Unlike other authentication methods, LTI does not load a plugin configuration or offer a settings menu for customizing the hypothetical configuration.

There are at least two setting types that I could see being very useful and very easy to implement:

One is an option to prefer the value of lis_person_sourcedid from launch or member data, if provided, instead of a hashed user_id.

This is valuable if the Moodle LTI Tool needs to itself launch LTI tools that depend on the canonical school-issued username.

The other is allowing site administrators to lock specific profile fields from user editing, similar to how other plugins work (and loading the configuration so that those field lock values are evaluated). (Hence the "Could be a security issue" since students would be able to change their email address, for example, to anything that can be validated.)

More ambitiously, the settings form could consume custom metadata to populate fields in the user table (for example, I ran into these issues when auditing whether idnumber was being used for anything and saw that a handful of well-meaning students were filling out empty profile fields). That feature could extend the first proposed setting above, where a field in custom metadata would be used instead of either lis_person_sourcedid in the hashed user_id provided by the platform.

This is a different improvement than consuming group information, although that would also come from platform custom metadata, as enrol_lti would need to handle that and not auth_lti, where I believe these settings are most apt.

Would there be any wider interest in this or other auth_lti plugin configuration values that would be useful?