Development: Fix LTI on multi node systems

[Strohgelaender]

Checklist

General

• I tested all changes and their related features with all corresponding user types on a test server.
• This is a small issue that I tested locally and was confirmed by another developer on a test server.
• Language: I followed the guidelines for inclusive, diversity-sensitive, and appreciative language.
• I chose a title conforming to the naming conventions for pull requests.

Server

• Important: I implemented the changes with a very good performance and prevented too many (unnecessary) database calls.
• I strictly followed the server coding and design guidelines.
• I added multiple integration tests (Spring) related to the features (with a high test coverage).
• I added pre-authorization annotations according to the guidelines and checked the course groups for all new REST Calls (security).
• I documented the Java code using JavaDoc style.

Motivation and Context

LTI does not work on multinode setups.
Fixes #9017.

Description

I copied the code of the default StateAuthorizationRequestRepository (which sadly is a final class) into a new DistributedStateAuthorizationRequestRepository that now uses Hazelcast to share the content between nodes.

Steps for Testing

Use a multinode testserver like TS3 (see https://confluence.ase.in.tum.de/pages/viewpage.action?pageId=25252245).

0. An Admin must connect the testserver with moodle (https://docs.artemis.cit.tum.de/user/lti.html).
1. Activate "Online Course" for your course (Course Management -> Edit -> Checkbox at the bottom).
2. Link exercises to moodle (follow the documentation on https://docs.artemis.cit.tum.de/user/lti.html#linking-artemis-exercises)

Testserver States

Note

These badges show the state of the test servers.
Green = Currently available, Red = Currently locked
Click on the badges to get to the test servers.

Review Progress

Performance Review

• I (as a reviewer) confirm that the server changes (in particular related to database calls) are implemented with a very good performance

Code Review

• Code Review 1
• Code Review 2

Manual Tests

• Test 1
• Test 2

Test Coverage

Summary by CodeRabbit

• New Features

  • Introduced enhanced security configurations with distributed data management using Hazelcast.
  • Added a new repository for managing OAuth2 authorization requests in a distributed environment.
  • Improved LTI 1.3 security filter configurations and logging capabilities for better traceability.

• Improvements

  • Refined error handling in the LTI 1.3 launch filter for better user experience.
  • Clarified naming conventions for JWT lifetime constants to improve code readability.
  • Enhanced the scalability and robustness of state management in security configurations.

• Bug Fixes

  • Corrected documentation in the login cookie method for better clarity.

[JohannesStoehr]

Code

[MaximilianAnzinger]

In general I like the logging you did here. However, I'm not sure if all of it should be logged as info?

[Strohgelaender]

In general I like the logging you did here. However, I'm not sure if all of it should be logged as info?

I had it at debug it first, but Stephan requested it to be in info level. LTI is not used often (which makes it a prime candidate for some regressions to sneak in) and in these cases gaining information about the LTI process should be as simple as possible.

[maximiliansoelch]

Didn't look at the code, but tested the PR on the staging server and it now works as expected 👍