Importing Common Cartridge w/ LTI Links never match existing External LTI Apps

[CreepyGnome]

I need to be able to import a thin common cartridge into the open source canvas and have all the LTI Links be matched with a global LTI external app I have already setup prior to importing any courses.

Currently, I have tried everything to get Canvas to match by changing the titles, domains, etc to be matching the incoming LTI data. Nothing works, and on importing of a common cartridge with LTI links Canvas creates new local external LTI apps that require editing to add the key and secret.

This is a horrible user experience. I want to setup the external LTI apps once globally for all courses and then have the import process for a common cartridge match the LTI resources with the proper LTI external app in canvas.

Please let me know how to do this if I am doing something wrong otherwise I am requesting this be fixed to do this.

[ninashowell]

Did you find a way around this issue? We're experiencing the same thing at our institution and I'm curious what your solution was.

[CreepyGnome]

The only way around it is if you add Canvas specific XML and then it will work, however doing this makes it no longer a pure common cartridge, and cannot be expected from all sources.

So while we have moved on from this issue, the issue is still valid in Canvas.

[spencerolson]

Hi @CreepyGnome and @ninashowell , I have contacted the team that handles Common Cartridge, and they suggested the following steps:

• Use the external_tools API to compare your course-level install against your account-level install. The best way to check would be to install the account-level tool, then check the tool config via API (https://canvas.instructure.com/doc/api/external_tools.html#method.external_tools.show). Then import the package and check the course-level tool config. They should have a matching privacy_level. All settings should match except custom_fields and vendor_extensions.

• If there are any differences noted in the step above, make changes so that the two match. There was code deployed that should make things work if the fields mentioned above match. That code can be found here: https://github.com/instructure/canvas-lms/blob/stable/app/models/importers/context_external_tool_importer.rb#L203-L217

Update: removed consumer_key and shared_secret above.

Thanks,
Spencer

[pfgray]

@spencerolson ,
The consumer_key and shared_secret won't ever match (if they did, this problem wouldn't exist), since Canvas automatically sets the consumer_key to the value: "fake" when it doesn't match a global tool. Further, the Canvas API (rightfully) doesn't report back the shared_secret so I can't check that even if I wanted to compare the two.

I set-up a tool globally as an admin via pasting xml configuration (with domain-level matching), with domain "mydomain.com".

Then, I imported a common cartridge file that had launch urls all to the same domain as the tool I set up. In the course I see that Canvas was able to correctly collapse all the configuration under one tool, and tells me to set up the one tool "mydomain.com" in the Course settings.

Here's the json for the globally configured tool via /api/v1/accounts/:acct_id/external_tools:

{
   "account_navigation":null,
   "assignment_menu":null,
   "assignment_selection":null,
   "collaboration":null,
   "consumer_key":"example-lti",
   "course_assignments_menu":null,
   "course_home_sub_navigation":null,
   "course_navigation":null,
   "course_settings_sub_navigation":null,
   "created_at":"2018-01-25T03:22:43Z",
   "custom_fields":{},
   "description":"Test Description",
   "discussion_topic_menu":null,
   "domain":"mydomain.com",
   "editor_button":null,
   "file_menu":null,
   "global_navigation":null,
   "homework_submission":null,
   "id":117499,
   "link_selection":null,
   "migration_selection":{
      "label":"LO Test #2",
      "message_type":"ContentItemSelectionRequest",
      "selection_height":400,
      "selection_width":800,
      "url":"https://mydomain.com/lti_new/curriculum/cc"
   },
   "module_menu":null,
   "name":"Test #2",
   "not_selectable":false,
   "post_grades":null,
   "privacy_level":"name_only",
   "quiz_menu":null,
   "resource_selection":null,
   "similarity_detection":null,
   "tool_configuration":null,
   "updated_at":"2018-01-25T03:22:43Z",
   "url":"https://mydomain.com/lti",
   "user_navigation":null,
   "vendor_help_link":null,
   "wiki_page_menu":null,
   "workflow_state":"name_only"
}

And here's the json for the collapsed tool that was created at the course level via the cc import via /api/v1/courses/:course_id/external_tools:

{  
   "account_navigation":null,
   "assignment_menu":null,
   "assignment_selection":null,
   "collaboration":null,
   "consumer_key":"fake",
   "course_assignments_menu":null,
   "course_home_sub_navigation":null,
   "course_navigation":null,
   "course_settings_sub_navigation":null,
   "created_at":"2018-01-25T01:38:18Z",
   "custom_fields":{},
   "description":"A combined configuration for all tools with the domain: mydomain.com",
   "discussion_topic_menu":null,
   "domain":"mydomain.com",
   "editor_button":null,
   "file_menu":null,
   "global_navigation":null,
   "homework_submission":null,
   "id":117496,
   "link_selection":null,
   "migration_selection":null,
   "module_menu":null,
   "name":"mydomain.com",
   "not_selectable":false,
   "post_grades":null,
   "privacy_level":"name_only",
   "quiz_menu":null,
   "resource_selection":null,
   "similarity_detection":null,
   "tool_configuration":null,
   "updated_at":"2018-01-25T01:38:18Z",
   "url":null,
   "user_navigation":null,
   "vendor_help_link":null,
   "wiki_page_menu":null,
   "workflow_state":"name_only"
}

The only differences I see are ones that make sense (the global config has migration_selection configured).

