LTI 1.3 and content migrations support

[matt31]

I am trying to get content migrations support working with an LTI 1.3 tool using the instructions here:

https://canvas.instructure.com/doc/api/file.tools_xml.html

I can specify the callback URLs in the tool json like this:

"settings": {
  "content_migration": {
    "export_start_url": "https://helloworld.example.com/api/ims_exports",
    "import_start_url": "https://helloworld.example.com/api/ims_imports"
  }
}

The URLs do get called on import/export, but I can't authenticate the messages coming from Canvas.

According to the docs:

For authentication a JWT will be included in the Authorization header using the Bearer scheme, it is signed using the shared secret for the tool and will include the stored consumer key in the kid field of the token's header object.

For an LTI 1.3 tool, there is no shared secret.  I'm actually seeing kid 'fake' and secret 'fake' in the bearer token when Canvas calls our URLs.  Is there a way to use this API with an LTI 1.3 tool and authenticate the calls made by Canvas?

[matthew_buckett]

Thanks for starting the discussion about this. We have a LTI 1.3 that would benefit from getting a callback when course content is copied and so I was excited to see this functionality and then sad when you say it doesn't work.

Is sort of makes sense that as there's no shared secret it can't use that to sign the request. It would be nice if Instructure could use the same key that signs the launch requests (eg https://canvas.instructure.com/api/lti/security/jwks ) to sign the content migration requests for LTI 1.3 tools.

[matt31]

I think signing the messages with the Canvas jwk would work, and that sounds like an easy change.