Trouble with testing as a tool against test platforms about lti-php HOT 6 CLOSED

I have used this library for a number of different tools, including https://saltire.lti.app/tool, and not encountered any issues. Were you using a PEM-formatted public key or a URL to a public key endpoint? If the former, try using the latest release (4.6.4) which fixed an issue with the update to the latest JWT library.

from lti-php.

I have tried using https://lti-ri.imsglobal.org/ as a platform to launch to https://saltire.lti.app/tool as the tool, but currently after the OIDC exchange the platform is sending a message without includiung the state parameter so it is rejected. This looks like a bug with https://lti-ri.imsglobal.org/ but I'll continue to explore this. Have you tried using any other platforms such as Moodle, Canvas, Blackboard or Brightspace?

from lti-php.

Thank you for the response. I am using a URL to a public key endpoint. I have tested in moodle and receive the following error: "signature check failed - perhaps an invalid public key or timestamp"

from lti-php.

I have explored the IMS reference implementation further and it appears that it only supports authentication requests sent using HTTP GET requests. The spec allows GET or POST to be used and this library uses POST. When I changed this to use GET, the launch from the reference implementation was successful with the saLTIre tool.

As for your issue when launching from Moodle, have you set the logging level to debug and inspected the requests being received and sent by your tool? Have you checked the time set on your server?

from lti-php.

Thank you for your help. This should help get our tool working in the IMS reference implementation for additional testing. I will look into additional debugging for moodle and checking the time on the servers.

from lti-php.

Good luck with your debugging. It is probably not of any use to you, but I have added a "Use GET for authentication request messages?" option to the saLTIre tool to allow users to override the use of POST when sending authentication requests to platforms. I am undecided about whether to add such an option to this library - I have never come across any other platforms which do not support POST requests to this endpoint. Support for both GET and POST is required by both the IMS LTI 1.3 spec and the Open ID Connect spec on which it is based.

from lti-php.