first commit

auth/lti/classes/local/ltiadvantage/entity/user_migration_claim.php

@@ -0,0 +1,150 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\entity;
+
+/**
+ * A simplified representation of a 'https://purl.imsglobal.org/spec/lti/claim/lti1p1' migration claim.
+ *
+ * This serves the purpose of migrating a legacy user account only. Claim properties that do not relate to user migration are not
+ * included or handled by this representation.
+ *
+ * See https://www.imsglobal.org/spec/lti/v1p3/migr#lti-1-1-migration-claim
+ *
+ * @package auth_lti
+ * @copyright 2021 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class user_migration_claim {
+
+    /** @var string the LTI 1.1 consumer key */
+    private $consumerkey;
+
+    /** @var string the LTI 1.1 user identifier.
+     * This is only included in the claim if it differs to the value included in the LTI 1.3 'sub' claim.
+     * If not included, the value will be taken from 'sub'.
+     */
+    private $userid;
+
+    /**
+     * The migration_claim constructor.
+     *
+     * The signature of a migration claim must be verifiable. To achieve this, the constructor takes a list of secrets
+     * corresponding to the 'oauth_consumer_key' provided in the 'https://purl.imsglobal.org/spec/lti/claim/lti1p1'
+     * claim. How these secrets are determined is not the responsibility of this class. The constructor assumes these
+     * correspond.
+     *
+     * @param array $jwt the array of claim data, as received in a resource link launch JWT.
+     * @param array $consumersecrets a list of consumer secrets for the consumerkey included in the migration claim.
+     * @throws \coding_exception if the claim data is invalid.
+     */
+    public function __construct(array $jwt, array $consumersecrets) {
+        // Can't get a claim instance without the claim data.
+        if (empty($jwt['https://purl.imsglobal.org/spec/lti/claim/lti1p1'])) {
+            throw new \coding_exception("Missing the 'https://purl.imsglobal.org/spec/lti/claim/lti1p1' JWT claim");
+        }
+        $claim = $jwt['https://purl.imsglobal.org/spec/lti/claim/lti1p1'];
+
+        // The oauth_consumer_key property MUST be sent.
+        // See: https://www.imsglobal.org/spec/lti/v1p3/migr#oauth_consumer_key.
+        if (empty($claim['oauth_consumer_key'])) {
+            throw new \coding_exception("Missing 'oauth_consumer_key' property in lti1p1 migration claim.");
+        }
+
+        // The oauth_consumer_key_sign property MAY be sent.
+        // For user migration to take place, however, this is deemed a required property since Moodle identified its
+        // legacy users through a combination of consumerkey and userid.
+        // See: https://www.imsglobal.org/spec/lti/v1p3/migr#oauth_consumer_key_sign.
+        if (empty($claim['oauth_consumer_key_sign'])) {
+            throw new \coding_exception("Missing 'oauth_consumer_key_sign' property in lti1p1 migration claim.");
+        }
+
+        if (!$this->verify_signature(
+            $claim['oauth_consumer_key'],
+            $claim['oauth_consumer_key_sign'],
+            $jwt['https://purl.imsglobal.org/spec/lti/claim/deployment_id'],
+            $jwt['iss'],
+            $jwt['aud'],
+            $jwt['exp'],
+            $jwt['nonce'],
+            $consumersecrets
+        )) {
+            throw new \coding_exception("Invalid 'oauth_consumer_key_sign' signature in lti1p1 claim.");
+        }
+
+        $this->consumerkey = $claim['oauth_consumer_key'];
+        $this->userid = $claim['user_id'] ?? $jwt['sub'];
+    }
+
+    /**
+     * Verify the claim signature by recalculating it using the launch data and cross-checking consumer secrets.
+     *
+     * @param string $consumerkey the LTI 1.1 consumer key.
+     * @param string $signature a signature of the LTI 1.1 consumer key and associated launch data.
+     * @param string $deploymentid the deployment id included in the launch.
+     * @param string $platform the platform included in the launch.
+     * @param string $clientid the client id included in the launch.
+     * @param string $exp the exp included in the launch.
+     * @param string $nonce the nonce included in the launch.
+     * @param array $consumersecrets the list of consumer secrets used with the given $consumerkey param
+     * @return bool true if the signature was verified, false otherwise.
+     */
+    private function verify_signature(string $consumerkey, string $signature, string $deploymentid, string $platform,
+        string $clientid, string $exp, string $nonce, array $consumersecrets): bool {
+
+        $base = [
+            $consumerkey,
+            $deploymentid,
+            $platform,
+            $clientid,
+            $exp,
+            $nonce
+        ];
+        $basestring = implode('&', $base);
+
+        // Legacy enrol_lti code permits tools to share a consumer key but use different secrets. This results in
+        // potentially many secrets per mapped tool consumer. As such, when generating the migration claim it's
+        // impossible to know which secret the platform will use to sign the consumer key. The consumer key in the
+        // migration claim is thus verified by trying all known secrets for the consumer, until either a match is found
+        // or no signatures match.
+        foreach ($consumersecrets as $consumersecret) {
+            $calculatedsignature = base64_encode(hash_hmac('sha256', $basestring, $consumersecret));
+
+            if ($signature === $calculatedsignature) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Return the consumer key stored in the claim.
+     *
+     * @return string the consumer key included in the claim.
+     */
+    public function get_consumer_key(): string {
+        return $this->consumerkey;
+    }
+
+    /**
+     * Return the LTI 1.1 user id stored in the claim.
+     *
+     * @return string the user id, or null if not provided in the claim.
+     */
+    public function get_user_id(): string {
+        return $this->userid;
+    }
+}

