--- loncom/Lond.pm	2022/02/14 02:48:49	1.19
+++ loncom/Lond.pm	2022/02/16 00:06:08	1.20
@@ -1,6 +1,6 @@
 # The LearningOnline Network
 #
-# $Id: Lond.pm,v 1.19 2022/02/14 02:48:49 raeburn Exp $
+# $Id: Lond.pm,v 1.20 2022/02/16 00:06:08 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -42,6 +42,7 @@ use Crypt::OpenSSL::X509;
 use Crypt::X509::CRL;
 use Crypt::PKCS10;
 use Net::OAuth;
+use Crypt::CBC;
 
 sub dump_with_regexp {
     my ( $tail, $clientversion ) = @_;
@@ -1063,7 +1064,7 @@ sub store_dom {
     $allkeys.='timestamp';
     $hashref->{"$version:keys:$rid"}=$allkeys;
     &untie_user_hash($hashref) or
-        return "error: ".($!+0)." untie(GDBM) Failed while attempting $cmd";    
+        return "error: ".($!+0)." untie(GDBM) Failed while attempting $cmd";
     return 'ok';
 }
 
@@ -1140,9 +1141,22 @@ sub crslti_itemid {
 
     return if (!keys(%crslti_by_key));
 
+    my %courselti = &Apache::lonnet::get_course_lti($cnum,$cdom,'provider');
+
     if (ref($crslti_by_key{$consumer_key}) eq 'ARRAY') {
         foreach my $id (@{$crslti_by_key{$consumer_key}}) {
             my $secret = $crslti{$id}{'secret'};
+            if (ref($courselti{$id}) eq 'HASH') {
+                if ((exists($courselti{$id}{'cipher'})) &&
+                    ($courselti{$id}{'cipher'} =~ /^\d+$/)) {
+                    my $keynum = $courselti{$id}{'cipher'};
+                    my $privkey = &get_dom("getdom:$cdom:private:$keynum:lti:key");
+                    if ($privkey ne '') {
+                        my $cipher = new Crypt::CBC($privkey);
+                        $secret = $cipher->decrypt_hex($secret);
+                    }
+                }
+            }
             my $request = Net::OAuth->request('request token')->from_hash($params,
                                               request_url => $url,
                                               request_method => $method,