--- loncom/Lond.pm	2023/05/22 21:10:56	1.22
+++ loncom/Lond.pm	2023/06/02 01:20:28	1.23
@@ -1,6 +1,6 @@
 # The LearningOnline Network
 #
-# $Id: Lond.pm,v 1.22 2023/05/22 21:10:56 raeburn Exp $
+# $Id: Lond.pm,v 1.23 2023/06/02 01:20:28 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -1197,6 +1197,9 @@ sub domlti_itemid {
         $name = $context;
     } else {
         $name = 'lti';
+        if ($context eq '') {
+            $context = 'provider';
+        }
     }
     $cachename = $name.'enc';
     my %ltienc;
@@ -1257,10 +1260,10 @@ sub domlti_itemid {
     return $itemid;
 }
 
-sub sign_params {
-    my ($cdom,$cnum,$crstool,$url,$idx,$keynum,$post,$loncaparev,$paramsref,$inforef) = @_;
+sub sign_lti_payload {
+    my ($cdom,$cnum,$crsdef,$type,$context,$url,$idx,$keynum,$loncaparev,$paramsref,$inforef) = @_;
     return unless (ref($paramsref) eq 'HASH');
-    my ($sigmethod,$type,$callback);
+    my ($sigmethod,$callback,$reqtype,$reqmethod,$respfmt,$bodyhash);
     if (ref($inforef) eq 'HASH') {
         if (exists($inforef->{'method'})) {
             $sigmethod = $inforef->{'method'};
@@ -1268,54 +1271,143 @@ sub sign_params {
         if (exists($inforef->{'cb'})) {
             $callback = $inforef->{'cb'};
         }
-        if (exists($inforef->{'type'})) {
-            $type = $inforef->{'type'};
+        if (exists($inforef->{'reqtype'})) {
+            $reqtype = $inforef->{'reqtype'};
+        }
+        if (exists($inforef->{'reqmethod'})) {
+            $reqmethod = $inforef->{'reqmethod'};
+        }
+        if (exists($inforef->{'body_hash'})) {
+            $bodyhash = $inforef->{'body_hash'};
         }
+        if (exists($inforef->{'respfmt'})) {
+            $respfmt = $inforef->{'respfmt'};
+        }
+    }
+    my ($key,$secret) = &get_lti_credentials($cdom,$cnum,$crsdef,$type,$idx,$keynum,$loncaparev);
+    return if (($key eq '') || ($secret eq ''));
+    if ($sigmethod eq '') {
+        $sigmethod = 'HMAC-SHA1';
+    }
+    if ($callback eq '') {
+        $callback = 'about:blank',
+    }
+    if ($reqtype eq '') {
+        $reqtype = 'request token';
     }
-    my ($cachename,$hashid,$key,$secret,%ltitoolsenc);
-    if ($crstool) {
-        $cachename = 'crsltitoolsenc';
+    if ($reqmethod eq '') {
+        $reqmethod = 'POST';
+    }
+    srand( time() ^ ($$ + ($$ << 15))  ); # Seed rand.
+    my $nonce = Digest::SHA::sha1_hex(sprintf("%06x%06x",rand(0xfffff0),rand(0xfffff0)));
+    my $request;
+    if (($context eq 'grade') && ($reqtype eq 'consumer') && ($bodyhash ne '')) { 
+        $request = Net::OAuth->request($reqtype)->new(
+                           consumer_key => $key,
+                           consumer_secret => $secret,
+                           request_url => $url,
+                           request_method => $reqmethod,
+                           signature_method => $sigmethod,
+                           timestamp => time(),
+                           nonce => $nonce,
+                           body_hash => $bodyhash,
+        );
+        $request->add_required_message_params('body_hash');
+    } else {
+        $request = Net::OAuth->request($reqtype)->new(
+            consumer_key => $key,
+            consumer_secret => $secret,
+            request_url => $url,
+            request_method => 'POST',
+            signature_method => $sigmethod,
+            timestamp => time,
+            nonce => $nonce,
+            callback => $callback,
+            extra_params => $paramsref,
+            version      => '1.0',
+            );
+    }
+    $request->sign();
+    if ($respfmt eq 'to_post_body') {
+        return $request->to_post_body();
+    } elsif ($respfmt eq 'to_authorization_header') {
+        return $request->to_authorization_header();
+    } else {
+        return $request->to_hash();
+    }
+}
+
+sub get_lti_credentials {
+    my ($cdom,$cnum,$crsdef,$type,$idx,$keynum,$loncaparev) = @_;
+    my ($dbname,$name,$cachename,$hashid,$key,$secret,%ltienc);
+    if ($crsdef) {
         $hashid = $cdom.'_'.$cnum;
     } else {
-        $cachename = 'ltitoolsenc';
         $hashid = $cdom;
     }
+    if ($type eq 'tools') {
+        if ($crsdef) {
+            $dbname = 'nohist_toolsenc';
+            $cachename = 'crsltitoolsenc';
+        } else {
+            $name = 'ltitools';
+            $dbname = 'encconfig';
+            $cachename = 'ltitoolsenc';
+        }
+    } elsif ($type eq 'linkprot') {
+        if ($crsdef) {
+            $dbname = 'nohist_ltienc';
+            $cachename = 'courseltienc';
+        } else {
+            $name = 'linkprot';
+            $dbname = 'encconfig';
+            $cachename = 'linkprotenc';
+        }
+    } elsif ($type eq 'lti') {
+        $name = 'lti';
