Moodle LTI 1.3 support and guidelines

[jlanza]

Proposed change

Is Moodle LTI 1.3 supported? Is there any information on how to integrate it with Moodle? The README is focused on Canvas. Currently I don't know where to put in JupyterHub configuration the private keys, etc. Moodle is asking for a public key.

Who would use this feature?

(just because I have to fill it) Probably quite some people trying to provide more security ;)

[welcome]

Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.

You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

[martinclaus]

Hi @jlanza, support for LTI 1.3 is currently added (#134) and will be part of the next release. But you are correct, the documentation and README really require some attention. Would be great if you are willing to contribute the Moodle specific documentation, once the PR is merged.

[jlanza]

Thanks a lot for the work towards LTI 1.3. I have used you LTI 1.1 implementation at my course and I will be eager to try to integrate LTI 1.3 (first I have to read the spec and check if the Moodle of my organization is updated (I guess yes) ;)). If I have time I can do so and also contribute.

[martinclaus]

Hi @jlanza! LTI 1.3 support (#134) is merged into the main branch and I have updated the LTI 1.3 section of the README. I hope the configuration of the LTI13Authenticator is now more clear.

[jlanza]

I really have to thank you all for the great job. I will test it as soon as I have sometime. I have integrated the functionality in my lectures, which are currently running. So I will test in a parallel deployment.

[jeflem]

Hi @jlanza, I'm running JupyterHub with LTIAuthenticator via Moodle 4 (just when I started to think about writing the 1.3 part for LTIAuthenticator on my own a few weeks ago, @martinclaus did it, saved me many hours, really great job done, many thanks!!!). Here are some config hints from my experience and testing:

In jupyterhub_config.py:

c.LTI13Authenticator.issuer = 'https://your-moodle-domain.org'
c.LTI13Authenticator.authorize_url = 'https://your-moodle-domain.org/mod/lti/auth.php'
c.LTI13Authenticator.client_id = 'client_id_generated_by_moodle'
c.LTI13Authenticator.jwks_endpoint ='http://your-moodle-domain.org/mod/lti/certs.php'

In Moodle's external tool configuration dialog (I use manual configuration):

• Tool URL: https://your-jhub-domain.org (if you want to use nbgitpuller: place the nbgitpuller link here)
• Public key type: Keyset URL
• Public keyset: empty (LTIAuthenticator doesn't need it)
• Initiate login URL: https://your-jhub-domain.org/hub/lti13/oauth_login
• Redirection URI(s): https://your-jhub-domain.org/hub/lti13/oauth_callback

Important: The 'Default launch container' has to be set to 'Existing window'. All other option (even 'New window') do not work with JupyterHub because JupyterHub doesn't allow embedding into other sites (Moodle's 'New Window' first embeds JupyterHub for some reason and then opens it in a new window).

[hugokoopmans]

Hi there,
I am trying to get this to work ;-)
I have added the ltiauthenticator to my docker file, done all the steps above (moodle 4 and jupyterhub both on docker with a nginx reverse proxy running), added appropriate lines to the config file.

Both systems work fine, but I cannot get the integration working.

Seems like the lti is not available in the jupyterhub?

When I add the jupyterhub as external tool the oath url is not found...

https://my.jupyter.org/hub/lti13/oauth_login gives

404 : Not Found

Jupyter has lots of moons, but this is not one...

My dockerfile:

# Copyright (c) Jupyter Development Team.
# Distributed under the terms of the Modified BSD License.
ARG JUPYTERHUB_VERSION
FROM jupyterhub/jupyterhub:$JUPYTERHUB_VERSION
# Install dockerspawner, nativeauthenticator
# hadolint ignore=DL3013
RUN python3 -m pip install --no-cache-dir \
dockerspawner \
jupyterhub-nativeauthenticator \
jupyterhub-ltiauthenticator

CMD ["jupyterhub", "-f", "/srv/jupyterhub/jupyterhub_config.py"]`

Do i need something extra on the commandline to make the authenticator run?

All advice welcome

[hugokoopmans]

