CVS log for loncom/lti/ltiauth.pm

Up to [LON-CAPA] / loncom / lti

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- Fix typo.

- Bugs 6754 and 6907
  - Return of grades to launcher CMS supported for resources or folders
    accessed via LTI-mediated deep link.
  - Support option: "Encrypt stored consumer secrets defined in domain"
  - Signing of LTI payloads for roster retrieval, passback of grades,
    and callback to logput launcher CMS session all now occur on
    primary library server for course's domain.

- Additional arg needed in call to get_course_lti() following changes in
  lonnet.pm rev. 1.1510

- On a balancer node, if LON-CAPA is an LTI Provider or if deep link access
  with LTI mediated link protection is in use, check for balancer cookie
  after credentials in LTI payload validated.

- Bug 6907
  "Exit Tool" button available to logout a session launched via deep link
  and escape iframe and redirect (for LTI-protected link).

- Bug 6907
  - Set request.linkprotuser in %env for students accessing deep-linked items
    with LTI link protection which includes username from other LMS.
  - Set "only_body" for intermediate pages shown while session is being set up
    for LTI link-protected access.
  - Provide appropriate feedback when a deep link is followed but the user
    only has a future and/or expired role in the target course.

- Bug 6907
  For LTI-protected deep links in which username is included in launch payload
  compare username in payload with username for any existing LON-CAPA session
  in current web browser and expire old session, if different user.

- Bug 6907
 - Don't show log-in page if link protection configuration has
   "Action when username is not for an enrolled student" set to:
   "Discontinue launch process", and username was not available.
 - White space added between two sentences in displayed warning.

- Net::OAuth expects characters outside the ASCII character set to have been
  decoded to perl's internal character structure, as it will UTF-8 encode them
  itself when making a signature.

- Bug 6907
  - Link Protectors for deep-linking from launch from LTI Consumer can be
    configured at both a domain level and a course level.
  - Support encryption of link protection secrets set in a domain.
  - Requires perl-Crypt-CBC

- Bug 6907
  - Modify message logged for user session launched from LTI-protected
    deep-link which includes username in signed payload.
  - On a balancer call lonauth::success before redirect to switchserver
  - Fix typo.

- Bug 6907
  - Domain default to determine whether LTI launch of deep-linked URL requires
    student to authenticate; can be overridden for specific course(s).
  - If domain config permits it, link protection setting in a course can
    specify whether to accept username included in LTI payload, and action
    to take if username is not for an enrolled student.
  - Second arg passed to ltiauth::invalid_request() is text string stating why
    LTI launch was invalid.

- Typo

- Bug 6907
  - Extraction of LTI itemID based on consumer key in signed LTI payload, and
    verification with available secret moved from ltiauth.pm to Lond.pm.
  - Verification will now occur on course's home server or domain's primary
    library server, for course-defined LTI ID, and domain-defined LTI ID
    respectively.
  - Setting and modifying link protection key and secret now requires user
    session on course's home server.
  - Display of existing LTI key only available of course's home server.
  - Display of stored LTI secret eliminated so a Course Coordinator will
    need to record it offline or commit it to memory.

- Typo

- Bug 6754
  When storing mapping of Consumer system's courseID  to LON-CAPA's course
  "number" include LTI item id verified from signed payload.

- Bug 6754
  - Storing mapping of Consumer course identifier to LON-CAPA courseID
    honors rules for allowable course types, and also general Y/N option for
    any type.
  - When a course is created due to launch from LTI Consumer, course's
    environment.db contains internal.lti set to 1, and extended course type
    is identified as "lti".

- Bug 6754
  Basic LTI authentication option for launch from Consumer for which user
  information but no course information are provided on launch.

- Add missing keys() command.

- Bug 6907
  - Use of token to store linkprot or linkkey compatible with use of
    btoken and iptoken (for load balancing and IP change respectively).
  - Launching access from a deeplink, with its own ltoken and/or linkkey,
    for a user session originally launched from a different deeplink will
    update required session information.

- Args in lonnet::spareserver() consistent with lonnet.pm rev. 1.1451 change.

- Fix typo in comment.

- scope for $urlcdom in &course_from_tinyurl() routine added in rev. 1.20

- Bug 6907 Content in a course can be set to be deep-link only.
  - deeplink parameter has 5 components:
    state, others, listing, scope, protect and menus.
  - deeplink protection for launch from non-LON-CAPA LTI-enabled systems
    uses /adm/launch/tiny/$dom/$uniqueID, and key and secret used by launcher
    can be set in a course (by CC), or for domain (by DC).

