Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-67988

JWKs Base64url-encoded values must not use padding

    XMLWordPrintable

    Details

    • Testing Instructions:
      Hide

      This is a technical story which was only impacting a single client with a strict interpretation of the specification. Thus the testing is to check there has been no regression on LTI 1.3 by verifying an LTI 1.3 launch works properly.

      Any LTI 1.3 tool can be used for this test.

      Setup

      1. Log in as an administrator
      2. Navigate to Site Administration > Plugins > External tool > Manage tools
      3. Click on configure a tool manually
      4. Fill the form as follow:
      5. LTI Version: LTI 1.3
      6. Public key: copy the value from https://ztest.cengage.info/ztest/ LTI 1.3 Connect info tab
      7. Initiate Login URI: https://ztest.cengage.info/ztest/ws/lti/startlaunch?lti13=true&platform=moodle
      8. Redirect URI: https://ztest.cengage.info/ztest/lti13
      9. Click on ‘Show more’
      10. Check Content-Item message
      11. The following steps are only needed until MDL-67702 is integrated:
        • Once the tool is created, click the information icon (pie icon) and copy the client id
        • Update the initiate login URI and replace CLIENT_ID_HERE with the client id value for that tool

      Testing scenario: Verify LTI Launch

      1. As instructor, log to a course
      2. Turn editing ON
      3. Click Add an activity or resource and select external tool
      4. On the Add external tool page, select ZTest 13 tool for preconfigured tool
      5. Turn on your browser developer tools - network
      6. Click on Select Content
      7. Verify there is no error in the tool: Successful Launch is displayed
      Show
      This is a technical story which was only impacting a single client with a strict interpretation of the specification. Thus the testing is to check there has been no regression on LTI 1.3 by verifying an LTI 1.3 launch works properly. Any LTI 1.3 tool can be used for this test. Setup Log in as an administrator Navigate to Site Administration > Plugins > External tool > Manage tools Click on configure a tool manually Fill the form as follow: Tool name: ZTest 1.3 Tool url: https://ztest.cengage.info/ztest/lti LTI Version: LTI 1.3 Public key: copy the value from https://ztest.cengage.info/ztest/ LTI 1.3 Connect info tab Initiate Login URI: https://ztest.cengage.info/ztest/ws/lti/startlaunch?lti13=true&platform=moodle Redirect URI: https://ztest.cengage.info/ztest/lti13 Click on ‘Show more’ Check Content-Item message The following steps are only needed until MDL-67702 is integrated: Once the tool is created, click the information icon (pie icon) and copy the client id Update the initiate login URI and replace CLIENT_ID_HERE with the client id value for that tool Testing scenario: Verify LTI Launch As instructor, log to a course Turn editing ON Click Add an activity or resource and select external tool On the Add external tool page, select ZTest 13 tool for preconfigured tool Turn on your browser developer tools - network Click on Select Content Verify there is no error in the tool: Successful Launch is displayed
    • Affected Branches:
      MOODLE_38_STABLE
    • Fixed Branches:
      MOODLE_37_STABLE, MOODLE_38_STABLE
    • Pull from Repository:
    • Pull Master Branch:
      MDL-67988-jws-base64url

      Description

      The JWKs key data returned by 'mod/lti/certs.php' includes 2 fields ("e" and "n") which are Base64url-encoded, and currently include padding (i.e. trailing '=' characters).

       

      Per the JWS proposed standard RFC-7515, which is referenced by the JWK proposed standard RFC-7517 as defining Base64url encoding, values with this encoding should be encoded "with all trailing '=' characters omitted".

      https://tools.ietf.org/html/rfc7517#section-2

      https://tools.ietf.org/html/rfc7515#section-2

       

        Attachments

          Activity

            People

            Assignee:
            claudevervoort Claude Vervoort
            Reporter:
            ahutchinson1 ahutchinson1
            Peer reviewer:
            Jake Dallimore
            Integrator:
            Sara Arjona (@sarjona)
            Tester:
            Anna Carissa Sadia
            Participants:
            Component watchers:
            Adrian Greeve, Jake Dallimore, Mathew May, Mihail Geshoski, Peter Dias
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Fix Release Date:
              9/Mar/20

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 1 hour, 41 minutes
                1h 41m