Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-67988

JWKs Base64url-encoded values must not use padding

    XMLWordPrintable

Details

    • MOODLE_38_STABLE
    • MOODLE_37_STABLE, MOODLE_38_STABLE
    • MDL-67988-jws-base64url
    • Hide

      This is a technical story which was only impacting a single client with a strict interpretation of the specification. Thus the testing is to check there has been no regression on LTI 1.3 by verifying an LTI 1.3 launch works properly.

      Any LTI 1.3 tool can be used for this test.

      Setup

      1. Log in as an administrator
      2. Navigate to Site Administration > Plugins > External tool > Manage tools
      3. Click on configure a tool manually
      4. Fill the form as follow:
      5. LTI Version: LTI 1.3
      6. Public key: copy the value from https://ztest.cengage.info/ztest/ LTI 1.3 Connect info tab
      7. Initiate Login URI: https://ztest.cengage.info/ztest/ws/lti/startlaunch?lti13=true&platform=moodle
      8. Redirect URI: https://ztest.cengage.info/ztest/lti13
      9. Click on ‘Show more’
      10. Check Content-Item message
      11. The following steps are only needed until MDL-67702 is integrated:
        • Once the tool is created, click the information icon (pie icon) and copy the client id
        • Update the initiate login URI and replace CLIENT_ID_HERE with the client id value for that tool

      Testing scenario: Verify LTI Launch

      1. As instructor, log to a course
      2. Turn editing ON
      3. Click Add an activity or resource and select external tool
      4. On the Add external tool page, select ZTest 13 tool for preconfigured tool
      5. Turn on your browser developer tools - network
      6. Click on Select Content
      7. Verify there is no error in the tool: Successful Launch is displayed
      Show
      This is a technical story which was only impacting a single client with a strict interpretation of the specification. Thus the testing is to check there has been no regression on LTI 1.3 by verifying an LTI 1.3 launch works properly. Any LTI 1.3 tool can be used for this test. Setup Log in as an administrator Navigate to Site Administration > Plugins > External tool > Manage tools Click on configure a tool manually Fill the form as follow: Tool name: ZTest 1.3 Tool url: https://ztest.cengage.info/ztest/lti LTI Version: LTI 1.3 Public key: copy the value from https://ztest.cengage.info/ztest/ LTI 1.3 Connect info tab Initiate Login URI: https://ztest.cengage.info/ztest/ws/lti/startlaunch?lti13=true&platform=moodle Redirect URI: https://ztest.cengage.info/ztest/lti13 Click on ‘Show more’ Check Content-Item message The following steps are only needed until MDL-67702 is integrated: Once the tool is created, click the information icon (pie icon) and copy the client id Update the initiate login URI and replace CLIENT_ID_HERE with the client id value for that tool Testing scenario: Verify LTI Launch As instructor, log to a course Turn editing ON Click Add an activity or resource and select external tool On the Add external tool page, select ZTest 13 tool for preconfigured tool Turn on your browser developer tools - network Click on Select Content Verify there is no error in the tool: Successful Launch is displayed

    Description

      The JWKs key data returned by 'mod/lti/certs.php' includes 2 fields ("e" and "n") which are Base64url-encoded, and currently include padding (i.e. trailing '=' characters).

       

      Per the JWS proposed standard RFC-7515, which is referenced by the JWK proposed standard RFC-7517 as defining Base64url encoding, values with this encoding should be encoded "with all trailing '=' characters omitted".

      https://tools.ietf.org/html/rfc7517#section-2

      https://tools.ietf.org/html/rfc7515#section-2

       

      Attachments

        1. MDL-67988.jpg
          112 kB
          Anna Carissa Sadia

        Activity

          People

            claudevervoort Claude Vervoort
            ahutchinson1 ahutchinson1
            Jake Dallimore Jake Dallimore
            Sara Arjona (@sarjona) Sara Arjona (@sarjona)
            Anna Carissa Sadia Anna Carissa Sadia
            Jake Dallimore, Ilya Tregubov, Kevin Percy, Mathew May, Mihail Geshoski, Shamim Rezaie
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:
              9/Mar/20

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 1 hour, 41 minutes
                1h 41m