instructure canvas real-time integration with sct...

Instructure Canvas real-time integration with SCT Banner

Instructure Canvas can leverage the real-time integration capabilities available in SCT Banner and the Luminis

integration product. This integration works via a JMS HTTPClient bridge configured within a Luminis Message

Broker IV installation.

Prerequisites:

1. Integration Technologies license with Luminis Message Broker (LMB)/Luminis Message Gateway (LMG)

(versions 4.0) installed and running.

2. Banner 8.x installed and running. Banner INTCOMP must be at 8.0.2 and requires a minimum of

GENERAL 8.1 and STUDENT 8.1.

3. Luminis Platform (4.x) is installed and running.

4. Real-time data synchronization (LDI Events) between Banner and Luminis via Integration Technologies

installed and running.

Installation of the Luminis packages are detailed in documents included with the product.

Familiarity with a cygwin/Linux/Solaris command line is preferred.

Configuring Luminis to Canvas Integration Summary

Table of Contents:

1. Determine what account on the Canvas server you are going to integrate with Banner and note the account

number.

2. Create a user within the Canvas server account being integrated with Banner. This user should have an

administrative role in the specific Canvas server account. A generic account should be created rather than using

a specific person's account.

3. Generate an ACCESS_TOKEN on the canvas server specific to the account that will be integrated.

4. Create an event exchange topic in the Luminis Message Broker (LMB) server. This will be used as a holding

area for live events going from Banner to Canvas. The topic that is needed is called com_sct_ldi_sis_LmsSync.

If the LMB server is integrated with another LMS, this may already exist.

5. Create a LMB user with password which will be used internally within the LMB/LMG server. After the user

is created, grant rights for it to consume messages in the LmsSync topic.

6. Create an event HTTPClient in the LMB server connected to the Canvas server. The HTTPClient configuration

bridges between the Luminis JMS system and an external HTTP client.

7. Obtain the Canvas server's public SSL Certificate and import into the $JAVA_HOME/lib/security/cacerts

certificate store. If necessary, import the full server certificate SSL chain and/or import the certificates in other

cacerts store files located on the server.

8. Ensure connectivity between the Luminis Message Broker and Canvas servers. The Luminis Message Broker

needs to be able to initiate a connection via SSL to the Canvas server, typically on port 443.

9. Create the queues in the LMB server used for grade exchange. These are used as a holding area for the grade

exchange between Canvas and Banner. The two that are needed are com_sct_ldi_sis_UpdateRequest queue and

com_sct_ldi_sis_UpdateReply queue. If another LMS is already configured for grade exchange, these names

should be modified to include canvas and a second instance of the LMG GradeAdapter should be configured.

10. Create a grade exchange HTTPClient in the LMB server.

11. Deploy the grade exchange application to an Apache Tomcat server in the environment (Luminis IV is

installed with a tomcat server, although a secondary one can be used).

12. Ensure connectivity between the grade exchange and Canvas servers. The Canvas server needs to be able to

initiate a connection to the tomcat server where the grade exchange application is installed via SSL, If the grade

exchange application is installed on the LMB server, communication would typically be on port 7678.

Appendix 1: canvas_mbldisetup script variables and detail

Appendix 2: SSL certificate discussion (2048 bit SSL certificate not supported by default)

Appendix 3: Miscellaneous hints and tips concerning LMB/LMG

1. Determine what account on the Canvas server you are going to integrate with Banner and note the account

number.

-- Example: 13

2. Create a user within the Canvas server account being integrated with Banner. This user should have an

administrative role in the specific Canvas server account. A generic account should be created rather than using

a specific person's account.

-- Example: [email protected]

3. Generate an ACCESS_TOKEN on the canvas server within a user account which has an admin role within

Canvas. Generate a new token by going to your profile settings (upper right corner of your Canvas session,

settings), scrolling to the bottom of the page and clicking the “+New Access Token”

-- Example: 1834~yrBwlKUXWtBmYtoynzei8RBs7LtBuXVb4RwJQ3zhSXdOaMoADtnetBNYS2UqBc6L

Sections 4-6, 9 and 10 can be automated by running a canvas_mbldisetup script that can be provided on the

Luminis Message Broker server.

4. Create an event exchange topic in the Luminis Message Broker (LMB) server. This will be used as a holding

area for live events going from Banner to Canvas. The topic that is needed is called com_sct_ldi_sis_LmsSync.

If the LMB server is integrated with another LMS, this may already exist.

The com_sct_ldi_sis_LmsSync topic receives live events from Banner via the Luminis Message Gateway event

application. This includes new person objects and related changes and enrollment events. Events are passed to

Canvas via the event HTTPClient we will configure in section six.

4a. Log into the Luminis management interface:

4b. Click on Destinations and the New Destination button. Put com_sct_ldi_sis_LmsSync as the Name, select

Topic as the type and click the Create button. If you have previously been integrated with another LMS, this

topic will already exist and can be used by all systems.

You should now see the LmsSync Topic in the Destinations page.

5. Create a LMB user with password which will be used internally within the LMB/LMG server. After the user

is created, grant rights for it to consume messages in the LmsSync topic.

5a. On the LMB server, open a terminal window (cygwin for windows).

Run the following command:

mbtool add user -id=<username> -desc=<description> -credential=<password>

<username> is the name of a user that will be created internally in the Luminis Message Broker. This can be

anything that is unique in the system.

-- Example: canvaslmb

<description> is a description assigned to the user

-- Example: Canvas_LMB_User

<password> is the password for the new LMB user.

-- Example: asofkljelisdlfileh

-- Example: mbtool add user -id=canvaslmb -desc=Canvas_LMB_User -credential=asofkljelisdlfileh

5b. Once the user is created, add rights to the LmsSync destination.

mbtool update destaccess -policy=allow -entity=user -id=<username> -access=consume

-dest=com_sct_ldi_sis_LmsSync -type=topic -op=add

<username> is the same one created above.

-- Example: mbtool update destaccess -policy=allow -entity=user -id=canvaslmb -access=consume

-dest=com_sct_ldi_sis_LmsSync -type=topic -op=add

5c. Verify that access has been properly added by checking in the Luminis management interface:

Log into the Luminis management interface and select Connection Access Policy

The <username> created above should be listed in the Normal column, Allow Users area. You may or may not

have other users listed in this area. If the user is not listed, type the <username> in the box next to the Add button

and then click the Add button.

Verify the LMB user you created is in the Allow Users box. From the front page, next select Destinations, select

the radio button next to the com_sct_ldi_sis_LmsSync topic and click the Edit Access button.

The <username> created above should be listed in the Consume column, Allow Users area. You may or may

not have other users listed in this area. If the user is not listed, type the <username> in the box next to the Add

button and then click the Add button.

6. Create an event HTTPClient in the Luminis Message Broker connected to the Canvas server.

The HTTPClient configuration bridges between Luminis JMS system and an external HTTP client.

Log into the LMB management interface and select Outgoing HTTP Clients.

Click on the New Client button.

The outgoing HTTP Client uses information from sections one thru five.

Name: The name of the HTTP Client within LMB.