- Bug 6754. LON-CAPA as LTI Provider.
  Domain configuration to support session expiration in LON-CAPA,
  after user logs out of LTI Consumer which originally launched session,
  (if Consumer supports logoutServiceUrl; e.g. custom_logout_url in Canvas).

- Consistent naming for selfenrollrole item in %env when LTI launch requires
  user's self-enrollment.

- Bug 6400 Deep-linking
  - URLs like /adm/lti/tiny/domain/uniqueID can be used to restrict use of
    deep links to access from another LTI-enabled application (no user data
    passed in this context).

- Bug 6754 LON-CAPA as LTI Provider
  - Convert tail of launch URL to a real symb, if launch was for a single
    resource.

- Formatting (whitespace changes only).

- Bug 6754 LON-CAPA as LTI Provider
  - Include value of 1 for $selfenroll arg when calling ltiutils::enrolluser()
    so user privs will be added to the user's environment for the new role.

- Bug 6754 LON-CAPA as LTI Provider
  - Support LTI Extension: Context Memberships Service, whereby launch of
    Consumer can trigger Provider to request course roster.
  - Code moved from ltiauth.pm to routines in ltiutils.pm:
    &get_lc_roles(), &create_user() and &enrolluser(); &create_passwd() routine
    also moved.
  - Code moved from &parse_roster() to &get_roster() in ltiutils.pm.
  - New routines: &batchaddroster(), &datechange_check(), &store_passbackurl()
    added to support roster updates, (including saving user-specific values
    for: lis_result_sourcedid, used for passback of grades to Consumer.

- Bug 6754 LON-CAPA as LTI Provider
  - Support LTI Consumer using OAuth version 1.0a (sends oauth_callback)

- Fix typo.

- Bug 6754 LON-CAPA as LTI Provider
  - request.lti.login set to consumer's ID for LTI authenticated session.
  - Rights to create LON-CAPA courses (LTI type) assigned, as per domain
    config to new user created for LTI instructor
  - No "Login" shown for "Invalid call" displayed for failed LTI launch.

- Bug 6754 LON-CAPA as LTI Provider
  - LTI launch results in call to ltiauth, even if user has existing LON-CAPA
    session (role, course etc. will be updated).
  - LTI launch can be for a published .sequence

- Bug 6754 LON-CAPA as LTI Provider
  - Original LTI launch of LON-CAPA is for a resource, a map, or an entire
    course, and display is for iframe, tab or window; retain this in %env.

- Bug 6754 LON-CAPA as LTI Provider
  - Assign randomly generated password to user in LON-CAPA if configuration
    for LTI Consumer permits both LTI auth and LON-CAPA log-in (internal) for
    a new user.

- Bug 6754 LON-CAPA as LTI Provider
  - Creation of new LON-CAPA user account available from an LTI Consumer.
  - Creation of new LON-CAPA course available from an LTI Consumer.
  - Self-enrollment in a LON-CAPA course available from an LTI Consumer.

- Bug 6754 LON-CAPA as LTI Provider
  - Tiny URLs can be part of the launch URL used to access a LON-CAPA
    assignment from another CMS. On launch (in the Consumer), POSTed data
    would be sent to a URL such as: /adm/lti/tiny/<domain>/<key>, where key
    is six characters.

- Bug 6754 LON-CAPA as LTI Provider
  - Launch terminated if user has no role in target course, and
    self-enrollment is not permitted.

Bug 6754 LON-CAPA as LTI Provider
 - More descriptive name for Consumer Key scalar.
 - Include LON-CAPA courseID in standard format when logging successful
   authentication via basic LTI.

Bug 6754 LTI Integration
- ltiutils.pm contains common LTI routines (to facilitate re-use).
  - &check_nonce() moved from ltiauth.pm to ltiutils.pm.
  - &set_callback_secret() moved from lonexttool.pm to ltiutils.pm, and
    renamed &set_service_secret().
  - &sign_params(), &get_tool_lock(), and &release_tool_lock() moved from
    lonexttool.pm to ltiutils.pm
- ltiroster.pm will service requests for course membership information
  from an LTI Provider, where domain configuration for Tool permits this
  service, and launch (by Instructor( included ext_ims_lis_memberships_id.

- Bug 6754 LTI Integration: LON-CAPA as LTI Provider
  - Move auth/lonlti.pm to lti/ltiauth.pm