Curiously, when I try to import the same exact cc import via Content-item message, no collapsing occurs, and I need to configure each "tool" separately.

this file looks particularly relevant, maybe someone more verse in Ruby would be able to glean something from that? :P

[spencerolson]

Hi @pfgray , I apologize, I was indeed wrong when I said consumer_key and shared_secret needed to match. I've shown your example above to the owning team, and it looks like 2 attributes need to be aligned to create a match:

1. migration_selection This should be updated to match, either by removing it from the account-level, or incorporating it into the Common Cartridge.

2. url This should be updated to match, either by adding a URL to the Common Cartridge or removing it from the account-level tool install.

Please let me know if you have any issues.

Thanks,
Spencer

[pfgray]

@spencerolson,
Thanks so much for your help! I have it half-working now...

I also needed to make the name, and description the same. Edit, this is wrong... only the urls need to match.

Also, if the url is required to match, I'm not sure what purpose Canvas' "domain" extension serves, since if the urls match, won't the domains always implicitly match?

Another issue I've run into is that while I've gotten the manual Common Cartridge import to work as stated above, when I try to import the same exact Common Cartridge file via Content-Item (migration_selection), Canvas still doesn't match existing tool configurations (even when they have the same url/name/description).

[pfgray]

Okay, some of my assertions were mistaken... I can have 'N' number of tools with different names, but they must have the same url as the global tool if they are to be matched. Even if they have the same domain as the global tool, they won't be.

Here's where I believe I might be experiencing some inconsistency:

Global

name         url                       domain
Test App     http://mydomain.com/lti   mydomain.com

Common Cartridge File:

name         url                       domain
Reading #1  http://mydomain.com/lti   mydomain.com
Quiz    #1  http://mydomain.com/lti   mydomain.com
Reading #2  http://mydomain.com/lti   mydomain.com
Quiz    #2  http://mydomain.com/lti   mydomain.com

All four links are matched to the Global LTI configuration, and everything works swimmingly.

However, if I have the following configuration:

Global

name         url                        domain
Test App     http://mydomain.com/lti    mydomain.com

Common Cartridge File:

name         url                        domain
Reading #1  http://mydomain.com/lti/1   mydomain.com
Quiz    #1  http://mydomain.com/lti/2   mydomain.com
Reading #2  http://mydomain.com/lti/3   mydomain.com
Quiz    #2  http://mydomain.com/lti/4   mydomain.com

The four links in the CC file are not matched to the global LTI link, but they are merged into one configuration, with Canvas prompting me with:

The security parameters for the external tool "mydomain.com" need to be set in Course Settings."

So, I'm confused as to why the four links in the CC file can be matched together based solely on the "domain" field, but not matched to the Global LTI link, whose domain is also "mydomain.com"

Am I doing something wrong?

Edit: fixed titles of activities

[spencerolson]

Hi @pfgray , thanks for the detailed info. I'll reach out to the owning team and get back to you (sorry for being the messenger here and not being able to help you directly; this area of the codebase is not in my wheelhouse).

[pfgray]

@spencerolson, no problem, thanks for your help thus far!
I'll just add some more details for completeness:

When I try to use the same configurations as above, but via Content Item Message (migration_selection), I get different results:

Global

name         url                       domain
Test App     http://mydomain.com/lti   mydomain.com

Common Cartridge File (via Content-item):

name         url                       domain
Reading #1  http://mydomain.com/lti   mydomain.com
Quiz    #1  http://mydomain.com/lti   mydomain.com
Reading #2  http://mydomain.com/lti   mydomain.com
Quiz    #2  http://mydomain.com/lti   mydomain.com

The four links in the CC file are not matched to the global LTI link, but they are merged into one configuration, with Canvas prompting me with:

The security parameters for the external tool "mydomain.com" need to be set in Course Settings."

