Skip to content

Commit 1f517ab

Browse files
martinclausmartinclaus
committed
Make client_id's type a list or set
1 parent f362508 commit 1f517ab

File tree

3 files changed

+13
-16
lines changed

3 files changed

+13
-16
lines changed

‎docs/source/lti13/getting-started.md

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ Start by navigating to your [LMS vendor's integration section](lms-integration.m
77
During the tool registration process, you should obtain the following information which is necessary to complete the setup of the LTI Authenticator plugin:
88

99
- `issuer`: URL of the LMS platform used for identification
10-
- `client_id`: opaque ID of the tool registration at the platform
10+
- `client_id`: opaque ID of the tool registration at the platform.
11+
You may obtain multiple client IDs, e.g. if you do multiple [single-tenant registrations](https://www.imsglobal.org/spec/lti/v1p3#single-tenant-tool-registered-and-deployed-once) within your LMS with the same JupyterHub instance.
1112

1213
```{note}
1314
If your LMS is not listed feel free to send us a PR with instructions for this new LMS.
@@ -21,14 +22,13 @@ See the [configuration reference](reference) for a complete list of available co
2122
The required settings to get authentication via LTI 1.3 to work are:
2223

2324
- `issuer`: the URL of your LMS platform. If your LMS is served from `https://canvas.instructure.com`, the issuer is `https://canvas.instructure.com`.
24-
- `client_id`: opaque ID, typically generated by the LMS when a tool is registered there.
25-
You can specify either a single client ID or a set of client IDs, e.g. if you do multiple [single-tenant registrations](https://www.imsglobal.org/spec/lti/v1p3#single-tenant-tool-registered-and-deployed-once) within your LMS with the same JupyterHub instance.
25+
- `client_id`: set or list of opaque IDs, typically generated by the LMS when a tool is registered there.
2626
- `authorize_url`: Authorization endpoint of the LMS platform. The URL to which authorization requests are sent by the authenticator as part of the [OIDC implicit flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/implicit-flow-with-form-post).
2727
E.g. `https://canvas.instructure.com/api/lti/authorize_redirect`.
2828
- `jwks_endpoint`: An endpoint of the LMS from which JupyterHub can obtain the [JWKS](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-key-sets) to verify and decode any received [JWT](https://auth0.com/docs/secure/tokens/json-web-tokens).
2929
E.g. `https://canvas.instructure.com/api/lti/security/jwks`.
3030

31-
A valid minimal configuration in the `jupyterhub_config,py` may look like this
31+
A valid minimal configuration in the `jupyterhub_config.py` may look like this
3232

3333
```python
3434
c.JupyterHub.authenticator_class = "ltiauthenticator.lti13.auth.LTI13Authenticator"
@@ -43,7 +43,7 @@ c.LTI13Authenticator.authorize_url = "https://canvas.instructure.com/api/lti/aut
4343
c.LTI13Authenticator.jwks_endpoint = "https://canvas.instructure.com/api/lti/security/jwks"
4444

4545
# The external tool's client id as represented within the platform (LMS)
46-
c.LTI13Authenticator.client_id = "125900000000000329"
46+
c.LTI13Authenticator.client_id = ["125900000000000329"]
4747
```
4848

4949
## Username Key Setting
@@ -104,19 +104,12 @@ hub:
104104
authorize_url: "https://canvas.instructure.com/api/lti/authorize_redirect"
105105
# The external tool's client id as represented within the platform (LMS)
106106
# Typically created by the platform when registering the tool.
107-
client_id: "125900000000000329"
107+
client_id:
108+
- "125900000000000329"
108109
# The platform's JWKS endpoint url providing public key sets used to verify the ID token
109110
jwks_endpoint: "https://canvas.instructure.com/api/lti/security/jwks"
110111
```
111112
112-
If you like to set multiple client IDs, you need to use yamls list notation:
113-
114-
```yaml
115-
client_id:
116-
- "125900000000000329"
117-
- "125900000000000330"
118-
```
119-
120113
## Deal with Synchronization Issues (iat, nbf, exp)
121114
122115
The underlying OIDC Implicit flow protocol requires some checks involving token issuing time.

‎docs/source/lti13/reference.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ hub:
2828
| tool_description | No | Description of the tool within the config JSON | `"Launch interactive Jupyter Notebooks with JupyterHub"` |
2929
| username_key | No | The LTI 1.3 launch parameter that contains the JupyterHub username value | `"email"` |
3030
| issuer | Yes | The platform's issuer identifier. A case-sensitive URL provided by the platform | |
31-
| client_id | Yes | The client ID or a list of client IDs identifying the JuyterHub within the LMS platform. Must contain the client IDs created when registering the tool on the LMS platform. Possible values are of type `str` or `set[str]`. | |
31+
| client_id | Yes | List or set of client IDs identifying the JuyterHub within the LMS platform. Must contain the client IDs created when registering the tool on the LMS platform. Possible values are of type `list[str]` or `set[str]`. | |
3232
| authorize_url | Yes | Authorization end-point of the platform's identity provider. Provided by the platform. | |
3333
| jwks_endpoint | Yes | Platform's jwks endpoint. Provided by the platform | |
3434
| jwks_algorithms | No | List of supported signature methods | `["RS256"]` |

‎examples/jupyterhub_config_lti13.py

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,11 @@
3333
os.getenv("LTI13_AUTHORIZE_URL")
3434
or "https://canvas.instructure.com/api/lti/authorize_redirect"
3535
)
36-
c.LTI13Authenticator.client_id = os.getenv("LTI13_OAUTH_CLIENT_ID") or {""}
36+
# The client ids are comma separated
37+
if client_id := os.getenv("LTI13_OAUTH_CLIENT_ID"):
38+
c.LTI13Authenticator.client_id = client_id.split(",")
39+
else:
40+
c.LTI13Authenticator.client_id = {""}
3741
c.LTI13Authenticator.jwks_endpoint = (
3842
os.getenv("LTI13_JWKS_ENDPOINT")
3943
or "https://canvas.instructure.com/api/lti/security/jwks"

0 commit comments

Comments
 (0)