-- Example: Canvas_Ldi_Event_Receiver

Enable: true

-- Set to true if this client is active.

Stop Delivery on Error: true

-- Set to true to ensure events queue from Banner if there is a communication error between the Luminis broker

and the canvas server. The easiest way to resume Canvas consumption of messages is to set Enable to false, save

and then reset Enable to true.

Consume From: com_sct_ldi_sis_LmsSync (Topic)

JMS Connection user Name: LMB user created in section five.


JMS Connection Password: LMB user password used in section five.


Verify Password:

JMS Message Selector: Leave blank

Durable: true

-- this will ensure that the connection persists and messages are saved to be consumed even if there is a

communication interruption

Post to HTTP(S) URL: This is the Canvas server URL with the following construction:

https://<canvasurl>/api/v1/accounts/<accountnumber>/sis_imports.json?access_token=<accesstoken>&import_

type=ims_xml&extension=xml

<canvasurl> is the URL of the Canvas Server being integrated with Banner.

-- Example: https://canvas.myschool.edu

<accountnumber> is the account number on the canvas server where you are setting the integration

-- Example: 13

<accesstoken> is an API key generated on the Canvas server by an institutional admin.

-- Example: A2IDLSRMFjileK87SREL32D9idkWI8ro

-- Example URL:

https://canvas.myschool.edu/api/v1/accounts/13/sis_imports.json?access_token=1834~yrBwlKUXWtBmYtoyn

zei8RBs7LtBuXVb4RwJQ3zhSXdOaMoADtnetBNYS2UqBc6L&import_type=ims_xml&extension=xml

Authorization User Name: A user on the Canvas server with Admin rights within the account being integrated.


Authorization Password: Canvas admin user password

-- Example: aoiIoiJuhJkUhU97s

Verify Password:

Click the Create button when all the information is filled in:

https://canvas.myschool.edu/

To modify any part of the HTTP Client configuration (changed password, URL, access_token, account number

etc.), select the radio button next to the HTTP Client and click the Modify button, update the information and click

the Modify button.

The event integration is now complete and events should flow from Banner to Canvas.

7. Obtain the Canvas server's public SSL Certificate and import into the $JAVA_HOME/lib/security/cacerts

certificate store. If necessary, import the full server certificate SSL chain and import the certificates in multiple

cacerts store files.

7a. At times, there may be a certificate communication error between the LMB server and the Canvas server when

originally configuring the integration. If this happens you will see errors similar to the following in the

$SCT_LMB_HOME\logs\datapipeline-audit.log log file:

---------------

2011-04-18 14:08:34,563/MessageBrokerApplication.dp-service: Message delivery started for client: http$canvas

2011-04-18 14:10:45,016/MessageBrokerApplication.http$canvas-adapter: javax.net.ssl.SSLException: untrusted server cert chain

2011-04-18 14:10:45,016/MessageBrokerApplication.dp-service: http$canvas adapter requesting delivery halt.

2011-04-18 14:10:45,016/MessageBrokerApplication.dp-service: Stopping message delivery to client: http$canvas

2011-04-18 14:10:46,298/MbTool.dp-service: Shutting down service.

---------------

To resolve this, the Canvas server's SSL certificate must be imported into the Java certificate store file. Different

parts of Luminis can potentially utilize different java installations, possibly requiring the certificate to be

imported into multiple locations.

7b. Obtain the Canvas server SSL certificate.

On the LMB server in a terminal window issue the following command:

openssl s_client -showcerts -connect canvas.myschool.edu:443 >canvas.crt

where canvas.myschool.edu:443 is the URL of the Canvas server.

This is creating an SSL connection to the Canvas server and requesting the certificate which is redirected to the

text file canvas.crt in your current directory. You may have to press control-c to break the connection after a few

seconds.

7c. The canvas.crt file may contain several certificates starting with a "-----BEGIN CERTIFICATE-----" line and

ending with an -----END CERTIFICATE----- line. This is the full certificate chain of the server certificate.

When importing a certificate into a java certificate store, only the top certificate in the file will be imported. Edit

the canvas.crt file and remove any text before the first Begin Certificate line and after the first End Certificate line.

Example initial results followed by the edit results:

-------------------

CONNECTED(00000003)

---

Certificate chain

0 s:/C=US/ST=Utah/L=Salt Lake City/O=My School /OU=IT/CN=canvas.myschool.edu

i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3

-----BEGIN CERTIFICATE-----

MIIGZjCCBU6gAwIBAgIQCJv2Pho1TvS30j6MJSX6mTANBgkqhkiG9w0BAQUFADBm

MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3

d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5j

ZSBDQS0zMB4XDTA5MDMwMzAwMDAwMFoXDTEyMDUwNTIzNTk1OVowgYsxCzAJBgNV

BAYTAlVTMQ0wCwYDVQQIEwRVdGFoMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEf

MB0GA1UEChMWVXRhaCBFZHVjYXRpb24gTmV0d29yazEfMB0GA1UECxMWVXRhaCBF

ZHVjYXRpb24gTmV0d29yazESMBAGA1UEAxQJKi51ZW4ub3JnMIGfMA0GCSqGSIb3

DQEBAQUAA4GNADCBiQKBgQCysHUElBMD+RrJktqjF/TyJ3DFVSSAKpliL/t3cT4Z

V5HWAWthHsRI7RCD/tn5K9h+7Z4JDKLlVVDuIZVIapLf6DSN8hSTtU3V+AFdjoot

xMyUJPTHtvCn9EZAl95SxgTZ+KlFyWaUKOiQXGFzAo8Lv2Oh1TjIyiaAuw8jig40

4QIDAQABo4IDbDCCA2gwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTeeZlIg/cw

HQYDVR0OBBYEFP5LMm+8zQSohuTpjEpnfMQ5OMrVMDcGA1UdEQQwMC6CGGxlYXJu

LXRlc3Qud2ViZXIudWVuLm9yZ4IHdWVuLm9yZ4IJKi51ZW4ub3JnMH8GCCsGAQUF

BwEBBHMwcTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEkG

CCsGAQUFBzAChj1odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DQUNlcnRzL0RpZ2lD

Af8EAjAAMGUGA1UdHwReMFwwLKAqoCiGJmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNv

bS9jYTMtMjAxMGMuY3JsMCygKqAohiZodHRwOi8vY3JsNC5kaWdpY2VydC5jb20v

Y2EzLTIwMTBjLmNybDCCAcYGA1UdIASCAb0wggG5MIIBtQYLYIZIAYb9bAEDAAEw

ggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9zc2wtY3Bz

LXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA

cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMA

bwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYA

IAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQA

IAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUA

bQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkA

dAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAA

aABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMB0GA1UdJQQW

MBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQUFAAOCAQEAHPw4Psjf

bIQtWdW5SYsQBK3wi370lIxUS1+GELB3juooxRlmcAqWXyisFnF0lKolOPtPtNZA

oww/0xFs3udfv1T17geN4WZfA76NKbcfJ54Zujj3xSE0hceG6SZ7Ao3secPIowEf

PE/QkXpYQSlsjTeyw2byyQiZF6EvODwyYJrPpDiohr+WoIhFLVAWJHwH3nv3wHBq

FfdWwevRi/zEXJY2q56NoQ6MqBHqPQ0Y9I1eLjX6qR/EjodxA9Npq/Il3yKctAsH

H0HQVyykeLvAJa0barVyBvpbT4KYaUgQbaASEoT/CYVLxFGrMNFy5XEC/QKbmSoc

bGr4YKpyb0K6yQ==

-----END CERTIFICATE-----

1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3

i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA


MIIGVTCCBT2gAwIBAgIQCFH5WYFBRcq94CTiEsnCDjANBgkqhkiG9w0BAQUFADBs


d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j

ZSBFViBSb290IENBMB4XDTA3MDQwMzAwMDAwMFoXDTIyMDQwMzAwMDAwMFowZjEL

MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3

LmRpZ2ljZXJ0LmNvbTElMCMGA1UEAxMcRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug

