[Summary view]

Differences Between: [Versions 401 and 402] [Versions 401 and 403]

   1  <?php
   2  // This file is part of Moodle - http://moodle.org/
   3  //
   4  // Moodle is free software: you can redistribute it and/or modify
   5  // it under the terms of the GNU General Public License as published by
   6  // the Free Software Foundation, either version 3 of the License, or
   7  // (at your option) any later version.
   8  //
   9  // Moodle is distributed in the hope that it will be useful,
  10  // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  // GNU General Public License for more details.
  13  //
  14  // You should have received a copy of the GNU General Public License
  15  // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  16  
  17  /**
  18   * LTI Advantage Initiate Dynamic Registration endpoint.
  19   *
  20   * https://www.imsglobal.org/spec/lti-dr/v1p0
  21   *
  22   * This endpoint handles the Registration Initiation Launch, in which a platform (via the user agent) sends their
  23   * OpenID config URL and an optional registration token (to be used as the access token in the registration request).
  24   *
  25   * The code then makes the required dynamic registration calls, namely:
  26   * 1. It fetches the platform's OpenID config by making a GET request to the provided OpenID config URL.
  27   * 2. It then POSTS a client registration request (along with the registration token provided by the platform),
  28   *
  29   * Finally, the code returns to the user agent signalling a completed registration, via a HTML5 web message
  30   * (postMessage). This lets the browser know the window may be closed.
  31   *
  32   * @package    enrol_lti
  33   * @copyright  2021 Jake Dallimore <jrhdallimore@gmail.com
  34   * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  35   */
  36  
  37  use enrol_lti\local\ltiadvantage\repository\application_registration_repository;
  38  use enrol_lti\local\ltiadvantage\repository\context_repository;
  39  use enrol_lti\local\ltiadvantage\repository\deployment_repository;
  40  use enrol_lti\local\ltiadvantage\repository\resource_link_repository;
  41  use enrol_lti\local\ltiadvantage\repository\user_repository;
  42  use enrol_lti\local\ltiadvantage\service\application_registration_service;
  43  
  44  require_once(__DIR__."/../../config.php");
  45  global $OUTPUT, $PAGE, $CFG, $SITE;
  46  require_once($CFG->libdir . '/filelib.php');
  47  
  48  $PAGE->set_context(context_system::instance());
  49  $PAGE->set_pagelayout('popup');
  50  
  51  // URL to the platform's OpenID configuration.
  52  $openidconfigurl = required_param('openid_configuration', PARAM_URL);
  53  
  54  // Token generated by the platform, which must be sent back in registration request.
  55  $regtoken = required_param('registration_token', PARAM_RAW);
  56  if (!preg_match('/[a-zA-Z0-9-_.]+/', $regtoken)) { // 0 on no match, FALSE on error.
  57      throw new coding_exception('Invalid registration_token.');
  58  }
  59  
  60  // Moodle-specific token used to secure the dynamic registration URL.
  61  $token = required_param('token', PARAM_ALPHANUM);
  62  
  63  $appregservice = new application_registration_service(
  64      new application_registration_repository(),
  65      new deployment_repository(),
  66      new resource_link_repository(),
  67      new context_repository(),
  68      new user_repository()
  69  );
  70  
  71  // Using the application registration repo, find the incomplete registration using its unique id.
  72  $appregrepo = new application_registration_repository();
  73  $draftreg = $appregrepo->find_by_uniqueid($token);
  74  if (is_null($draftreg) || $draftreg->is_complete()) {
  75      throw new moodle_exception('invalidexpiredregistrationurl', 'enrol_lti');
  76  }
  77  
  78  // Get the OpenID config from the platform.
  79  $curl = new curl();
  80  $openidconfig = $curl->get($openidconfigurl);
  81  $errno = $curl->get_errno();
  82  if ($errno !== 0) {
  83      throw new coding_exception("Error '{$errno}' while getting OpenID config from platform: {$openidconfig}");
  84  }
  85  $openidconfig = json_decode($openidconfig);
  86  if (json_last_error() !== JSON_ERROR_NONE) {
  87      throw new moodle_exception('ltiadvdynregerror:invalidopenidconfigjson', 'enrol_lti');
  88  }
  89  
  90  $regendpoint = $openidconfig->registration_endpoint ?? null;
  91  if (empty($regendpoint)) {
  92      throw new coding_exception('Missing registration endpoint in OpenID configuration');
  93  }
  94  
  95  // Build the client registration request to send to the platform.
