LTIv1.3 connection to Nebari

[danielmcquillen]

Hi all. I'm researching tools that would allow me to integrate various Jupyter notebooks into my Learning Management System (LMS) via LTIv1.3, a connection mechanism used in e-Learning (based on OpenID connect).

Essentially I'm trying to find a platform that would allow a course author to define notebooks for different lessons in a course and then at appropriate moments spin up a notebook for a student user when they load a particular unit where the notebook is relevant. I image each notebook defined as a Dockerfile in the instructor's private github repos.

Has anyone attempted such a thing with Nebari? I know that JupyterHub has a plugin called LTIAuthenticator to enable LTIv1.3 connections... but I've found Zero to JupyterHub a bit hard to understand enough to experiment with in this scenario. I did get LTIv1.3 working with ZTJH, but don't understand yet how to configure a system to map students to notebooks that would be automatically spawned from github.

Perhaps Nebari has an easier approach to this scenario?

Thanks in advance for any thoughts ... or findings from any similar efforts.

[dcmcand]

Hi @danielmcquillen, Nebari has a mechanism a for starting with github repos cloned into every users jupyterlab.

See the section on jupyterlab.initial_repositories at https://www.nebari.dev/docs/explanations/custom-overrides-configuration#jupyterlab for more details, or the original pr at #2207.

That would probably be the easiest way to handle this. I am not familiar with LTIv1.3, unfortunately. @krassowski Do you have any thoughts here?

[krassowski]

We also have jupyterlab-gallery integrated; this is useful to pull repositories on-demand and add some more visual cues. It supports private repositories.

Here is a screenshot from the README for convenience:

The nebari settings are documented in https://www.nebari.dev/docs/explanations/custom-overrides-configuration#jupyterlab

[danielmcquillen]

Thanks @dcmcand and @krassowski for your thoughts!!

In my use case, the notebook would need to be chosen and launched at runtime when a student visits a particular unit in the LMS and is directed to an associated notebook, so I think a static helm definition isn't as useful here as there could be many notebooks for many units for many courses (although still good to know about). The first time a student visits a lesson the notebook will need to be created from scratch and loaded with the target .ipynb file before being shown to the student.

Furthermore, as time goes on, a course author will be creating new courses that need new .ipynb files (probably stored in GitHub?), so there's no way to "prebuild" a container to contain all the future github repos that might be used.

As for notebook selection: I'm imagining the notebook showing up in an iframe directly in the learning content, no user selection involved as I want to avoid any potential confusion for the student or selecting the wrong notebook for the current lesson.
I have this somewhat working using ZTJH and LTIAuthenticator, but only when I point to an existing notebook I create beforehand for my test.

Not sure how to set up machinery in ZTJH or elsewhere to dynamically load a notebook from github and launch for user so they can start right away...although as I learn more I understand a custom spawner and a Docker pre-loaded with nbgitpuller is probably part of the mix. Just trying to find an easier way.

However, I didn't know that Nebari uses the same helm-based configurations as ZTJH.

In that case, a follow-up question: is it possible to use the same LTIAuthenticator plugin I've used with ZTJH?

As background, this is a snippet from my helm configuration yaml for ZTJH:

hub:
  config:
    JupyterHub:
      authenticator_class: ltiauthenticator.lti13.auth.LTI13Authenticator
      log_level: DEBUG
    LTI13Authenticator:
      # Use an LTI 1.3 claim to set the username. You can use and LTI 1.3 claim that
      # identifies the user, such as email, last_name, etc.
      username_key: "username"
      # The issuer identifier of the platform
      issuer: "https://(my LMS domain name)"
      # The LTI 1.3 authorization url
      authorize_url: "(my LMS domain name)/lti/authorize_redirect"
      # The platform's JWKS endpoint url providing public key sets used to verify the ID token
      jwks_endpoint: "(my LMS domain name)/lti/security/jwks"
      # The external tool's client id as represented within the platform (LMS)
      # Typically created by the LMS platform when registering the tool.
      client_id:
        # DMcQ: by convention I'm setting this to 1 in the LMS for this test
        - "1" 

(Meanwhile, I've started to look at modal.com as perhaps that's a more direct way of spinning up arbitrary notebooks for various students and units, but not sure whether that path promises an easier road as I'll have to start creating a mini-JupyterHub directly in the LMS...and also modal.com seems like it might be kind of expensive for a course author).

Background: I'm working on an open-source LMS and our focus is on supporting groups doing undergrad/grad sciences training. So we're keen to learn more about integrating computer-intensive learning environments directly in courseware. KinesinLMS

[viniciusdc]

Hey @danielmcquillen, since this was in December, we got caught on the releases and missed a follow-up here. Starting from here:

is it possible to use the same LTIAuthenticator plugin I've used with ZTJH?

Since Nebari uses Keycloak for all authentication, we end up using a Custom Oauth class for managing the jupyterhub authentication, thus using another authentication method would break the dependency between components. However, Keycloak supports any OpenId form of authentication, so you can set it up as an IDP, and it would automatically translate to the hub ecosystem.

The first time a student visits a lesson, the notebook must be created from scratch and loaded with the target .ipynb file before being shown to the student.

There are many ways you could expand the already existing tools on Nebari to achieve it, for example:

• help extension to serve an API service that will dynamically clone github repos and copy the notebooks into the appropriate user;
• use of the jupyterlab-gallery seems more user-friendly, though the creation of notebooks would need to be handled externally within the repo CI;
  As Chuck suggested, we do have an initial_repos field that basically acts as an init_container on each user's Jupyterlab instance. We pre-populate it with any given repo content.

In most solutions, the creation of the notebooks needs external tools outside of the current scope of nebari, though you could create a general Argo workflow that would handle the notebook creation and repo cloning automatically with custom triggers, though that would require checking their documentation https://argo-workflows.readthedocs.io/en/latest/cron-workflows/

[marcelovilla]

@danielmcquillen let me know if this is something you're still interested. Otherwise, I think we can close the discussion.

[danielmcquillen]

@viniciusdc Thanks for the thoughtful response.