Q0EtMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9hCikQH17+NDdR

CPge+yLtYb4LDXBMUGMmdRW5QYiXtvCgFbsIYOBC6AUpEIc2iihlqO8xB3RtNpcv

KEZmBMcqeSZ6mdWOw21PoF6tvD2Rwll7XjZswFPPAAgyPhBkWBATaccM7pxCUQD5

BUTuJM56H+2MEb0SqPMV9Bx6MWkBG6fmXcCabH4JnudSREoQOiPkm7YDr6ictFuf

1EutkozOtREqqjcYjbTCuNhcBoz4/yO9NV7UfD5+gw6RlgWYw7If48hl66l7XaAs

zPw82W3tzPpLQ4zJ1LilYRyyQLYoEt+5+F/+07LJ7z20Hkt8HEyZNp496+ynaF4d

32duXvsCAwEAAaOCAvcwggLzMA4GA1UdDwEB/wQEAwIBhjCCAcYGA1UdIASCAb0w

ggG5MIIBtQYLYIZIAYb9bAEDAAIwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3

LmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUH

AgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQBy

AHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBj

AGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAg

AEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQ

AGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBt

AGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBj

AG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBl

AHIAZQBuAGMAZQAuMA8GA1UdEwEB/wQFMAMBAf8wNAYIKwYBBQUHAQEEKDAmMCQG

CCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgY8GA1UdHwSBhzCB

hDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFz

c3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQu

Y29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDAfBgNVHSMEGDAW

gBSxPsNpA/i/RwHUmCYaCALvY2QrwzAdBgNVHQ4EFgQUUOpzidsp+xCPnuUBINTe

eZlIg/cwDQYJKoZIhvcNAQEFBQADggEBAF1PhPGoiNOjsrycbeUpSXfh59bcqdg1

rslx3OXb3J0kIZCmz7cBHJvUV5eR13UWpRLXuT0uiT05aYrWNTf58SHEW0CtWakv

XzoAKUMncQPkvTAyVab+hA4LmzgZLEN8rEO/dTHlIxxFVbdpCJG1z9fVsV7un5Tk

1nq5GMO41lJjHBC6iy9tXcwFOPRWBW3vnuzoYTYMFEuFFFoMg08iXFnLjIpx2vrF

EIRYzwfu45DC9fkpx1ojcflZtGQriLCnNseaIGHr+k61rmsb5OPs4tk8QUmoIKRU

9ZKNu8BVIASm2LAXFszj0Mi0PeXZhMbT9m5teMl5Q+h6N/9cNUm/ocU=


---

Server certificate

subject=C=US/ST=Utah/L=Salt Lake City/O=My School /OU=IT/CN=canvas.myschool.edu

issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3

---

No client certificate CA names sent

---

SSL handshake has read 5776 bytes and written 340 bytes

----------------

The resulting file should look similar to the following:


MIIGZjCCBU6gAwIBAgIQCJv2Pho1TvS30j6MJSX6mTANBgkqhkiG9w0BAQUFADBm


d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5j

ZSBDQS0zMB4XDTA5MDMwMzAwMDAwMFoXDTEyMDUwNTIzNTk1OVowgYsxCzAJBgNV

BAYTAlVTMQ0wCwYDVQQIEwRVdGFoMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEf

MB0GA1UEChMWVXRhaCBFZHVjYXRpb24gTmV0d29yazEfMB0GA1UECxMWVXRhaCBF

ZHVjYXRpb24gTmV0d29yazESMBAGA1UEAxQJKi51ZW4ub3JnMIGfMA0GCSqGSIb3

DQEBAQUAA4GNADCBiQKBgQCysHUElBMD+RrJktqjF/TyJ3DFVSSAKpliL/t3cT4Z

V5HWAWthHsRI7RCD/tn5K9h+7Z4JDKLlVVDuIZVIapLf6DSN8hSTtU3V+AFdjoot

xMyUJPTHtvCn9EZAl95SxgTZ+KlFyWaUKOiQXGFzAo8Lv2Oh1TjIyiaAuw8jig40

4QIDAQABo4IDbDCCA2gwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTeeZlIg/cw

HQYDVR0OBBYEFP5LMm+8zQSohuTpjEpnfMQ5OMrVMDcGA1UdEQQwMC6CGGxlYXJu

LXRlc3Qud2ViZXIudWVuLm9yZ4IHdWVuLm9yZ4IJKi51ZW4ub3JnMH8GCCsGAQUF

BwEBBHMwcTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEkG

CCsGAQUFBzAChj1odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DQUNlcnRzL0RpZ2lD

Af8EAjAAMGUGA1UdHwReMFwwLKAqoCiGJmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNv

bS9jYTMtMjAxMGMuY3JsMCygKqAohiZodHRwOi8vY3JsNC5kaWdpY2VydC5jb20v

Y2EzLTIwMTBjLmNybDCCAcYGA1UdIASCAb0wggG5MIIBtQYLYIZIAYb9bAEDAAEw

ggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9zc2wtY3Bz

LXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA

cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMA

bwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYA

IAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQA

IAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUA

bQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkA

dAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAA

aABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMB0GA1UdJQQW

MBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQUFAAOCAQEAHPw4Psjf

bIQtWdW5SYsQBK3wi370lIxUS1+GELB3juooxRlmcAqWXyisFnF0lKolOPtPtNZA

oww/0xFs3udfv1T17geN4WZfA76NKbcfJ54Zujj3xSE0hceG6SZ7Ao3secPIowEf

PE/QkXpYQSlsjTeyw2byyQiZF6EvODwyYJrPpDiohr+WoIhFLVAWJHwH3nv3wHBq

FfdWwevRi/zEXJY2q56NoQ6MqBHqPQ0Y9I1eLjX6qR/EjodxA9Npq/Il3yKctAsH

H0HQVyykeLvAJa0barVyBvpbT4KYaUgQbaASEoT/CYVLxFGrMNFy5XEC/QKbmSoc

bGr4YKpyb0K6yQ==


If the certificate uses a self-signed certificate authority, it may be necessary to import all of the certificates in the

chain individually. If this is the case, save each certificate out to a separate .crt file.

7d. Identify the java certificate store file(s) where the Canvas server certificate may need to be imported.

