this

lti/deep_linking.py

@@ -203,9 +203,8 @@ class SelectMediaView(View):
             # Create JWT payload
             tool_issuer = request.build_absolute_uri('/')[:-1]
 
-            # Per LTI spec, aud should be the platform's issuer URL
-            # Try just the platform URL (some Moodle versions don't accept arrays)
-            audience = platform.platform_id
+            # Per LTI spec, aud should be the client_id assigned by the platform
+            audience = platform.client_id
 
             # Get sub (subject) from original launch
             sub = message_launch_data.get('sub')

lti/services.py

@@ -53,19 +53,25 @@ class LTINRPSClient:
             return []
 
         try:
+            print(f"NRPS: Attempting to fetch members. nrps_claim: {self.nrps_claim}")
             tool_config = DjangoToolConfig.from_platform(self.platform)
             registration = tool_config.find_registration_by_issuer(self.platform.platform_id)
 
             if not registration:
+                print("NRPS: No registration found for platform.")
                 return []
 
             service_connector = DjangoServiceConnector(registration)
             nrps = NamesRolesProvisioningService(service_connector, self.nrps_claim)
             members = nrps.get_members()
-
+            print(f"NRPS: Successfully fetched {len(members)} members.")
             return members
 
-        except Exception:
+        except Exception as e:
+            print(f"NRPS Error: Failed to fetch members. Exception: {e}")
+            import traceback
+
+            traceback.print_exc()
             return []
 
     def sync_members_to_rbac_group(self, rbac_group):