auth/lti/classes/local/ltiadvantage/event/event_handler.php

@@ -0,0 +1,48 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\event;
+
+use auth_lti\local\ltiadvantage\utility\cookie_helper;
+use core\event\user_loggedin;
+
+/**
+ * Event handler for auth_lti.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class event_handler {
+
+    /**
+     * Allows the plugin to augment Set-Cookie headers when the user_loggedin event is fired as part of complete_user_login() calls.
+     *
+     * @param user_loggedin $event the event
+     * @return void
+     */
+    public static function handle_user_loggedin(user_loggedin $event): void {
+        // The event data isn't important here. The intent of this listener is to ensure that the MoodleSession cookie is set up
+        // properly during LTI launches + login. This means two things:
+        // i) it's set with SameSite=None; Secure; where possible (since OIDC needs HTTPS this will almost always be possible).
+        // ii) it set with the 'Partitioned' attribute, when required.
+        // The former ensures cross-site cookies are sent for embedded launches. The latter is an opt-in flag needed to use Chrome's
+        // partitioning mechanism, CHIPS.
+        if (cookie_helper::cookies_supported()) {
+            cookie_helper::setup_session_cookie();
+        }
+    }
+}

auth/lti/classes/local/ltiadvantage/utility/cookie_helper.php

@@ -0,0 +1,173 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\local\ltiadvantage\utility;
+use core\session\utility\cookie_helper as core_cookie_helper;
+
+/**
+ * Helper class providing utils dealing with cookies in LTI, particularly 3rd party cookies.
+ *
+ * @package    auth_lti
+ * @copyright  2024 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class cookie_helper {
+
+    /** @var int Cookies are not supported. */
+    public const COOKIE_METHOD_NOT_SUPPORTED = 0;
+
+    /** @var int Cookies are supported without explicit partitioning. */
+    public const COOKIE_METHOD_NO_PARTITIONING = 1;
+
+    /** @var int Cookies are supported via explicit partitioning. */
+    public const COOKIE_METHOD_EXPLICIT_PARTITIONING = 2;
+
+    /**
+     * Check whether cookies can be used with the current user agent and, if so, via what method they are set.
+     *
+     * Currently, this tries 2 modes of setting a test cookie:
+     * 1. Setting a SameSite=None, Secure cookie. This will work in any first party context, and in 3rd party contexts for
+     * any browsers supporting automatic partitioning of 3rd party cookies (E.g. Firefox, Brave).
+     * 2. If 1 fails, setting a cookie with the Chrome 'Partitioned' attribute included, opting that cookie into CHIPS. This will
+     * work for Chrome.
+     *
+     * Upon completion of the cookie check, the check sets a SESSION flag indicating the method used to set the cookie, and upgrades
+     * the session cookie ('MoodleSession') using the respective method. This ensure the session cookie will continue to be sent.
+     *
+     * Then, the following methods can be used by client code to query whether the UA supports cookies, and how:
+     * @see self::cookies_supported() - whether it could be set at all.
+     * @see self::get_cookies_supported_mode() - if a cookie could be set, what mode was used to set it.
+     *
+     * This permits client code to make sure it's setting its cookies appropriately (via the advertised method), and allows it to
+     * present notices - such as in the case where a given UA is found to be lacking the requisite cookie support.
+     * E.g.
+     * cookie_helper::do_cookie_check($mypageurl);
+     * if (!cookie_helper::cookies_supported()) {
+     *     // Print a notice stating that cookie support is required.
+     * }
+     * // Elsewhere in other client code...
+     * if (cookie_helper::get_cookies_supported_mode() === cookie_helper::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+     *     // Set a cookie, making sure to use the helper to also opt-in to partitioning.