Within a terminal window type the following command:

find $JAVA_HOME -o -name "cacerts" -print 2>/dev/null

This will find the certificate store file location in your default java instance. This should be the only cacerts file

that will need to have the certificate imported.

Even though the above cacerts file should be the only one that needs the Canvas server certificate, it is possible to

have different Luminis programs utilize other java installations on the server. If this is the case, it is possible that

the Canvas server certificate will need to be imported into the additional instances as well.

Within a terminal window type the following command:

find / $ -name proc -prune $ -o -name "cacerts" -print 2>/dev/null

This will find all cacerts files located on the server.

7e. Copy the canvas.crt file to the $JAVA_HOME/jre/lib/security directory. Change the command line location

into the same directory. Because there may be multiple versions of java on the system, it is preferred to be located

in the security directory of the java instance into which you are importing the certificate to make sure the proper

version of the import tool is being used.

7f. Make a backup copy of the cacerts file. Import the Canvas server certificate into the cacerts store. The

keytool utility will prompt for the password for the cacerts store file. Most of the time this is a default of

"changeit". The primary Luminis IV cacerts file may be protected by the admin password that was used when

installing Luminis.

First make a copy of the cacerts file.

cp cacerts cacerts.bak

The command to import the certificate is the following when located in the lib/security directory:

../../bin/keytool -keystore ./cacerts -import -alias <alias> -file ./<certfile.crt>

<alias> is an unique name that will be used in the cacerts file to identify the certificate. It can be anything as long

as it doesn't conflict with another alias in the file.

-- Example: canvas

<certfile.crt> is the file which contains the certificate that will be imported.

-- Example: canvas.crt

note: If the server certificate is using a self-signed certificate authority (CA), it may be necessary to import each

certificate in the certificate chain. If this is the case, extract each certificate to its own <certfile.crt> file and

import each one with a different <alias>.

If multiple canvas server certificates are eventually imported, the alias can be changed as needed, for example by

adding a number after canvas.

If the password is incorrect, the command will result in an error. Try again with the password assigned at

Installation.

If the password is correct, a summary of the certificate will be listed asking for confirmation to 'Trust this

certificate". Type yes and press enter.

If the alias is already used or if the certificate already exists in the cacerts file, it will indicate this.

Restart the Luminis services or preferably the LMB server to load the updated certificate file in memory. If the

untrusted server cert error continues, repeat the import process for each other cacerts file found on the system. If

java is ever updated to a newer version, the cacerts file may be overwritten with the one in the new java

installation package. If this happens, either the old cacerts file could be copied back into place or the server

certificate import would have to be repeated.

8. Ensure connectivity between the Luminis Message Broker and Canvas servers. The Luminis Message Broker

needs to be able to initiate a connection via SSL to the Canvas server, typically on port 443.

9. Create the queues in the LMB server used for grade exchange. These are used as a holding area for the grade

exchange between Canvas and Banner. The two that are needed are com_sct_ldi_sis_UpdateRequest queue and

com_sct_ldi_sis_UpdateReply queue. If another LMS is already configured for and using grade exchange, these

names should be modified to include canvas and a second instance of the LMG GradeAdapter should be

configured. Please refer to section 9d.

The com_sct_ldi_sis_UpdateRequest queue receives grades pushed from Canvas via the grade exchange

application. Grade events are received by Banner via the Luminis Message Gateway grade adapter application.

We will set up the grade exchange application in section eleven.

The com_sct_ldi_sis_UpdateReply queue receives status updates from Banner for grades received and is sent

Canvas via the grade exchange HTTPClient we will configure in section ten.

9a. Log into the Luminis management interface:

9b. Click on the New Destination button. Put com_sct_ldi_sis_UpdateRequest as the Name, select queue as the

type and click the Create button. If you have previously been integrated with another LMS, this queue will

already exist.

9c. Click on the New Destination button. Put com_sct_ldi_sis_UpdateReply as the Name, select queue as the

type and click the Create button. If you have previously been integrated with another LMS, this queue will

already exist.

You should now see both queues in the Destinations page.

9d. If another LMS is currently integrated Banner on the same Luminis box and using grade pass back, the canvas

grade exchange will have to be created with different queues. For example, the following names could be used in

steps 9b and 9c instead.

com_sct_ldi_sis_UpdateRequest_Canvas

com_sct_ldi_sis_UpdateReply_Canvas

To integrate grade exchange with two LMS systems via the same LMB/LMG server, a copy of the

$SCT_LMG_HOME/GradeAdapter will have to be created and started for each LMS.

If a copy is made at $SCT_LMG_HOME/GradeAdapterCanvas with the modified queue names above, the

configuration file located at $SCT_LMG_HOME/GradeAdapterCanvas/config/adapter.properties would need to

have the following variables adjusted:

In the BannerAdapter section, update the dtdUriBase variable to reflect the new grade adapter config directory

location

-- Example: dtdUriBase = "file:///c:/lmg/GradeAdapterCanvas/config";

In the JMSTransport section, update the InboundGradesQueue variable to reflect the new GradeAdapter inbound

grades queue.

-- Example: InboundGradesQueue =

"cn=queue$com_sct_ldi_sis_UpdateRequest_Canvas,ou=AdministeredObjects";

10. Create a grade exchange HTTPClient in the LMB server.

Log into the LMB management interface and select Outgoing HTTP Clients.

Click on the New Client button.

The outgoing HTTP Client uses information from sections one thru five of the Event integration document.

Name: The name of the HTTP Client within LMB.

-- Example: Canvas_LDI_GradeExchange_Endpoint

Enable: true

-- Set to true if this client is active.

Stop Delivery on Error: true

Consume From: com_sct_ldi_sis_UpdateReply (Queue)

JMS Connection user Name: LMB user created in section five.


JMS Connection Password: LMB user password used in section five.


Verify Password:

JMS Message Selector: Leave blank

Durable: false

Post to HTTP(S) URL: This is the Canvas server URL with the following construction:

https://<canvasurl>/api/v1/accounts/<accountnumber>/sis_imports.json?access_token=<accesstoken>&impo

rt_type=banner_grade_exchange_results&extension=xml

<canvasurl> is the Canvas Server URL which is being integrated with Banner.

-- Example: https://canvas.myschool.edu

<accountnumber> is the account number on the canvas server where you are setting the integration

-- Example: 13

<accesstoken> is an API key generated on the Canvas server by an institutional admin

-- Example: A2IDLSRMFjileK87SREL32D9idkWI8ro

-- Example URL:

https://canvas.myschool.edu/api/v1/accounts/13/sis_imports.json?access_token=A2IDLSRMFjileK87SREL32D

9idkWI8ro&import_type=banner_grade_exchange_results&extension=xml

Authorization User Name: A user on the Canvas server with Admin rights within the account being integrated.


Authorization Password: Canvas admin user password

-- Example: aoiIoiJuhJkUhU97s

Verify Password:

Click the Create button when all the information is filled in:

https://canvas.myschool.edu/

To modify any part of the HTTP Client configuration (changed password, URL, access_token, account number

etc.), select the radio button next to the HTTP Client and click the Modify button, update the information and click

the Modify button.

If the LMB server is integrated for grade exchange with another LMS, change the Consume From: queue to

reflect the GradeAdapter used with Canvas.

If there appears to be a communication issued between the Canvas server and Banner server, please refer to

Section 7: Obtain the Canvas server's public SSL Certificate and import into the

$JAVA_HOME/lib/security/cacerts certificate store.

11. Deploy the grade exchange application (HTTPGradeExchangeRelay-1.0.0.war) to an Apache Tomcat server

in the environment (Luminis IV is installed with a tomcat server, although a secondary one can be used).

11a. Because the grade publishing event can come from potentially any Canvas job server (making it difficult to

open up targeted firewall holes), and because it is often difficult to keep Luminis current with security patches for

the underlying programs, it may be advisable to install the grade exchange application on a standalone tomcat

server that is separate than the built-in Luminis one.

11b. Once you have decided what tomcat server to use, you will need a valid SSL certificate signed by an official

certificate authority (CA) (not self-signed) if you don’t already have one. Most certificate authorities will

provide directions for generating a private key and certificate signing request for tomcat. If you use the built-in

Luminis tomcat, here is an example of how to update the certificate associated with the tomcat user used by

Luminis.

Change to the lib/security directory of the java installation used by tomcat, delete the old key, create a new key,

generate signing request, import the new key and restart.

cd /cygdrive/c/Java/jdk1.5.0_10/jre/lib/security/

cp cacerts cacerts.backup

../../bin/keytool -delete -alias tomcat -keystore cacerts -storepass <password>

../../bin/keytool -genkey -alias tomcat -keyalg RSA -keysize 2048 -dname "CN=<FQDN of this server>,

OU=<organization unit>, O=<organization>, L=<city>, ST=<state>, C=<country>" -keypass <password>

-keystore cacerts -storepass <password>

../../bin/keytool -certreq -v -alias tomcat -file cert.req -keystore cacerts -storepass <password>

../../bin/keytool -import -trustcacerts -alias tomcat -file integrator.p7b -keystore cacerts -storepass <password>

11c. Place the HTTPGradeExchangeRelay-1.0.0.war file in the webapps directory of your tomcat server for

deployment. Tomcat will automatically extract and deploy it.

For the default Luminis location on windows, this is located under

$SCT_LMB_HOME/products/tomcat/tomcat-mb/webapps/ and will expand to

$SCT_LMB_HOME/products/tomcat/tomcat-mb/webapps/HTTPGradeExchangeRelay-1.0.0/.

Modify the

$SCT_LMB_HOME/products/tomcat/tomcat-mb/webapps/HTTPGradeExchangeRelay-1.0.0/WEB-INF/classes

/config.properties file to reflect your environment:

# ------- config.properties example ---------

# JMS Operation for sending Banner Grade request

# to the JMS Queue for consumption by LMG (GE adapter)

relayGradeRequestToJMSQueue = true

# HTTP Post Operation for sending Banner Grade response

# in a URL parameter named "message"

relayGradeResponseToHTTPEndpoint = false

ldispDTDSource = classpath:ldisp-2.0.dtd

############### JMS Connection ######################

initialContextFactory = com.sun.jndi.ldap.LdapCtxFactory

securityAuthentication = simple

securityPrincipal = cn=canvaslmbuser,ou=People,o=messaging

securityCredentials = asdfpoiarejjpoasdfj

providerUrl = ldap://luminis.myschool.edu:389/o=messaging

sisLookupName = cn=com_sct_ldi_sis_QueueConnFactory,ou=AdministeredObjects

queueUsername = canvaslmbuser

queuePassword = asdfpoiarejjpoasdfj

clientId = canvaslmbuser.MessageBrokerApplication_1

queueName = cn=queue$com_sct_ldi_sis_UpdateRequest_canvas,ou=AdministeredObjects

replyQueueName = cn=queue$com_sct_ldi_sis_UpdateReply_canvas,ou=AdministeredObjects

durableScription = http$CanvasHttpClient

############### HTTP Client Connection ###############

httpEndpoint =

https://canvas.myschool.edu/api/v1/accounts/13/sis_imports.json?access_token=<token>&import_type=banner

_grade_exchange_results&extension=xml

httpBasicAuthHost =

httpBasicAuthPort =

httpBasicAuthUserName = e

httpBasicAuthPassword = e

If you already use grade exchange and created new UpdateRequest and UpdateReply queues, update the file to

reflect this.

11d. Create a tomcat user that will be used to authenticate the connection from Canvas. Edit tomcat-users.xml

within the <tomcat>/conf/ directory ($SCT_LMB_HOME/products/tomcat/tomcat-mb/conf/tomcat-users.xml)

Add a line such as the following:

<user username="[email protected]" password="qBlnmCBgi0Ip9unU" roles="GradeExchange"/>

If you want the tomcat password encrypted, you can set it to be sha1 encrypted by updating the default realm

Edit $SCT_LMB_HOME/products/tomcat/tomcat-mb/conf/server.xml. Find the following line:

<Realm resourceName='UserDatabase' className='org.apache.catalina.realm.UserDatabaseRealm'/>

and add the encryption type;

<Realm resourceName='UserDatabase' digest='SHA'

className='org.apache.catalina.realm.UserDatabaseRealm'/>

Go to $SCT_LMB_HOME/products/tomcat/tomcat-mb/bin/ and run digest.sh –a SHA <password>, take the

encrypted password and put it in the tomcat-users.xml file.

$ ./digest.sh -a SHA qBlnmCBgi0Ip9unU

qBlnmCBgi0Ip9unU:39e141e3ee10b65e91c2fb380d7b414032355b12

The entry will look like this:

<user username="[email protected]" password="39e141e3ee10b65e91c2fb380d7b414032355b12"

roles="GradeExchange"/>

11e. After restarting tomcat, Go to the URL

https://<mytomcatserver>:<port>/HTTPGradeExchangeRelay-1.0.0/GradeExchangeProcessor/ , log in with the

username and password placed in the tomcat-users.xml file. You should receive the response

“HTTP Grade Exchange Relay Service

Request is authenticated and awaiting Banner Grade XML message...”

11d. Have Instructure add the POST to URL in the grade passback area to point to your tomcat server.

https://<tomcat-users username>:<password>@<tomcat server

FQDN>:<port>/HTTPGradeExchangeRelay-1.0.0/GradeExchangeProcessor

for example:

https://[email protected]:[email protected]/HTTPGradeExchangeRelay-1.0.0/G

radeExchangeProcessor/

12. Ensure connectivity between the grade exchange and Canvas servers. The Canvas server needs to be able to

initiate a connection to the tomcat server where the grade exchange application is installed via SSL, If the grade

exchange application is installed on the LMB server, communication would typically on port 7678. Because the

grade publishing event can come from potentially any Canvas job server, and because it is often difficult to keep

Luminis current with security patches for the underlying programs, it may be advisable to install the grade

exchange application on a standalone tomcat server that is separate than the built-in Luminis one.

Appendix 1: canvas_mbldisetup script variables and detail

A script original created for WebCT integration has been updated to address many of the basic steps used to

configure Canvas integration. The top of the script includes several variables which need to be defined for each

installation environment.

Copy the canvas_mbldisetup to $SCT_LMG_HOME, update the following variables as needed and run to

automate Sections 4-6, 9 and 10.

# ------------- LMB Setup -------------

# CANVAS_LMB_USER - LMB user account that is created in and connects to LMB

# example: CANVAS_LMB_USER=canvaslmbuser

CANVAS_LMB_USER=canvaslmb

# Password for the above user

# example: CANVAS_LMB_PW=asdfpoiarejjpoasdfj

CANVAS_LMB_PW=asdfpoiarejjpoasdfj

# ------------- Canvas Event Exchange -------------

#HTTP authorization user name for Events. This is an admin user on the Canvas server used for integration

# example: [email protected]

[email protected]

#HTTP authorization password for Events. This is the password of the above user on the canvas server

#EVENT_HTTPAUTH_PW=aoiIoiJuhJkUhU97s

EVENT_HTTPAUTH_PW=aoiIoiJuhJkUhU97s

# Access token generated on the Canvas server by an institutional admin

# example: CANVAS_ACCESS_TOKEN=A2IDLSRMFjileK87SREL32D9idkWI8ro

CANVAS_ACCESS_TOKEN=A2IDLSRMFjileK87SREL32D9idkWI8ro

# Canvas account number for the institution (not a user account id)

#CANVAS_ACCOUNT_NUMBER=13

CANVAS_ACCOUNT_NUMBER=13

#LMG filtered Sync Topic for Canvas/Blackboard/.... Canvas consumes events from this topic.

#Multiple LMS can consume from this location.

SCT_LMS_DISPATCH_TOPIC=com_sct_ldi_sis_LmsSync

#Topic for SyncError messages and orphaned UpdateReply messages

# Error with the synchronization will be reported here

SCT_ERROR_TOPIC=com_sct_ldi_sis_Error

#set to true to delete and recreate above objects, if they already exist.

#setting this to true quickly resets the integration environment (LMB users/Topics/Queues/HTTPClients)

RE_INITIALIZE=true

#set to true if you're already integrated with BB Vista and don't want to delete and recreate the topics/queues

# deleting and recreating the topics/queues will require the BB Vista LMB user to have its permissions

# re-assigned. This tones down the re-initialization

BBVISTA=true

#HTTP client identifier for events. This can be any descriptive name

CANVAS_EVENTS_RECEIVER_NAME=Canvas_Ldi_Event_Receiver

# HTTP LDI Event Receiver in Canvas This is the base URL of the Canvas Server

#CANVAS_EVENTS_URL=https://canvas.myschool.edu

CANVAS_EVENTS_URL=https://canvas.myschool.edu

# ------------- Grade Exchange -------------

# This information will likely match some of the settings within the Event configuration above.

# It is added in here in case the grade exchange info is ever different

#HTTP authorization user name for grade exchange . This is an admin user on the Canvas server

#used for integration


[email protected]

#HTTP authorization password for grade exchange. This is the password of the above user on the canvas server

#GE_HTTPAUTH_PW=aoiIoiJuhJkUhU97s

GE_HTTPAUTH_PW=aoiIoiJuhJkUhU97s

# HTTP LDI grade exchange sender in Canvas. This is the base URL of the Canvas Server

#CANVAS_GE_URL=https://canvas.myschool.edu

CANVAS_GE_URL=https://canvas.myschool.edu

#HTTP client identifier for GradeExchange. This can be any descriptive name.

CANVAS_GE_RECEIVER_NAME=Canvas_LDI_GradeExchange_Endpoint

# Canvas Produces Grade Exchange messages on to this Queue

# If another LMS is integrated and operational for grade exchange, this should be modified for a

# second instance of the LMG GradeAdapter. Example: com_sct_ldi_sis_UpdateRequest_Canvas

SCT_GRADE_QUEUE_INBOUND=com_sct_ldi_sis_UpdateRequest

# Canvas Consumes Grade Exchange reply messages from this Queue

# If another LMS is integrated and operational for grade exchange, this should be modified for a

# second instance of the LMG GradeAdapter. Example: com_sct_ldi_sis_UpdateReply_Canvas

SCT_GRADE_QUEUE_OUTBOUND=com_sct_ldi_sis_UpdateReply

#If true, LMB keeps trying to POST the message after an interval of time if an error is encountered.

STOPDELIVERY_ONERROR=true

Copy everything between the BEGIN SCRIPT and END SCRIPT lines, not including those two and save them to

$SCT_LMG_HOME/canvas_mbldisetup.

Update the variables discussed above to match your environment

For Linux or Solaris, change the mode of the file to allow execution.

From the $SCT_LMG_HOME directory run the following:

chmod 755 canvas_mbldisetup

Run the script by typing ./canvas_mbldisetup from the $SCT_LMG_HOME directory.

-------------------BEGIN SCRIPT------------------ #!/bin/sh

###############################################################################

# 2001-2002 Systems & Computer Technology Corporation. All Rights Reserved.

#

# CONFIDENTIAL BUSINESS INFORMATION

#

# THIS PROGRAM IS PROPRIETARY INFORMATION OF SYSTEMS & COMPUTER TECHNOLOGY

# CORPORATION AND IS NOT TO BE COPIED, REPRODUCED, LENT, OR DISPOSED OF,

# NOR USED FOR ANY PURPOSE OTHER THAN THAT WHICH IT IS SPECIFICALLY PROVIDED

# WITHOUT THE WRITTEN PERMISSION OF THE SAID COMPANY

#

# Script to create JMS Objects and/or permissions for Webct adapter.

# @version 1.0

# DT Jan-16-2004 Cloned from mbldiscript for SCT LMG

# BR Jun-01-2011 Cloned from webct_mbldiscript for SCT LMG

# stripped out the JMS connector material and changed

# for canvas. If you have current BB Vista/WebCT integration

# established, set BBVISTA to true to prevent deletion and recreation

of the topics/queues in LMB

# BR Jun-21-2011 Added back in the gradeexchange material. Created CANVAS_GE_*

variables for canvas

# url/username/password in case these ever differ from the event ones.

#

# !/bin/sh -xv debug's the script.

# In debug mode a + before the line shows the line being executed

#

###############################################################################

# ------------- LMB Setup -------------

# CANVAS_LMB_USER - LMB user account that is created in and connects to LMB

# example: CANVAS_LMB_USER=canvaslmbuser

CANVAS_LMB_USER=

# Password for the above user

# example: CANVAS_LMB_PW=asdfpoiarejjpoasdfj

CANVAS_LMB_PW=

# ------------- Canvas Event Exchange -------------

#HTTP authorization user name for Events. This is an admin user on the Canvas server used for

integration


EVENT_HTTPAUTH_USER=

#HTTP authorization password for Events. This is the password of the above user on the canvas

server

#EVENT_HTTPAUTH_PW=aoiIoiJuhJkUhU97s

EVENT_HTTPAUTH_PW=

# Access token generated on the Canvas server for a Canvas account

# example: CANVAS_ACCESS_TOKEN=A2IDLSRMFjileK87SREL32D9idkWI8ro

CANVAS_ACCESS_TOKEN=

# Canvas account number for which the above API key was generated

#CANVAS_ACCOUNT_NUMBER=13

CANVAS_ACCOUNT_NUMBER=

#LMG filtered Sync Topic for Canvas/Blackboard/.... Canvas consumes events from this topic.