However, if I have non matching urls again:

Global

name         url                        domain
Test App     http://mydomain.com/lti    mydomain.com

Common Cartridge File (via Content-Item):

name         url                        domain
Reading #1  http://mydomain.com/lti/1   mydomain.com
Quiz    #1  http://mydomain.com/lti/2   mydomain.com
Reading #2  http://mydomain.com/lti/3   mydomain.com
Quiz    #2  http://mydomain.com/lti/4   mydomain.com

The four links in the CC file are not matched to the global LTI link, and they are not merged into one configuration.

Canvas prompts me with "4 issues":

The security parameters for the external tool "Reading # 1" need to be set in Course Settings."
The security parameters for the external tool "Quiz # 1" need to be set in Course Settings."
The security parameters for the external tool "Reading # 2" need to be set in Course Settings."
The security parameters for the external tool "Quiz # 2" need to be set in Course Settings."

I think there might be some matching logic applied to manual Common Cartridge imports, that is not being applied Common Cartridge imports via Content-Item Message.

Hopefully these details will help someone along the line :D

[spencerolson]

Hi @pfgray , it looks like the team needs to do some more research into this. I've created a research ticket on our side for the team, and added a note on that ticket to comment back here in this thread with their findings.

[SteelWagstaff]

@spencerolson We are experiencing the same issue described by @pfgray in #1087 (comment) with our LTI provider tool and Thin Common Cartridge files uploaded to Canvas. Do you have any additional information to share about suggestions for resolving this?

[SteelWagstaff]

The primary problem in our case is the creation of an unnecessary and duplicative 'unconfigured' Canvas app in the course upon uploading of the Thin Common Cartridge file. The globally configured app 'works' but is being overridden by the newly created app with 'fake' key and no secret, launch URL, etc.

'Global' app configuration:

Post import 'issue' message:

Newly created app configuration:

If I manually enter the key, secret, launch URL into this new app, the LTI links work. They also work if I simply delete the newly created course-level app. We don't understand why this new app is being created when a global app already exists to handle these links. This appears to be a relatively new issue for us, as we've had several users working with our LTI provider app in Canvas for several months without issues.

[spencerolson]

Hi @SteelWagstaff apologies on never getting back to you folks on this one. I've poked the owning team and I'll see if we can get some updates here. Thanks.

[SteelWagstaff]

@spencerolson We heard back from Dan Nevarez who wrote: "It appears there are some differences between the way the account level tool is configured and the tool being imported. Canvas attempts to match these up, but if they aren't exactly the same it may not be able to, resulting in the course level duplicate you're seeing. The configuration of the tool inside the Thin Common Cartridge does not have a launch url, while the configuration for the account level tool already installed does. So for this specific instance, we recommend removing the launch URL from the account level tool's configuration, which will correct this behavior."

We did this, and it worked. We're going to instruct our users to leave the launch URL blank when configuring the LTI tool for global use in Canvas and to simply enter a value for the domain field unless instructed otherwise, as that seems to be working.

[jeffbaier]

@spencerolson This still seems to be an issue and is causing quite a few headaches for us. Any follow up from the dev team?

[spencerolson]

@jeffbaier thanks for following up and apologies for how drawn-out this has been. I'll get a response from the dev team here shortly.

[cmfurse]

Without your CC package and rails console it is a little difficult to see what is happening in your specific case. My suggestion would be to debug the code found here:

https://github.com/instructure/canvas-lms/blob/stable/app/models/importers/context_external_tool_importer.rb#L204-L220

...when doing an import with your package. We believe this method is most likely returning false when trying to find a matching tool.

[jaydudhatra1997]

@jeffbaier @cmfurse @spencerolson @SteelWagstaff
I had the same issue. Canvas is creating a tool for each lti link in the thin common cartridge package.
I have analyzed the package and come to know that if LTI reference file contains "blti:extensions" then canvas is creating tool for each items.

I have added sample packages for testing.
https://drive.google.com/drive/folders/1HhnkxiwFNM3dGBvSrzCYj9VzDKgp-G45

Package WITH extensions:
-> Canvas will create external tool for each link in the package.
Package WITHOUT extensions:
-> Canvas will create ONE generic tool with domain.

How to analyze package? (For non-technical users)

1. Change extension of package to ".zip".
2. Extract the package.
3. Open imsmanifest.xml. Check identifierref field for LTI link and search for {{identifierref}}.xml
4. Check all the information given in the file.

[weberswords]

We're seeing this as well.

So for this specific instance, we recommend removing the launch URL from the account level tool's configuration, which will correct this behavior."

Configuration requires either domain or launch url. I tried using the domain that shows in the import generated app and the import still generates a new app.

Documentation around how the matching works or even pointing to where in the repo this matching is done would be helpful so we could build our tool to handle the situation and reduce the frustration on the customer side. Is there any further information we can get on this so we can improve the overall experience?