Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-74303

Launches fail if platforms omit 'alg' in JWKS

XMLWordPrintable

    • MOODLE_400_STABLE
    • MOODLE_400_STABLE
    • MDL-74303-master
    • Hide

      Force the inclusion of 'alg' in the platform JWK, where possible.

      Show
      Force the inclusion of 'alg' in the platform JWK, where possible.
    • Hide

      Prerequisites

      Two sites are required for testing this feature and they must be able to communicate with one another. You'll also need to be able to change files on the platform site, to simulate the kind of JWKS we're aiming to target with the patch here.

      1. LTI platform (formerly known as consumer)
      2. LTI tool (formerly known as provider).
        Important: If you're testing locally, you'll need to disable the 'Blocked hosts' setting in BOTH sites. You can find it in Site administration ► Security ► HTTP security. You'll need to clear the values and save.
      3. In the tool site, create a course with:
        • One assignment
        • One file resource
      4. Enrol a teacher t1 in the course
      5. In the platform site, create a course
      6. Enrol two teachers: t1 and t2
      7. Enrol one student, s1

      Enable the 'Publish as LTI tool' feature in the 'tool' site

      1. Log in to the tool site as an administrator.
      2. Follow Site administration ► Security ► HTTP security and enable 'Allow frame embedding'.
      3. Follow Site administration ► Plugins ► Authentication ► Manage authentication' and enable the 'LTI' authentication plugin.
      4. Follow Site administration ► Plugins ► Enrolments ► Manage enrol plugins and enable 'Publish as LTI tool'.

      Register the tool and platform

      1. Log in to the tool site as an admin user
      2. Follow Site administration ► Plugins ► Enrolments ► Publish as LTI tool ► Tool registration
      3. Click "Register a platform"
      4. Enter "Moodle LMS" when prompted for a name and click "Continue"
      5. When you see the tool details on the next screen, copy the registration URL to clipboard using the icon next to the URL
      6. Now, in a separate browser tab, log in to the platform site as an administrator
      7. Follow Site administration ► Plugins ► Activity modules ► External tool ► Manage tools
      8. Paste the registration URL into the "Tool URL..." field and press "Add LTI Advantage"
      9. When the page reloads and you see the tool card in the list of tools, click to edit the settings of the tool
      10. Make sure the following are set:
        1. Set "Tool configuration usage" to "Show in activity chooser and as a preconfigured tool"
        2. Expand "Privacy" and set "Share launcher's name with tool" to "Delegate to teacher"
        3. Again in "Privacy", set "Share launcher's email with tool" to "Delegate to teacher"
      11. Set the name of the tool to "QA test tool" and save the tool configuration
      12. Click "Activate" on the tool card.

      Publish a course, activity and resource on the tool site

      1. Log in to the tool site as the teacher t1
      2. Visit the course
      3. Follow Course administration ► Published as LTI tools
      4. Make sure you're on the LTI Advantage tab
      5. Add a new instance, setting 'Tool to be published' to the course.
      6. Add a new instance, setting 'Tool to be published' to the assignment
      7. Add a new instance, setting 'Tool to be published' selected to the file resource.
      8. Verify you now have 3 published items
      9. Log out of the tool site now.

      On the platform site

      1. Log in as teacher t1 and visit the course.
      2. Click to add an activity or resource
      3. Select "QA test tool" from the activity chooser
      4. On the activity edit view, click "Select content"
      5. Verify you see the list of published activities
      6. Now edit the method mod/lti/classes/local/ltiopenid/jwks_helper::get_jwks(), setting the line as follows (commented out): 

        //$jwk['alg'] = 'RS256';

      7. Save the file.
      8. Click 'Select content' again.
      9. Verify you can see the list of published activities.
      10. Now edit the method get_jwks() again, setting the line as follows: 

         $jwk['alg'] = 'RS512';

      11. Save the file.
      12. Click 'Select content' again.
      13. Verify you now see an error - "Incorrect key for this algorithm"
      14. Now edit the method get_jwks() again, setting the two lines as follows: 

        $jwk['kty'] = 'EC';
        		 
        //$jwk['alg'] = 'RS512';

      15. Save the file.
      16. Click 'Select content' again.
      17. Verify you now see an error - "Alg specified in the JWT header is incompatible with the JWK key type"
      After the test
      1. Make sure to revert your changes. 

