Issuer validation by Tools in the Ref. Imp.

Forum:

Learning Tools Interoperability Public Forum

Issuer validation by Tools in the Ref. Imp.

Submitted by geoff-va on Tue, 15-Sep-2020 15:27.

I see the following in the 1EdTech Security Spec:

5.1.3 Authentication Response Validation

Tools MUST validate the ID Token in the token response in the following manner:

The Tool MUST Validate the signature of the ID Token according to JSON Web Signature [RFC7515], Section 5.2 using the Public Key from the Platform;

The Issuer Identifier for the Platform MUST exactly match the value of the iss (Issuer) Claim (therefore the Tool MUST previously have been made aware of this identifier);
...

When we create a tool in the reference implementation, we never fill out any information for a platform issuer.

Is this actually being validated in the reference implementation, or somehow done implicitly?

Thanks!

The names 1EdTech^® and IMS Global Learning Consortium^®, the 1EdTech logos, Better Learning From Better Learning Technology^®, TrustEd Apps™, 1EdTech TrustEd Apps™, Learning Tools Interoperability^®, LTI^®, IMS LTI^®, IMS Learning Tools Interoperability^®, OneRoster^®, Caliper Analytics^®, Question & Test Interoperability (QTI)^®, QTI^®, Common Cartridge^®, Competencies and Academic Standards Exchange^®, CASE^®, Competencies and Academic Standards Exchange (CASE)^®, Accessible Portable Item Protocol (APIP)^®, AccessForAll^®, Badge Connect^®, Comprehensive Learner Record Standard™, and CLR Standard™ are trademarks of 1EdTech Consortium, Inc. in the United States and/or other countries. All other trademarks and registered trademarks are the properties of their respective owners.

For information on the 1EdTech trademark usage policy, see our trademark policy page.