OAuth error: Please check your key and secret

[ravikhetani]

Hi,

I'm trying to integrate marsha into OpenEdx, and am getting an authentication error - I've used the consumer key and secret provided in the Django interface, and can see on the request made to /lti/videos that the correct consumer key is being sent over. But I'm given no more information - how important is the the domain in consumer sites, does it need to be in a specific format? Any help would be much appreciated!

[kernicPanel]

Hi, the domain in consumer site should not contain the scheme.
ie: sandbox.moodledemo.net
Hope this helps.

[kernicPanel]

Please note that no slash should appear as well.

[ravikhetani]

Hi, thank you for the speedy response - That is what I have done - I'm sharing some urls and the keys/secrets here as this is only a test instance which I'm happy to tear down.

I'm running an OpenEdx installation, at urls https://edx.giu.h5s.org/ for the student learning portal, and https://studio.edx.giu.h5s.org/ for the course management portal ( this is what it does out of the box).

Please advice if you think I have misconfigured anything.

Having looked through the source code, it seems this message/screen is generated when their is an invalid oauth signature?

[kernicPanel]

I don't see anything wrong here…
Have you got some informations from marsha logs ?

[ravikhetani]

.

[ravikhetani]

All I'm getting the logs is the following:

OAuth error: Please check your key and secret HTTP POST /lti/videos/ 200 [0.02, 172.21.0.1:34104] HTTP GET /static/css/main.css 404 [0.01, 172.21.0.1:34104]

I'm currently running Marsha in development mode, so debug logs are turned on from what I understand. I'm not seeing anything else that could be useful.

Here is the result of introspecting the request via ngrok:

[ravikhetani]

I'm also running on the main branch, rather than a release if it helps.

[kernicPanel]

I suppose you're running marsha locally.
If so, could you try to run make logs at the root of the project while trying the LTI request through edx, please ?

[ravikhetani]

No, that's all the output I'm getting.

I'm currently trying to create a test launch request via postman using the credentials provided, to see whether this an issue with Edx generating an incorrect oauth signature - but would welcome any pointers.

[ravikhetani]

Marsha.postman_collection.json

I was able to recreate the issues in postman - I generated the oauth signature using a new lti passport I created with the following values:

consumer_key: SX056ULJA4NN15KZBRBJ
consumer_secret: +oO*CP-Xu@lApn6uO=FLA#5U8IQc^$wKx#*afp-A

The ngrok url specified in this collection is still active if you want to try it out for yourself - any suggestions? Is this possibly a recent breaking change?

[kernicPanel]

Sorry, for now I have no idea on what is happening…
I'll talk about your problem with the team, hopefully someone would have some clue.
But maybe you could set DJANGO_BYPASS_LTI_VERIFICATION=True in env.d/development just to test the behavior, and go further with your exploration ?

[ravikhetani]

No problem, I'll wait for you to get back to me, in the meanwhile I'll see if I can have a play around and try out a previous tagged release. I did originally have that turned on, and it was fine from the instructor side, I could upload videos etc. But from the student view, I got an error related to missing JWT keys, which obviously weren't there seeing as verification was being bypassed, but I guess something in Marsha did not like it. Again appreciate the speedy response, much appreciated!

[ravikhetani]

Hi, any update on this?