Hi all, I am developing an LTI Advantage tool and I am having difficulty figuring out what "issuers" are likely to need validating when I verify LTI requests?
Is the issuer always the same or does it vary depending on environment : TEST / PRODUCTION or hosting location : self hosted / cloud instance of Moodle?
I have developed the same tool for Blackboard and Canvas and they listed their LTI Issuers in their documentation, but I don't see these important items in your documentation.
For Blackboard it is always : "blackboard.com"
For Canvas they have 3 Issuers: "canvas.instructure.com", "canvas.test.instructure.com", "canvas.beta.instructure.com",
For Moodle I use this for testing : "sandbox.moodledemo.net"
Would any of these be used with Moodle : "moodle.com", "moodle.org", "MoodleCloud.com"
How would you be able to obtain these in advance of LTI Advantage requests being received. I understand that you should always validate the issuer as part of the JWT Verification.
Thanks in advance.
Richard Hetherington | Senior Web Developer
JS Group | Engagement House | Units 3 & 4 West Quay Trade Park | West Quay Road | Southampton |SO15 1GZ