[BD-24] [TNL-7330] [BB-2726] LTI Improvements - Implement Context Membership Service

[shimulch]

This PR Implements the Context Membership Service specified on LTI Names and Role Provisioning Services spec.

The ADR that this implementation follows can be found at - https://github.com/edx/xblock-lti-consumer/blob/master/docs/decisions/0004-lti-advantage-nrps.rst

This PR depends on -

• https://github.com/edx/edx-platform/pull/25843

JIRA tickets:

• https://tasks.opencraft.com/browse/BB-2726
• https://tasks.opencraft.com/browse/BB-4203
• https://openedx.atlassian.net/browse/TNL-7330

Discussions: N/A

Dependencies: None

Screenshots:

Sandbox URL: None

Merge deadline: None

Testing instructions:

1. Pull this PR on local devstack. Pull https://github.com/edx/edx-platform/pull/25843 for edx-platform repository.
2. Make sure LTI 1.3 enabled by setting the feature flag on studio.yml

FEATURES:
    LTI_1P3_ENABLED: true
    LTI_NRPS_ENABLED: true

3. Create an LTI 1.3 block. Follow the procedure from here.
4. Enable LTI NRPS from xblock settings as per the screenshot above.
5. Check that LTI Launches successfully and LTI NRPS claim is being shown.
6. Generate a JWT token. Go to www.jwt.io, select RS-256, fill in both the private and public keys section in the bottom right
   Set the header and payload as follows

# HEADER:
{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "123"
}

# PAYLOAD:
{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iat": 1516239022
}

7. Get access token

curl --request POST \
  --url 'http://localhost:18000/api/lti_consumer/v1/token/<USAGE_KEY>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data scope=https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly \
  --data client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
  --data client_assertion=<JWT_TOKEN>

8. Use the returned access token to perform the GET request to the Context Membership URL.

curl --request GET \
  --url http://localhost:18000/api/lti_consumer/v1/lti/<LTI_CONFIG_ID>/lti-nrps/memberships \
  --header 'Authorization: Bearer <ACCESS_TOKEN>'

9. You should see a response with the same schema defined it https://www.imsglobal.org/spec/lti-nrps/v2p0#context-membership
10. To enable exposing PII information, add a course waffle flag from http://localhost:18000/admin/waffle_utils/waffleflagcourseoverridemodel/.
11. Set waffle flag to - lti_consumer.lti_nrps_transmit_pii and set course key to your course key. ex: course-v1:edX+DemoX+Demo_Course.
12. Make sure you've chosen Override Choice - Force On and enabled it.
13. Now perform the request from step 8. You should see the name, email, and profile picture in the result now.
14. To test if API correctly gates when the course has a large number of enrollments, set the LTI_NRPS_ACTIVE_ENROLLMENT_LIMIT Django setting to a lower value than the number of enrollments of your test course.
15. Then perform the request from step 8, you should see API now throws 404.

Author notes and concerns:
N/A

Reviewers

• @giovannicimolin
• edX reviewer[s] TBD