--- loncom/lond	2023/01/23 03:43:33	1.489.2.43.2.6
+++ loncom/lond	2023/07/05 21:55:22	1.489.2.43.2.7
@@ -2,7 +2,7 @@
 # The LearningOnline Network
 # lond "LON Daemon" Server (port "LOND" 5663)
 #
-# $Id: lond,v 1.489.2.43.2.6 2023/01/23 03:43:33 raeburn Exp $
+# $Id: lond,v 1.489.2.43.2.7 2023/07/05 21:55:22 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -63,7 +63,7 @@ my $DEBUG = 0;		       # Non zero to ena
 my $status='';
 my $lastlog='';
 
-my $VERSION='$Revision: 1.489.2.43.2.6 $'; #' stupid emacs
+my $VERSION='$Revision: 1.489.2.43.2.7 $'; #' stupid emacs
 my $remoteVERSION;
 my $currenthostid="default";
 my $currentdomainid;
@@ -4867,6 +4867,81 @@ sub lti_handler {
 &register_handler("lti", \&lti_handler, 1, 1, 0);
 
 #
+# Data for LTI payload (received encrypted) are unencrypted and
+# then signed with the appropriate key and secret, before re-encrypting
+# the signed payload which is sent to the client for unencryption by
+# the caller: lonnet::sign_lti()) before dispatch either to a web browser
+# (launch) or to a remote web service (roster, logout, or grade).
+#
+# Parameters:
+#   $cmd             - Command request keyword (signlti).
+#   $tail            - Tail of the command.  This is a colon-separated list
+#                      consisting of the domain, coursenum (if for an External
+#                      Tool defined in a course), crsdef (true if defined in
+#                      a course), type (linkprot or lti),
+#                      context (launch, roster, logout, or grade),
+#                      escaped launch URL, numeric ID of external tool,
+#                      version number for encryption key (if tool's LTI secret was
+#                      encrypted before storing), a frozen hash of LTI launch
+#                      parameters, and a frozen hash of LTI information,
+#                      (e.g., method => 'HMAC-SHA1',
+#                             respfmt => 'to_authorization_header').
+#   $client          - File descriptor open on the client.
+# Returns:
+#   1       - Continue processing.
+#   0       - Exit.
+#  Side effects:
+#     The reply will contain the LTI payload, as & separated key=value pairs,
+#     where value is itself a frozen hash, if the required key and secret
+#     for the apecific tool ID are available. The payload data are retrieved from
+#     a call to Lond::sign_lti_payload(), and the reply is encrypted before being
+#     written to $client.
+#
+sub sign_lti_handler {
+    my ($cmd, $tail, $client) = @_;
+
+    my $userinput = "$cmd:$tail";
+
+    my ($cdom,$cnum,$crsdef,$type,$context,$escurl,
+        $ltinum,$keynum,$paramsref,$inforef) = split(/:/,$tail);
+    my $url = &unescape($escurl);
+    my $params = &Apache::lonnet::thaw_unescape($paramsref);
+    my $info = &Apache::lonnet::thaw_unescape($inforef);
+    my $res =
+        &LONCAPA::Lond::sign_lti_payload($cdom,$cnum,$crsdef,$type,$context,$url,$ltinum,
+                                         $keynum,$perlvar{'lonVersion'},$params,$info);
+    my $result;
+    if (ref($res) eq 'HASH') {
+        foreach my $key (keys(%{$res})) {
+            $result .= &escape($key).'='.&Apache::lonnet::freeze_escape($res->{$key}).'&';
+        }
+        $result =~ s/\&$//;
+    } else {
+        $result = $res;
+    }
+    if ($result =~ /^error:/) {
+        &Failure($client, \$result, $userinput);
+    } else {
+        if ($cipher) {
+            my $cmdlength=length($result);
+            $result.="         ";
+            my $encres='';
+            for (my $encidx=0;$encidx<=$cmdlength;$encidx+=8) {
+                $encres.= unpack("H16",
+                                 $cipher->encrypt(substr($result,
+                                                         $encidx,
+                                                         8)));
+            }
+            &Reply( $client,"enc:$cmdlength:$encres\n",$userinput);
+        } else {
+            &Failure( $client, "error:no_key\n",$userinput);
+        }
+    }
+    return 1;
+}
+&register_handler("signlti", \&sign_lti_handler, 1, 1, 0);
+
+#
 #  Puts an id to a domains id database. 
 #
 #  Parameters: