LTI authenication time_leeway is ignored

JupyterHub Zero to JupyterHub on Kubernetes
1

I am currently trying to install zero to jupyterHub on our k3s kubernetes cluster using helm.

Moreover, I am trying to connect it to moodle using LTI1.3. It seems, however, there is a second of desync between the LTI Server and the jupyterhub. When trying to log in using LTI, I get the error

400 : Bad Request The token is not yet valid (iat)

As such, I tried to adjust the configuration `time_leeway` for the LTIAuthenticator. Unfortunately, it does not seem to matter which value I input, the error remains. Any pointer what I am missing maybe?

My helm configuration for the lti authenticator looks like this:

hub:
  config:
    JupyterHub:
      authenticator_class: ltiauthenticator.lti13.auth.LTI13Authenticator
    # LTI13 Authenticator reference: https://ltiauthenticator.readthedocs.io/en/latest/lti13/getting-started.html
    LTI13Authenticator:
      issuer: *redacted*
      authorize_url: *redacted*
      jwks_endpoint: *redacted*
      client_id: [*redacted*]
      allow_all: true
    LTI13LaunchValidator:
      time_leeway: 10000000000

I tried to use various values for time_leeway, and even something extreme like 10000000000, but the error remains. Did I use the configuration wrongly? Am I missing something else? I also spotted the same issue here: The token is not yet valid (iat) but they did not offer a solution.

Thanks for your help!

2

I think this is a bug, I’ve opened

3 Likes