#Multiple LMS can consume from this location.

SCT_LMS_DISPATCH_TOPIC=com_sct_ldi_sis_LmsSync

#Topic for SyncError messages and orphaned UpdateReply messages

# Error with the synchronization will be reported here

SCT_ERROR_TOPIC=com_sct_ldi_sis_Error

#set to true to delete and recreate above objects, if they already exist.

#setting this to true quickly resets the integration environment (LMB

users/Topics/Queues/HTTPClients)

RE_INITIALIZE=true

#set to true if you're already integrated with BB Vista and don't want to delete and recreate

the topics/queues

# deleting and recreating the topics/queues will require the BB Vista LMB user to have its

permissions

# re-assigned. This tones down the re-initialization

BBVISTA=true

#HTTP client identifier for events. This can be any descriptive name

CANVAS_EVENTS_RECEIVER_NAME=Canvas_Ldi_Event_Receiver

# HTTP LDI Event Receiver in Canvas This is the base URL of the Canvas Server

#CANVAS_EVENTS_URL=https://canvas.myschool.edu

CANVAS_EVENTS_URL=

# ------------- Grade Exchange -------------

# This information will likely match some of the settings within the Event configuration above.

# It is added in here in case the grade exchange info is ever different

#HTTP authorization user name for grade exchange . This is an admin user on the Canvas server

#used for integration


GE_HTTPAUTH_USER=

#HTTP authorization password for grade exchange. This is the password of the above user on

the canvas server

#GE_HTTPAUTH_PW=aoiIoiJuhJkUhU97s

GE_HTTPAUTH_PW=

# HTTP LDI grade exchange sender in Canvas. This is the base URL of the Canvas Server

#CANVAS_GE_URL=https://canvas.myschool.edu

CANVAS_GE_URL=

#HTTP client identifier for GradeExchange. This can be any descriptive name.

CANVAS_GE_RECEIVER_NAME=Canvas_LDI_GradeExchange_Endpoint

# Canvas Produces Grade Exchange messages on to this Queue

# If another LMS is integrated and operational for grade exchange, this should be modified

for a

# second instance of the LMG GradeAdapter. Example: com_sct_ldi_sis_UpdateRequest_Canvas

SCT_GRADE_QUEUE_INBOUND=com_sct_ldi_sis_UpdateRequest

# Canvas Consumes Grade Exchange reply messages from this Queue

# If another LMS is integrated and operational for grade exchange, this should be modified

for a

# second instance of the LMG GradeAdapter. Example: com_sct_ldi_sis_UpdateReply_Canvas

SCT_GRADE_QUEUE_OUTBOUND=com_sct_ldi_sis_UpdateReply

#If true, LMB keeps trying to POST the message after an interval of time if an error is

encountered.

STOPDELIVERY_ONERROR=true

# ------------- Begin init scripts -------------

inithttpclient_events() {

DO_CREATE="true"

if [ "$DO_CREATE" = "true" ]

then

echo "INFO: Creating httpclient $CANVAS_EVENTS_RECEIVER_NAME..."

mbtool add httpclient -client=$CANVAS_EVENTS_RECEIVER_NAME

-http.username=$EVENT_HTTPAUTH_USER -http.password=$EVENT_HTTPAUTH_PW

-http.url=$CANVAS_EVENTS_URL/api/v1/accounts/$CANVAS_ACCOUNT_NUMBER/sis_imports.json?acce

ss_token=$CANVAS_ACCESS_TOKEN\&import_type=ims_xml\&extension=xml -enabled=true

-http.stopDeliveryOnError=$STOPDELIVERY_ONERROR -username=$CANVAS_LMB_USER

-credential=$CANVAS_LMB_PW -message.source.name=$SCT_LMS_DISPATCH_TOPIC

-message.source.type=topic -message.selector=NONE -durable=true

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: unable to create httpclient $CANVAS_EVENTS_RECEIVER_NAME"

return 1

fi

fi

return 0

}

delete_event_httpclient() {

mbtool delete httpclient -client=$CANVAS_EVENTS_RECEIVER_NAME >/dev/null 2>&1

if [ $? -ne 0 ]

then

echo "INFO: httpclient $CANVAS_EVENTS_RECEIVER_NAME does not exist"

fi

return 0

}

inithttpclient_gradeexchange() {

DO_CREATE="true"


then

echo "INFO: Creating httpclient $CANVAS_GE_RECEIVER_NAME..."

mbtool add httpclient -client=$CANVAS_GE_RECEIVER_NAME

-http.username=$GE_HTTPAUTH_USER -http.password=$GE_HTTPAUTH_PW

-http.url=$CANVAS_GE_URL/api/v1/accounts/$CANVAS_ACCOUNT_NUMBER/sis_imports.json?access_t

oken=$CANVAS_ACCESS_TOKEN\&import_type=banner_grade_exchange_results\&extension=xml

-enabled=true -http.stopDeliveryOnError=$STOPDELIVERY_ONERROR -username=$CANVAS_LMB_USER

-credential=$CANVAS_LMB_PW -message.source.name=$SCT_GRADE_QUEUE_OUTBOUND

-message.source.type=queue -message.selector=NONE -durable=false

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: unable to create httpclient $CANVAS_GE_RECEIVER_NAME"

return 1

fi

fi

return 0

}

delete_grades_httpclient() {

mbtool delete httpclient -client=$CANVAS_GE_RECEIVER_NAME >/dev/null 2>&1

if [ $? -ne 0 ]

then

echo "INFO: httpclient $CANVAS_GE_RECEIVER_NAME does not exist"

fi

return 0

}

initusers() {

DO_CREATE="true"

mbtool list user -id="$CANVAS_LMB_USER" >/dev/null 2>&1

if [ $? -eq 0 ]

then

if [ "$RE_INITIALIZE" = "true" ]

then

echo "INFO: Deleting User $CANVAS_LMB_USER..."

mbtool delete user -id=$CANVAS_LMB_USER

else

echo "INFO: User $CANVAS_LMB_USER already exists, skipping..."