logging from jupyterhub

[I 2023-08-31 09:09:13.119 JupyterHub users:768] Server jupyter-admin is ready
[I 2023-08-31 09:09:13.120 JupyterHub log:191] 200 GET /hub/api/users/jupyter-admin/server/progress?_xsrf=[secret] (jupyter-admin@86.93.106.67) 2122.98ms
[I 2023-08-31 09:09:13.158 JupyterHub log:191] 302 GET /hub/spawn-pending/jupyter-admin -> /user/jupyter-admin/ (jupyter-admin@86.93.106.67) 3.45ms
[I 2023-08-31 09:09:13.242 JupyterHub log:191] 302 GET /hub/api/oauth2/authorize?client_id=jupyterhub-user-jupyter-admin&redirect_uri=%2Fuser%2Fjupyter-admin%2Foauth_callback&response_type=code&state=[secret] -> /user/jupyter-admin/oauth_callback?code=[secret]&state=[secret] (jupyter-admin@86.93.106.67) 24.23ms
[I 2023-08-31 09:09:13.291 JupyterHub log:191] 200 POST /hub/api/oauth2/token (jupyter-admin@172.20.0.4) 30.71ms
[I 2023-08-31 09:09:13.316 JupyterHub log:191] 200 GET /hub/api/user (jupyter-admin@172.20.0.4) 22.27ms
[W 2023-08-31 09:10:04.218 JupyterHub web:1869] 403 POST /hub/lti13/oauth_login (86.93.106.67): '_xsrf' argument missing from POST
[W 2023-08-31 09:10:04.255 JupyterHub log:191] 403 POST /hub/lti13/oauth_login (@86.93.106.67) 38.16ms
[W 2023-08-31 09:10:25.584 JupyterHub web:1869] 403 POST /hub/lti13/oauth_login (86.93.106.67): '_xsrf' argument missing from POST
[W 2023-08-31 09:10:25.586 JupyterHub log:191] 403 POST /hub/lti13/oauth_login (@86.93.106.67) 2.28ms
[W 2023-08-31 09:10:55.231 JupyterHub log:191] 404 GET /hub/lti13/oauth_login (jupyter-admin@86.93.106.67) 37.30ms
[W 2023-08-31 09:12:07.748 JupyterHub web:1869] 403 POST /hub/lti13/oauth_login (86.93.106.67): '_xsrf' argument missing from POST
[W 2023-08-31 09:12:07.750 JupyterHub log:191] 403 POST /hub/lti13/oauth_login (@86.93.106.67) 2.29ms
09:13:28.382 [ConfigProxy] info: 200 GET /api/routes 
[I 2023-08-31 09:14:04.606 JupyterHub log:191] 200 POST /hub/api/users/jupyter-admin/activity (jupyter-admin@172.20.0.4) 12.41ms
09:18:28.382 [ConfigProxy] info: 200 GET /api/routes 
[I 2023-08-31 09:19:16.609 JupyterHub log:191] 200 POST /hub/api/users/jupyter-admin/activity (jupyter-admin@172.20.0.4) 13.56ms
[I 2023-08-31 09:20:52.988 JupyterHub log:191] 200 GET /hub/api/user (jupyter-admin@172.20.0.4) 10.99ms
[W 2023-08-31 09:21:00.229 JupyterHub log:191] 404 GET /hub/lti13/oauth_login (jupyter-admin@86.93.106.67) 3.83ms
[W 2023-08-31 09:21:13.255 JupyterHub log:191] 404 GET /hub/lti13/oauth_login (jupyter-admin@86.93.106.67) 3.45ms
09:23:28.382 [ConfigProxy] info: 200 GET /api/routes 
[I 2023-08-31 09:24:13.586 JupyterHub log:191] 200 POST /hub/api/users/jupyter-admin/activity (jupyter-admin@172.20.0.4) 12.20ms
09:28:28.382 [ConfigProxy] info: 200 GET /api/routes 
[I 2023-08-31 09:28:59.096 JupyterHub log:191] 200 POST /hub/api/users/jupyter-admin/activity (jupyter-admin@172.20.0.4) 14.65ms```

[hugokoopmans]

hmmm i assume these two can run side by side

jupyterhub-nativeauthenticator
jupyterhub-ltiauthenticator

[hugokoopmans]

hehe

you do need to choose indeed:

#c.JupyterHub.authenticator_class = "nativeauthenticator.NativeAuthenticator"
c.JupyterHub.authenticator_class = "ltiauthenticator.lti13.auth.LTI13Authenticator"

now it works from moodle (but not anymore from outside)

[martinclaus]

Hi @hugokoopmans,

you were quicker than me 😄.

Indeed, ltiauthenticator cannot run alongside another authenticator as mentioned in the README. Though, it could be mentioned in the docs too. Actually, I am not sure if multiple authenticator are supported by Jupyterhub at all. You may try to look here for some hints how to add another authenticator.

[hugokoopmans]

ok it worked fine untill a few weeks ago...

[hugokoopmans]

now I get this error : Required LTI 1.3 arg iss not in request

[I 2024-05-28 12:19:50.793 JupyterHub log:191] 200 GET /hub/login?next=%2Fhub%2Fadmin (@90.145.96.110) 2.46ms

12:20:58.516 [ConfigProxy] info: 200 GET /api/routes 

[I 2024-05-28 12:21:30.095 JupyterHub log:191] 302 GET /hub/user-redirect/git-pull?repo=https%3A%2F%2Fgithub.com%2Fstefmolin%2Fpandas-workshop&urlpath=lab%2Ftree%2Fpandas-workshop%2F -> /hub/login?next=%2Fhub%2Fuser-redirect%2Fgit-pull%3Frepo%3Dhttps%253A%252F%252Fgithub.com%252Fstefmolin%252Fpandas-workshop%26urlpath%3Dlab%252Ftree%252Fpandas-workshop%252F (@90.145.96.110) 1.38ms

[I 2024-05-28 12:21:30.134 JupyterHub log:191] 200 GET /hub/login?next=%2Fhub%2Fuser-redirect%2Fgit-pull%3Frepo%3Dhttps%253A%252F%252Fgithub.com%252Fstefmolin%252Fpandas-workshop%26urlpath%3Dlab%252Ftree%252Fpandas-workshop%252F (@90.145.96.110) 3.47ms

[W 2024-05-28 12:21:51.949 JupyterHub web:1869] 400 GET /hub/lti13/oauth_login?next=%2Fhub%2Fadmin (90.145.96.110): Required LTI 1.3 arg iss not in request