+        $dbname = 'encconfig';
+        $cachename = 'ltienc';
+    }
     my ($encresult,$enccached)=&Apache::lonnet::is_cached_new($cachename,$hashid);
     if (defined($enccached)) {
         if (ref($encresult) eq 'HASH') {
-            %ltitoolsenc = %{$encresult};
+            %ltienc = %{$encresult};
         }
     } else {
-        if ($crstool) {
-            my $reply = &dump_with_regexp(join(":",($cdom,$cnum,'nohist_toolsenc','','')),$loncaparev);
-            %ltitoolsenc = %{&Apache::lonnet::unserialize($reply)};
+        if ($crsdef) {
+            my $reply = &dump_with_regexp(join(":",($cdom,$cnum,$dbname,'','')),$loncaparev);
+            %ltienc = %{&Apache::lonnet::unserialize($reply)};
         } else {
-            my $reply = &get_dom("getdom:$cdom:encconfig:ltitools");
-            my $ltitoolsencref = &Apache::lonnet::thaw_unescape($reply);
-            if (ref($ltitoolsencref) eq 'HASH') {
-                %ltitoolsenc = %{$ltitoolsencref};
+            my $reply = &get_dom("getdom:$cdom:$dbname:$name");
+            my $encref = &Apache::lonnet::thaw_unescape($reply);
+            if (ref($encref) eq 'HASH') {
+                %ltienc = %{$encref};
             }
         }
         my $cachetime = 24*60*60;
-        &Apache::lonnet::do_cache_new($cachename,$hashid,\%ltitoolsenc,$cachetime);
+        &Apache::lonnet::do_cache_new($cachename,$hashid,\%ltienc,$cachetime);
     }
-    if (!keys(%ltitoolsenc)) {
-         return;
-    } elsif (exists($ltitoolsenc{$idx})) {
-        if (ref($ltitoolsenc{$idx}) eq 'HASH') {
-            if (exists($ltitoolsenc{$idx}{'key'})) {
-                $key = $ltitoolsenc{$idx}{'key'};
-            }
-            if (exists($ltitoolsenc{$idx}{'secret'})) {
-                $secret = $ltitoolsenc{$idx}{'secret'};
-                my $privhost;
+    if (!keys(%ltienc)) {
+         return ();
+    } elsif (exists($ltienc{$idx})) {
+        if (ref($ltienc{$idx}) eq 'HASH') {
+            if (exists($ltienc{$idx}{'key'})) {
+                $key = $ltienc{$idx}{'key'};
+            }
+            if (exists($ltienc{$idx}{'secret'})) {
+                $secret = $ltienc{$idx}{'secret'};
                 if ($keynum =~ /^\d+$/) {
-                    if ($crstool) {
+                    my $privhost;
+                    my $privname = 'ltitools';
+                    if (($type eq 'lti') || ($type eq 'linkprot')) {
+                        $privname = 'lti';
+                    }
+                    if ($crsdef) {
                         my $primary = &Apache::lonnet::domain($cdom,'primary');
                         my @ids = &Apache::lonnet::current_machine_ids();
                         unless (grep(/^\Q$primary\E$/,@ids)) {
                             $privhost = $primary;
-                            my ($result,$plainsecret) = &decrypt_secret($privhost,$secret,$keynum,'ltitools');
+                            my ($result,$plainsecret) = &decrypt_secret($privhost,$secret,$keynum,$privname);
                             if ($result eq 'ok') {
                                 $secret = $plainsecret;
                             } else {
@@ -1324,7 +1416,7 @@ sub sign_params {
                         }
                     }
                     unless ($privhost) {
-                        my $privkey = &get_dom("getdom:$cdom:private:$keynum:ltitools:key");
+                        my $privkey = &get_dom("getdom:$cdom:private:$keynum:$privname:key");
                         if (($privkey ne '') && ($secret ne '')) {
                             my $cipher = new Crypt::CBC($privkey);
                             $secret = $cipher->decrypt_hex($secret);
@@ -1336,36 +1428,7 @@ sub sign_params {
             }
         }
     }
-    return if (($key eq '') || ($secret eq ''));
-    if ($sigmethod eq '') {
-        $sigmethod = 'HMAC-SHA1';
-    }
-    if ($type eq '') {
-        $type = 'request token';
-    }
-    if ($callback eq '') {
-        $callback = 'about:blank',
-    }
-    srand( time() ^ ($$ + ($$ << 15))  ); # Seed rand.
-    my $nonce = Digest::SHA::sha1_hex(sprintf("%06x%06x",rand(0xfffff0),rand(0xfffff0)));
-    my $request = Net::OAuth->request($type)->new(
-            consumer_key => $key,
-            consumer_secret => $secret,
-            request_url => $url,
-            request_method => 'POST',
-            signature_method => $sigmethod,
-            timestamp => time,
-            nonce => $nonce,
-            callback => $callback,
-            extra_params => $paramsref,
-            version      => '1.0',
-            );
-    $request->sign();
-    if ($post) {
-        return $request->to_post_body();
-    } else {
-        return $request->to_hash();
-    }
+    return ($key,$secret);
 }
 
 sub decrypt_secret {