        git reset --hard origin/master

      Show
      Prerequisites Two sites are required for testing this feature and they must be able to communicate with one another. You'll also need to be able to change files on the platform site, to simulate the kind of JWKS we're aiming to target with the patch here. LTI platform (formerly known as consumer) LTI tool (formerly known as provider). Important : If you're testing locally, you'll need to disable the 'Blocked hosts' setting in BOTH sites. You can find it in Site administration ► Security ► HTTP security. You'll need to clear the values and save. In the tool site, create a course with: One assignment One file resource Enrol a teacher t1 in the course In the platform site, create a course Enrol two teachers: t1 and t2 Enrol one student, s1 Enable the 'Publish as LTI tool' feature in the 'tool' site Log in to the tool site as an administrator. Follow Site administration ► Security ► HTTP security and enable 'Allow frame embedding'. Follow Site administration ► Plugins ► Authentication ► Manage authentication' and enable the 'LTI' authentication plugin. Follow Site administration ► Plugins ► Enrolments ► Manage enrol plugins and enable 'Publish as LTI tool'. Register the tool and platform Log in to the tool site as an admin user Follow Site administration ► Plugins ► Enrolments ► Publish as LTI tool ► Tool registration Click "Register a platform" Enter "Moodle LMS" when prompted for a name and click "Continue" When you see the tool details on the next screen, copy the registration URL to clipboard using the icon next to the URL Now, in a separate browser tab, log in to the platform site as an administrator Follow Site administration ► Plugins ► Activity modules ► External tool ► Manage tools Paste the registration URL into the "Tool URL..." field and press "Add LTI Advantage" When the page reloads and you see the tool card in the list of tools, click to edit the settings of the tool Make sure the following are set: Set "Tool configuration usage" to "Show in activity chooser and as a preconfigured tool" Expand "Privacy" and set "Share launcher's name with tool" to "Delegate to teacher" Again in "Privacy", set "Share launcher's email with tool" to "Delegate to teacher" Set the name of the tool to "QA test tool" and save the tool configuration Click "Activate" on the tool card. Publish a course, activity and resource on the tool site Log in to the tool site as the teacher t1 Visit the course Follow Course administration ► Published as LTI tools Make sure you're on the LTI Advantage tab Add a new instance, setting 'Tool to be published' to the course. Add a new instance, setting 'Tool to be published' to the assignment Add a new instance, setting 'Tool to be published' selected to the file resource. Verify you now have 3 published items Log out of the tool site now. On the platform site Log in as teacher t1 and visit the course. Click to add an activity or resource Select "QA test tool" from the activity chooser On the activity edit view, click "Select content" Verify you see the list of published activities Now edit the method mod/lti/classes/local/ltiopenid/jwks_helper::get_jwks(), setting the line as follows (commented out): //$jwk['alg'] = 'RS256'; Save the file. Click 'Select content' again. Verify you can see the list of published activities. Now edit the method get_jwks() again, setting the line as follows: $jwk[ 'alg' ] = 'RS512' ; Save the file. Click 'Select content' again. Verify you now see an error - "Incorrect key for this algorithm" Now edit the method get_jwks() again, setting the two lines as follows: $jwk[ 'kty' ] = 'EC' ; //$jwk['alg'] = 'RS512'; Save the file. Click 'Select content' again. Verify you now see an error - "Alg specified in the JWT header is incompatible with the JWK key type" After the test Make sure to revert your changes. git reset --hard origin/master
    • 3
    • QA time 2

      This is an optional value in the keyset (as per the JWK spec - https://datatracker.ietf.org/doc/html/rfc7517#section-4.4) but firebase/php-jwt (specifically v6.0, which we recently upgraded to) demands this is set (https://github.com/firebase/php-jwt/blob/main/src/JWK.php#L85-L89).

      This prevents the correct public key retrieval during launches from platforms - like D2L for example - which omit the alg value in their JWKS JSON.

      This kind of dependency on alg has also come up elsewhere - https://github.com/BookStackApp/BookStack/issues/3206. See also the "Similar cases" reported in that issue, which refers to other projects.

      We need to solve this in a similar way, perhaps falling back to RS256 in cases where alg isn't present.

      To replicate:

      1. Perform the platform registration steps described above in the testing instructions.
      2. Publish a resource in the tool site, so it'll be available via deep linking
      3. Modify the platform's JWKS - in Moodle this is in mod/lti/classes/local/ltiopenid/jwks_helper::get_jwks(). Comment out the line: 

        $jwks['alg'] = 'RS256'

      4. In the platform, try to launch a deep linking request (see testing instructions, this is the "select content" button)
      5. Notice the error stating that it was unable to find the public key.

        1. Step No. 5_Screenshot.PNG
          24 kB
          Gladys Basiana
        2. Step No. 9_Screenshot.PNG
          24 kB
          Gladys Basiana
        3. Step No. 13_Screenshot.PNG
          36 kB
          Gladys Basiana
        4. Step No. 17_Screenshot.PNG
          39 kB
          Gladys Basiana

            jaked Jake Dallimore
            jaked Jake Dallimore
            Andrew Lyons Andrew Lyons
            Jun Pataleta Jun Pataleta
            Gladys Basiana Gladys Basiana
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved:

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 6 hours, 10 minutes
                6h 10m

                  Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.