Add LTI 1.3 support to Moodle

The changes made include some fundamental updates to the core LTI code and so a comprehensive check of the LTI functionality is warranted. Setup in a Moodle 3.6 instance (on a publicly accessible server): create a course create 3 users with the following details: Given name: Siân Family name: Instructor Email: sian@imscert.org ID number (under the 'Optional' section of the form): sis:sian Given name: John Family name: Student Email: john@imscert.org ID number: sis:john Given name: Gill Family name: O'post-rophe Email: gill@imscert.org ID number: sis:gill Enrol the users in the course with the following roles: Siân: teacher John: student Gill : student Visit ‘Site administration' > 'Plugins' > 'Manage tools'. Click 'configure a tool manually' add an LTI 1 external tool with a Tool URL of https://lti.tools/saltire/tp a consumer key of "moodle" and a secret of "secret" Visit ‘Site administration' > 'Plugins' > 'Manage tools'. add an LTI 2 tool using a registration URL by entering https://lti.tools/saltire/tp in the 'Tool URL...' field and submit. Once you see 'Passed' click on 'Tool proxy'. Click on 'Submit' and wait. Click on 'Yes' in the next page to activate the tool. Log out. Log in as Siân Visit the course you are enrolled in Turn editing on Click to add a new activity or resource. Add an 'External tool' In Preconfigured tool select the first one you created (LTI1 tool) and save. Add another external tool, but instead select the second option in Preconfigured tool (LTI2 tool) and save Launch each tool and keep a copy of the message parameters section Log in as John Launch each tool by clicking on it and keep a copy of the message parameters section Upgrade Moodle instance to 3.7dev Check existing links: Log in as Siân Launch each tool and keep a copy of the message parameters section - they should be identical to the original copy except for: parameters with names starting oauth _ LTI 2 Only: custom_system_settings_url, custom_context_settings_url and custom_link_settings_url will all have a suffix of  /custom added LTI 2 Only: custom_lineitems_url and custom_lineitem_url will have a type_id query parameter added LTI 2 Only: custom_tc_profile_url will have an lti_version query parameter added Log in as John Launch each tool and keep a copy of the message parameters section - they should be identical to the original copy except for: parameters with names starting oauth _ custom_system_settings_url, custom_context_settings_url and custom_link_settings_url will all have a suffix of  /custom added custom_lineitems_url and custom_lineitem_url will have a type_id query parameter added the value of the tool_consumer_info_version parameter will be different IMS LTI Certification Suite Open certification suite at  https://www.imsglobal.org/lti-certification-suite and follow the "Process for Tool Consumers" option at the bottom (requires IMS login) Enter "Moodle" and "3.7" on the configuration page and click "Save settings" Log in as a System Administrator Create the two courses outlined in the instructions displayed (enter an ID number for each course) Test LTI 1.0/1.1: Create an LTI 1 tool using the details provided by the certification suite - select the "Show in activity chooser and as a preconfigure tool" Tool configuration usage option, "New window" for the Default launch container option and check the Content-Item Message box Login is as Siân Add 3 links as per suite instructions Run through LTI 1 certification tests - most tests can be completed by launching each of the 3 links by each of the 2 users, then use the "Select Content" option when creating a new link, and run all the tests of services from the results page of the suite Run MDL-60416 tests (note that a 401 error should be expected rather than a 403 error as per the instructions.) Test LTI 2: Register LTI 2 tool to certification suite Add a link using the new tool Run through LTI 2 certification tests - most tests can be completed by launching each of the 3 links by each of the 2 users, then use the "Select Content" option when creating a new link, and run all the tests of services from the results page of the suite Run MDL-60416 tests (note that a 401 error should be expected rather than a 403 error as per the instructions.) Test LTI 1.3 Generate a private/public key at https://lti-ri.imsglobal.org/  (Follow "Generate Keys" link in the header menu) Open certification suite at https://ltiadvantagevalidator.imsglobal.org/ltiplatform (requires IMS login) Proceed through to the Tool configuration page Log into Moodle as System Administrator Create a manual tool: set LTI version to 1.3 paste in the public key generated above copy the Tool End-Point to Receive Launches URL into the Tool URL field copy the OIDC Login Initiation URL into the Initiate Login URL field copy both the Tool OIDC Launch Redirect URL and the Tool OIDC Redirect Deep Linking URL as separate lines in the Redirection URI(s) field click on Show more... check the Content-Item Message checkbox copy the Tool End-Point to Receive Deep Link Launches URL into the Content Selection URL field select the "Show in activity chooser and as a preconfigure tool" Tool configuration usage option select "New window" for the Default launch container option All Privacy options should be left as Delegate to teacher Select the bottom option for each of the services Save the tool In the certification suite, do not select any of the Start Testing With options Click next for the Platform Configuration page Click the View configuration details icon for the tool in Moodle and copy the details into the certification suite (iss = platform ID, well-known Url = public keyset URL, OAuth Bearer Retrieval Url = access token URL Copy in the generated private key Click next Log into Moodle as Siân Add a link to the new tool in each of the two courses Log into Moodle as John Launch one of the links (should generate a P ayload Received message) Click Continue in the certification suite Run each test: check that you have launched as the user type displayed in the test (learner/student or instructor/teacher) - relaunch the link as the correct user type, if not click on Test options click Submit Test click Confirm Results if you get an error it is likely that the launch message has timed out - never click 'confirm results' otherwise the test will always be marked as failed - just launch again and re-run the test click in Next Test repeat! NB ignore any error with the lti11_legacy_user_id At some point the tool will need to be re-configured to stop sending personal data - this can be done via the settings for the link being used to launch from (see the privacy section) At some point it will ask you to launch as an Instructor so you will need to log out and back in as Siân (set the Privacy options to send personal data when you do - you will be asked again later to disable them) A deep linking payload is generated by clicking on the Select content button when adding a new instance Check the clean_access_tokens task after running at least one service test above: inspect the lti_access_tokens table - it should contain at least one access token issued for the service being tested wait at least an hour and then wait up to 24 hours for the scheduled task to be run inspect the lti_access_tokens table - all the access tokens previously found in table should have been deleted (if no further access tokens have been issued, then the table should be empty) Run unit tests