OIDC Initiation#

LTI launches use the OIDC third-party initiation flow as a security measure to prevent CSRF attacks. As a part of this workflow, an LTI tool must:

  1. Receive an initiation request from a registered platform.

  2. Respond with a properly formed authentication request.

Handling an initiation request#

To handle an initiation request from an LTI platform, django-lti provides OIDCLoginInitView, which can be used as-is in a Django project to return an authentication request to the platform

# ...
from lti_tool.views import OIDCLoginInitView

urlpatterns = [
    path("init/<uuid:registration_uuid/", OIDCLoginInitView.as_view(), name="init"),
    # ...
]

The registration_uuid parameter is a reference to the LtiRegistration.uuid property, and is used to identify the platform registration associated with the initiation request.

Customizing language for blocked cookies#

When the user’s browser prevents embedded content from setting cookies within an iframe, the module displays a message about it and a link to open the content in a new tab or window. The language of the message and link may be customized using optional message arguments to OIDCLoginInitView.as_view()…

# ...
from lti_tool.views import OIDCLoginInitView

urlpatterns = [
    path("init/<uuid:registration_uuid/", OIDCLoginInitView.as_view(
        main_msg=(
            "Your browser prevents embedded content from using cookies.  To work "
            "around this, the content must be opened in a new tab or window.  "
        ),
        click_msg="Open a new tab or window now.",
        loading_msg="Loading..."
    ), name="init"),
    # ...
]

The main_msg, click_msg, and loading_msg optional arguments are passed to DjangoOIDCLogin.enable_check_cookies() to generate messages shown in the UI. The values shown here are the default values used by OIDCLoginInitView. If cookies are not allowed by the browser, the value of main_msg will be shown. That will be followed by a link with label containing the value of click_msg, which opens the content in a new tab or window.

Customizing the authentication request#

By default, the response from OIDCLoginInitView will use the target_link_uri from the request as the redirect_uri. If the application requires the use of a different redirect_uri it can be provided by overriding the get_redirect_url() method.

class CustomLoginInitView(OIDCLoginInitView):
    def get_redirect_url(self, target_link_uri):
        return "https://my.tool/some/custom/path/"

Resources#