Also, from the pages @Arald.d.320 linked to (actually the following page) there is this last comment:

I am not exactly sure what is meant by the highlighted statement. I can't find any information on this within the OATH2 workflow information in the API docs.

Sangeetha.T.629

Hi @Randall.S.394,

Thanks for reaching out to us through the community!

Can you please confirm whether you have reviewed the document below?

https://community.d2l.com/brightspace/kb/articles/33526-register-an-oauth2-0-application-for-server-to-server-authentication

This document will help you implement OAuth 2.0. I would also suggest you review the documents below, which provide more detail on the request you are implementing.

https://community.d2l.com/brightspace/kb/articles/34318-service-users-and-server-to-server-authentication-for-brightspace

If you still have issues, I would request that you raise an admin support case with us so we can check and understand what is implemented and what is required.

Please let us know if there are any further concerns.

Thanks,

Sangeetha

Randall.S.394

My problem is finding the JWKS URL for our internal applications.

We use Azure and SSO for regular user authentication and it is managed by a different department. However, we have been using local logins for the users we create for our internal applications. We cannot use the Azure URL since these are not 'real' users.

I would like to be able to use D2L's authentication infrastructure (since that is what I was doing before) but I cannot find information on the JWKS URL for our D2L instance. I am hesitant to just run a spider to walk the web tree looking for "https://ourd2l.com/*/.well-known". I would imagine that might raise some security flags on your side.

Niccolo.C.4346

Hi Randall,

The Service User is linked during the OAuth 2.0 application registration process for a server-to-server application.

In Brightspace, go to Admin Tools > Manage Extensibility > OAuth 2.0, then register an application using Client Credentials as the grant type. During that registration, the documented steps include adding the previously created Service User under the Service User section.

Documentation:
https://community.d2l.com/brightspace/kb/articles/33526-register-an-oauth2-0-application-for-server-to-server-authentication

For the JWKS URL specifically, this is not a Brightspace instance URL that you retrieve from your D2L site. The documentation states that the JWKS URL is the HTTPS URL that hosts the JSON Web Key Set for the application or external authorization server. Brightspace uses that URL to retrieve the public keys it needs to verify the signed JWT client assertion.

The developer documentation also describes this as the location of your application host’s signing-key sets:
https://docs.valence.desire2learn.com/basic/oauth2.html

At a high level, the documented flow is:

Create and configure the Service User.
Register an OAuth 2.0 application with Client Credentials as the grant type.
Provide an HTTPS JWKS URL for the public keys used to validate the signed JWT client assertion.
Link the Service User to that OAuth 2.0 application.
Have the application sign a JWT client assertion with the private key that corresponds to the public key in the JWKS.
Exchange that signed JWT for an access token from Brightspace.
Use the access token in the Authorization: Bearer header when calling Brightspace APIs.

So, for your internal application, the JWKS endpoint needs to be hosted by your application or by the system that manages the public signing keys used for this client-credentials integration.

Also note that API access is controlled by both the OAuth scopes registered/requested by the application and the org unit access and permissions assigned to the linked Service User.

The Service Users overview may also help clarify the model:
https://community.d2l.com/brightspace/kb/articles/34318-service-users-and-server-to-server-authentication-for-brightspace

Randall.S.394

Hi. Thanks for the information but I think I my have not been clear. My question is essentially, where do you get this HTTPS JWKS URL ?

Ana.A.776

Hello @Randall.S.394,

Thank you for reaching out in the Brightspace Community.

The JWKS URL is an HTTPS endpoint hosted by your external application. The external application must provide the JWKS URL. Brightspace automatically fetches the public key from this JWKS endpoint.

This URL exposes a JSON Web Key Set (JWKS), which contains your application’s public keys.
When your application generates a JSON Web Token (JWT), it signs that token using its private key.
Brightspace then retrieves the public key from the JWKS URL and uses it to verify that the JWT was issued by your application and has not been tampered with.

Please refer to the following Community article for more details: Register a server-to-server OAuth 2.0 application

Please let us know if you have further questions or concerns.

Thanks,

Ana

Randall.S.394

I am just trying to be sure I understand the limitations of the new service user.

I have applications that access our D2L site using API. Currently, they use a local user account that I have created. This user has a local password. Since our site uses SSO managed by Azure and these are not 'official user accounts', in order to get the initial refresh token, I have to login to our instance, bypassing SSO using /login?noredirect=1 in order to login using the D2L login credentials.

However, if I make a website on GitHub (or similar) and upload a self-signed public key for the fake service user, I can then use the new built in Service User.

Without having access to a public webserver, there is no way to use the new Service User feature.

Am I understanding correctly ?

Nikhil.P.90

@Randall.S.394 Hi Randall,

Yes, your understanding is correct.

To authenticate a service user for applications registered in Brightspace using the Client Credentials grant type, you will need either:

An external authorization server that exposes a JWKS endpoint, or
A publicly accessible location (such as a website hosted on GitHub Pages or a similar platform) to host the JWKS URL used for authentication.

Additionally, if you will be attending D2L Fusion on July 8–10, I recommend attending the lab session that includes a demonstration of the Client Credentials authentication flow, presented by one of our development team members. This session should provide a practical walkthrough of the setup and implementation.

Please let me know if you have any further questions.

Kind regards,

Nik

Randall.S.394

Thanks for the clarification.