  96  $wwwrooturl = $CFG->wwwroot;
  97  $parsed = parse_url($wwwrooturl);
  98  $sitefullname = format_string(get_site()->fullname);
  99  $scopes = [
 100      'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem',
 101      'https://purl.imsglobal.org/spec/lti-ags/scope/result.readonly',
 102      'https://purl.imsglobal.org/spec/lti-ags/scope/score',
 103      'https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly',
 104  ];
 105  
 106  $regrequest = (object) [
 107      'application_type' => 'web',
 108      'grant_types' => ['client_credentials', 'implicit'],
 109      'response_types' => ['id_token'],
 110      'initiate_login_uri' => $CFG->wwwroot . '/enrol/lti/login.php?id=' . $draftreg->get_uniqueid(),
 111      'redirect_uris' => [
 112          $CFG->wwwroot . '/enrol/lti/launch.php',
 113          $CFG->wwwroot . '/enrol/lti/launch_deeplink.php',
 114      ],
 115       // TODO: Consider whether to support client_name#ja syntax for multi language support - see MDL-73109.
 116      'client_name' => format_string($SITE->fullname, true, ['context' => context_system::instance()]),
 117      'jwks_uri' => $CFG->wwwroot . '/enrol/lti/jwks.php',
 118      'logo_uri' => $OUTPUT->get_compact_logo_url() ? $OUTPUT->get_compact_logo_url()->out(false) : '',
 119      'token_endpoint_auth_method' => 'private_key_jwt',
 120      'scope' => implode(" ", $scopes),
 121      'https://purl.imsglobal.org/spec/lti-tool-configuration' => [
 122          'domain' => $parsed['host'],
 123          'target_link_uri' => $CFG->wwwroot . '/enrol/lti/launch.php',
 124          'custom_parameters' => [],
 125          'claims' => [
 126              'iss',
 127              'sub',
 128              'aud',
 129              'given_name',
 130              'family_name',
 131              'email',
 132              'picture',
 133          ],
 134          'messages' => [
 135              (object) [
 136                  'type' => 'LtiDeepLinkingRequest',
 137                  'allowLearner' => false,
 138                  'target_link_uri' => $CFG->wwwroot . '/enrol/lti/launch_deeplink.php',
 139                   // TODO: Consider whether to support label#ja syntax for multi language support - see MDL-73109.
 140                  'label' => get_string('registrationdeeplinklabel', 'enrol_lti', $sitefullname),
 141                  'placements' => [
 142                      "ContentArea"
 143                  ],
 144              ],
 145              (object) [
 146                  'type' => 'LtiResourceLinkRequest',
 147                  'allowLearner' => true,
 148                  'target_link_uri' => $CFG->wwwroot . '/enrol/lti/launch.php',
 149                  // TODO: Consider whether to support label#ja syntax for multi language support - see MDL-73109.
 150                  'label' => get_string('registrationresourcelinklabel', 'enrol_lti', $sitefullname),
 151                  'placements' => [
 152                      "ContentArea"
 153                  ],
 154              ],
 155          ]
 156      ]
 157  ];
 158  
 159  $curl->setHeader(['Authorization: Bearer ' . $regtoken]);
 160  $regrequest = json_encode($regrequest);
 161  $regresponse = $curl->post($regendpoint, $regrequest);
 162  $errno = $curl->get_errno();
 163  if ($errno !== 0) {
 164      throw new coding_exception("Error '{$errno}' while posting client registration request to client: {$regresponse}");
 165  }
 166  
 167  if ($regresponse) {
 168      $regresponse = json_decode($regresponse);
 169      if ($regresponse->client_id) {
 170          $toolconfig = $regresponse->{'https://purl.imsglobal.org/spec/lti-tool-configuration'};
 171  
 172          if ($appregrepo->find_by_platform($openidconfig->issuer, $regresponse->client_id)) {
 173              throw new moodle_exception('existingregistrationerror', 'enrol_lti');
 174          }
 175  
 176          // Registration of the tool on the platform was successful.
 177          // Now update the platform details in the registration and mark it complete.
 178          $draftreg->set_accesstokenurl(new moodle_url($openidconfig->token_endpoint));
 179          $draftreg->set_authenticationrequesturl(new moodle_url($openidconfig->authorization_endpoint));
 180          $draftreg->set_clientid($regresponse->client_id);
 181          $draftreg->set_jwksurl(new moodle_url($openidconfig->jwks_uri));
 182          $draftreg->set_platformid(new moodle_url($openidconfig->issuer));
 183          $draftreg->complete_registration();
 184          $appreg = $appregrepo->save($draftreg);
 185  
 186          $deployment = $appreg->add_tool_deployment($toolconfig->deployment_id, $toolconfig->deployment_id);
 187          $deploymentrepo = new deployment_repository();
 188          $deploymentrepo->save($deployment);
 189      }
 190  }
 191  
 192  echo "<script>
 193  (window.opener || window.parent).postMessage({subject: 'org.imsglobal.lti.close'}, '$openidconfig->issuer');
 194  </script>";