LTI 1.3 Launch Fails When Using Reusable Configuration (Turnitin Integration)

[meet0208]

Hi,

Description:
I am facing an issue with an LTI 1.3 launch to Turnitin after enabling Reusable Configuration in the Open edX LTI Store.

When launching without reusable configuration, the LTI launch works fine.
However, after switching to reusable configuration, the launch fails with a Turnitin authorization error.

Working Launch URL

https://lti-sandbox.int.turnitin.com/oidc/login/8421cb71-d09a-449a-8389-05d068bb2d14?iss=https%3A%2F%2Fsandbox-ng.abzt.de&client_id=f6d41724-e279-4e87-9e97-982f5817a709&lti_deployment_id=1&target_link_uri=https%3A%2F%2Flti-sandbox.int.turnitin.com%2Flaunch%2Ftfs&login_hint=c124d806-32ce-4458-a0d8-12183053395c&lti_message_hint=3bee3b6de78ee3eaafbe461278ed9742

Failing Launch URL (Generated After Reusable Configuration)

https://lti-sandbox.int.turnitin.com/oidc/login/8421cb71-d09a-449a-8389-05d068bb2d14?iss=https%3A%2F%2Fsandbox-ng.abzt.de&client_id=f6d41724-e279-4e87-9e97-982f5817a709&lti_deployment_id=1&target_link_uri=https%3A%2F%2Flti-sandbox.int.turnitin.com%2Flaunch%2Ftfs&login_hint=c124d806-32ce-4458-a0d8-12183053395c&lti_message_hint=7fb4dd2462bbaa828236d3b70f88980a

Error Message

Reference ID: 112be23c-1d33-47a5-9c40-304b4f9493a7
Unable to authorize launch
Internal signing validation error.
If this error continues, please contact your administrator or Turnitin support.

Observations

• The only difference between both URLs is the lti_message_hint value.

• LMS logs show a valid JWKS response:

  GET /api/lti_consumer/v1/public_keysets/42673c39-f783-4822-a927-909d1ee55a03 200
  

  → So JWKS and key discovery are functioning properly.

• The issue occurs only after enabling LTI Store Reusable Configuration.

• Turnitin seems to reject or fail to validate the lti_message_hint generated in this context.

Expected Behavior

LTI launch to Turnitin should succeed even when using the reusable configuration in the LTI Store.

Questions for the community

1. Is there any known issue with lti_message_hint generation in reusable configurations?
2. Does the LTI Store modify or re-generate lti_message_hint between launches?
3. Has anyone successfully integrated Turnitin LTI 1.3 using reusable configuration on Teak?
4. Could Turnitin be rejecting hints that differ in length or encoding?

Logs

2025-11-11 17:17:53,181 INFO 26 [eventtracking.backends.async_routing] [user None] [ip 52.29.246.76]
async_routing.py:41 - [EventEmissionExit] skipping event /api/lti_consumer/v1/public_keysets/42673c39-f783-4822-a927-909d1ee55a03
2025-11-11 17:17:53,182 INFO 26 [tracking] [user None] [ip 52.29.246.76]
{"name": "/api/lti_consumer/v1/public_keysets/42673c39-f783-4822-a927-909d1ee55a03", ... "HTTP/1.1 200"}

---