DO_CREATE="false"

fi

fi


then

echo "INFO: Creating User $CANVAS_LMB_USER..."

mbtool add user -id=$CANVAS_LMB_USER -desc=LMG -credential=$CANVAS_LMB_PW

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: unable to create User $CANVAS_LMB_USER"

return 1

fi

fi

echo "INFO: Creating LMB access permissions to $CANVAS_LMB_USER..."

mbtool update clientaccess -policy=allow -entity=user -id=$CANVAS_LMB_USER

-conn=normal -op=add

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: Could not grant access to $CANVAS_LMB_USER to connect to LMB"

return 1

fi

return 0

}

initdestinations() {

for DEST_SPEC in \

"${SCT_LMS_DISPATCH_TOPIC}:topic:consume" \

"${SCT_ERROR_TOPIC}:topic:produce" \

"${SCT_GRADE_QUEUE_INBOUND}:queue:produce" \

"${SCT_GRADE_QUEUE_OUTBOUND}:queue:consume"

do

DEST_NAME=ècho $DEST_SPEC | cut -d: -f1`

DEST_TYPE=ècho $DEST_SPEC | cut -d: -f2`

DEST_PERMISSION=ècho $DEST_SPEC | cut -d: -f3`

DO_CREATE="true"

mbtool list deststatus -dest="$DEST_NAME" -type="$DEST_TYPE" >/dev/null 2>&1

if [ $? -eq 0 ]

then

if [[ "$RE_INITIALIZE" = "true" && "$BBVISTA" = "false" ]]

then

echo "INFO: Deleting ${DEST_TYPE} ${DEST_NAME}..."

mbtool delete destination -dest="$DEST_NAME" -type="$DEST_TYPE"

else

echo "INFO: ${DEST_TYPE} ${DEST_NAME} already exists, skipping..."

DO_CREATE="false"

fi

fi


then

echo "INFO: Creating ${DEST_TYPE} ${DEST_NAME}..."

mbtool add destination -dest="$DEST_NAME" -type="$DEST_TYPE"

if [ $? -ne 0 ]

then

echo "ERROR: unable to create ${DEST_TYPE} ${DEST_NAME}"

return 1

fi

fi

echo "INFO: Adding $DEST_PERMISSION permission to ${DEST_TYPE} ${DEST_NAME} for user

${CANVAS_LMB_USER}..."

mbtool update destaccess -policy=allow -entity=user -id="$CANVAS_LMB_USER"

-access=$DEST_PERMISSION -dest="$DEST_NAME" -type=$DEST_TYPE -op=add

if [ $? -ne 0 ]

then

echo "ERROR: unable to update destinaton permissions"

return 1

fi

done

return 0

}

initadministeredobjectstcp() {

for ADMIN_OBJ_SPEC in \

"cn=$CANVAS_TOPIC_CONNECTION_FACTORY:tcf" \

"cn=$CANVAS_QUEUE_CONNECTION_FACTORY:qcf"

do

ADMIN_OBJ_RDN=ècho $ADMIN_OBJ_SPEC | cut -d: -f1`

ADMIN_OBJ_TYPE=ècho $ADMIN_OBJ_SPEC | cut -d: -f2`

mbtool list adminobj -rdn="${ADMIN_OBJ_RDN}" >/dev/null 2>&1

if [ $? -eq 0 ]

then


then

echo "INFO: Deleting administered object " \

"${ADMIN_OBJ_RDN} with type ${ADMIN_OBJ_TYPE}..."

mbtool delete adminobj -rdn="${ADMIN_OBJ_RDN}"

else

echo "INFO: Administered object " \

"${ADMIN_OBJ_RDN} with type ${ADMIN_OBJ_TYPE} already " \

"exists, skipping..."

continue

fi

fi

echo "INFO: Adding administered object " \


mbtool add adminobj -rdn="${ADMIN_OBJ_RDN}" -obj="${ADMIN_OBJ_TYPE}"

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: administered object creation failed, not proceeding"

return 1

fi

done

return 0

}

initadministeredobjectsssl() {

for ADMIN_OBJ_SPEC in \

"cn=$CANVAS_TOPIC_CONNECTION_FACTORY_SSL:tcf" \

"cn=$CANVAS_QUEUE_CONNECTION_FACTORY_SSL:qcf"

do

ADMIN_OBJ_RDN=ècho $ADMIN_OBJ_SPEC | cut -d: -f1`

ADMIN_OBJ_TYPE=ècho $ADMIN_OBJ_SPEC | cut -d: -f2`

mbtool list adminobj -rdn="${ADMIN_OBJ_RDN}" >/dev/null 2>&1

if [ $? -eq 0 ]

then


then

echo "INFO: Deleting administered object " \


mbtool delete adminobj -rdn="${ADMIN_OBJ_RDN}"

else

echo "INFO: Administered object " \

"${ADMIN_OBJ_RDN} with type ${ADMIN_OBJ_TYPE} already " \

"exists, skipping..."

continue

fi

fi

echo "INFO: Adding administered object " \


mbtool add adminobj -rdn="${ADMIN_OBJ_RDN}" -obj="${ADMIN_OBJ_TYPE}"

-property="imqConnectionType:TLS"

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: administered object creation failed, not proceeding"

return 1

fi

done

return 0

}

echo ""

echo "#### Initializing messaging users..."

initusers

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: messaging user initialization failed, not proceeding"

exit 1

fi

echo ""

echo "#### Initializing administered objects TCP..."

initadministeredobjectstcp

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: TCP administered object initialization failed, not proceeding"

exit 1

fi

echo ""

echo "#### Initializing administered objects SSL..."

initadministeredobjectsssl

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: SSL administered object initialization failed, not proceeding"

exit 1

fi

echo ""

echo "#### Initializing message destinations..."

initdestinations

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: message destination initialization failed, not proceeding"

exit 1

fi

echo ""

echo "### Checking event http clients..."

delete_event_httpclient

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: event http client could not be deleted......."

exit 1

fi

echo ""

echo "#### Initializing event http client "

inithttpclient_events

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: event http client could not be created, not proceeding"

exit 1

fi

echo ""

echo "### Checking grades http clients..."

delete_grades_httpclient

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: grades http client could not be deleted......."

exit 1

fi

echo ""

echo "#### Initializing grade exchange http client "

inithttpclient_gradeexchange

if [ $? -ne 0 ]

then

echo ""

echo "ERROR: grade exchange http client could not be created, not proceeding"

exit 1

fi

echo ""

echo "INFO: Successfully configured JMS Objects in LMB"

exit 0

-------------------END SCRIPT-------------------

Appendix 2: SSL certificate discussion (2048 bit SSL certificate not supported by default)

The following is a discussion on a Luminis Development list which gives some suggestions for certificates:

http://www.lumdev.net/node/3355

The long and short of it is that the command line has to be used to generate the key and CSR and to install the

certificates.

These instructions helped as well:

http://www.digicert.com/ssl-certificate-installation-iplanet.htm

Appendix 3: Miscellaneous hints and tips concerning LMB/LMG

Example Luminis IV config file for a standalone installation of LMB/LMG. Notice that there is no ‘escaping’ of

equal signs like the documentation tells you to do.

admin.id=admin

admin.password=<password>

cp.root=c:\lmb

license.key=<license key for standalone>

resource.directory.manager.dn=cn=Directory Manager

resource.directory.manager.password = <password>

http://www.lumdev.net/node/3355

http://www.digicert.com/ssl-certificate-installation-iplanet.htm

resource.host=luminis.myschool.edu

resource.ldap.suffix=cp

resource.ldap.port=389

school.city=somewhere

school.country=us

school.name=USU

school.state=UT

school.timezone=America/Denver

school.zipcode=84322

tiers=messagebroker

verbose=yes

ws.http.port=7677

ws.https.port=7678

instructure canvas real-time integration with sct...

Documents