LTI 1.3 | JWT Error

[KylanJohnson]

I am trying to add an assignment and submit as an external tool. I have selected the content from the tool, and when I am trying to deeplink, it throws an error, saying 

{"errors":{"jwt":[{"attribute":"jwt","type":"JSON::JWK::Set::KidNotFound","message":"JSON::JWK::Set::KidNotFound"},{"attribute":"jwt","type":"JWT verification failure","message":"JWT verification failure"}]}}

So I tried using JWK instead of Url.

{"keys":[{"kty":"RSA","alg":"RS256","use":"sig","e":"AQAB","n":"0Ll6DEpUsvmlHTlKZD_IozrQfRvM3RFoncjMUjxTOsFDI7t2Qx_TrGzqwR3tjfNcbyym5v9SmSbg4-EQ1hr-cSY_NL6bIT8QT-tb4D-ybj7CYJK7JAfaSX3I5kTuhQcKy2pxVtVuXOrm8VZR7ehtqsZH9tvuEXsgjh2IW0GL3MJ0yfhscd_MDu0BbqGxXaaA_Fs2CGMakWLrhLbK6vnxEOwgz1Vf--cA5YN1-qOgMqRMvTfuQIv1qTSTvXZmfRk790zACHOVMjftao2TRxN2PqF9TshRqqGjzQYo1VmDhcDxBKC1iXkjDowk-V7tBmjfIYxs7jDjABmTbzY0ZRxXGw","kid":"b03a385e7a13e4d1aaa1edf86c9fae047b91ec399a1887862e303e47163d651d"}]}

when I try to add this, I am getting an error there as well.  

I have attached the screenshot of the error which reads "Type error: Cannot destructure property 'developer_key' of 'e' as it is undefined. %"

[svickers2]

It looks like you are getting a "KidNotFound" error.  Have you checked that your public key endpoint is accessible by Canvas and that its response includes a public key with the same kid value as used in the JWT you sent?

[KylanJohnson]

My public key url is accessible, the output is 

{"keys":[{"kty":"RSA","alg":"RS256","use":"sig","e":"AQAB","n":"0Ll6DEpUsvmlHTlKZD_IozrQfRvM3RFoncjMUjxTOsFDI7t2Qx_TrGzqwR3tjfNcbyym5v9SmSbg4-EQ1hr-cSY_NL6bIT8QT-tb4D-ybj7CYJK7JAfaSX3I5kTuhQcKy2pxVtVuXOrm8VZR7ehtqsZH9tvuEXsgjh2IW0GL3MJ0yfhscd_MDu0BbqGxXaaA_Fs2CGMakWLrhLbK6vnxEOwgz1Vf--cA5YN1-qOgMqRMvTfuQIv1qTSTvXZmfRk790zACHOVMjftao2TRxN2PqF9TshRqqGjzQYo1VmDhcDxBKC1iXkjDowk-V7tBmjfIYxs7jDjABmTbzY0ZRxXGw","kid":"b03a385e7a13e4d1aaa1edf86c9fae047b91ec399a1887862e303e47163d651d"}]}

The kid b03a385e7a13e4d1aaa1edf86c9fae047b91ec399a1887862e303e47163d651d is the same in the JWT which I sent.

The url is : https://psc28113.illuminateed.io/qa28113/ltiadvantage/keyset/?p_name=canvas

[CelsoBarboza]

Have you got any solution here? I've got the same issue!

[SomDaveYoung]

Having this issue as well - KID is absolutely in the header of the JWT and is the correct value.

[SomDaveYoung · Accepted solution]

So, you're using an array of keys here rather than a single key. If you use this it'll accept the input:

{"kty":"RSA","alg":"RS256","use":"sig","e":"AQAB","n":"0Ll6DEpUsvmlHTlKZD_IozrQfRvM3RFoncjMUjxTOsFDI7t2Qx_TrGzqwR3tjfNcbyym5v9SmSbg4-EQ1hr-cSY_NL6bIT8QT-tb4D-ybj7CYJK7JAfaSX3I5kTuhQcKy2pxVtVuXOrm8VZR7ehtqsZH9tvuEXsgjh2IW0GL3MJ0yfhscd_MDu0BbqGxXaaA_Fs2CGMakWLrhLbK6vnxEOwgz1Vf--cA5YN1-qOgMqRMvTfuQIv1qTSTvXZmfRk790zACHOVMjftao2TRxN2PqF9TshRqqGjzQYo1VmDhcDxBKC1iXkjDowk-V7tBmjfIYxs7jDjABmTbzY0ZRxXGw","kid":"b03a385e7a13e4d1aaa1edf86c9fae047b91ec399a1887862e303e47163d651d"}

One interesting thing here though is that after you enter the JWKS and save, the next time you edit the developer key it will revert to Public JWK. 

[eraymond]

If the JWK is served by  URL, the content type needs to be application/json and response JWT needs to have `kid` in the header (which does not seem to be needed if the JWK is embedded in the developer key).