+     *     setcookie('myauthcookie', 'myauthcookievalue', ['samesite' => 'None', 'secure' => true]);
+     *     cookie_helper::add_partitioning_to_cookie('myauthcookie');
+     * }
+     *
+     * @param \moodle_url $pageurl the URL of the page making the check, used to redirect back to after setting test cookies.
+     * @return void
+     */
+    public static function do_cookie_check(\moodle_url $pageurl): void {
+        global $_COOKIE, $SESSION, $CFG;
+        $cookiecheck1 = optional_param('cookiecheck1', null, PARAM_INT);
+        $cookiecheck2 = optional_param('cookiecheck2', null, PARAM_INT);
+
+        if (empty($cookiecheck1)) {
+            // Start the cookie check. Set two test cookies - one samesite none, and one partitioned - and redirect.
+            // Set cookiecheck to show the check has started.
+            self::set_test_cookie('cookiecheck1', self::COOKIE_METHOD_NO_PARTITIONING);
+            self::set_test_cookie('cookiecheck2', self::COOKIE_METHOD_EXPLICIT_PARTITIONING, true);
+            $pageurl->params([
+                'cookiecheck1' => self::COOKIE_METHOD_NO_PARTITIONING,
+                'cookiecheck2' => self::COOKIE_METHOD_EXPLICIT_PARTITIONING,
+            ]);
+
+            // LTI needs to guarantee the 'SameSite=None', 'Secure' (and sometimes 'Partitioned') attributes are set on the
+            // MoodleSession cookie. This is done via manipulation of the outgoing headers after the cookie check redirect. To
+            // guarantee these outgoing Set-Cookie headers will be created after the redirect, expire the current cookie.
+            core_cookie_helper::expire_moodlesession();
+
+            redirect($pageurl);
+        } else {
+            // Have already started a cookie check, so check the result.
+            $cookie1received = isset($_COOKIE['cookiecheck1']) && $_COOKIE['cookiecheck1'] == $cookiecheck1;
+            $cookie2received = isset($_COOKIE['cookiecheck2']) && $_COOKIE['cookiecheck2'] == $cookiecheck2;
+
+            if ($cookie1received || $cookie2received) {
+                // The test cookie could be set and received.
+                // Set a session flag storing the method used to set it, and make sure the session cookie uses this method.
+                $cookiemethod = $cookie1received ? self::COOKIE_METHOD_NO_PARTITIONING : self::COOKIE_METHOD_EXPLICIT_PARTITIONING;
+                $SESSION->auth_lti_cookie_method = $cookiemethod;
+
+                self::setup_session_cookie();
+            }
+        }
+    }
+
+    /**
+     * If a cookie check has been made, returns whether cookies could be set or not.
+     *
+     * @return bool whether cookies are supported or not.
+     */
+    public static function cookies_supported(): bool {
+        return self::get_cookies_supported_method() !== self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * If a cookie check has been made, gets the method used to set a cookie, or self::COOKIE_METHOD_NOT_SUPPORTED if not supported.
+     *
+     * For cookie methods:
+     * @see self::COOKIE_METHOD_NOT_SUPPORTED
+     * @see self::COOKIE_METHOD_NO_PARTITIONING
+     * @see self::COOKIE_METHOD_EXPLICIT_PARTITIONING
+     *
+     * @return int the constant representing the method by which the cookie was set, or not.
+     */
+    public static function get_cookies_supported_method(): int {
+        global $SESSION;
+        return $SESSION->auth_lti_cookie_method ?? self::COOKIE_METHOD_NOT_SUPPORTED;
+    }
+
+    /**
+     * Sets up the session cookie according to the method used in the cookie check, and with SameSite=None; Secure attributes.
+     *
+     * @return void
+     */
+    public static function setup_session_cookie(): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        if (is_moodle_cookie_secure()) {
+            $atts = ['SameSite=None', 'Secure'];
+            if (self::get_cookies_supported_method() == self::COOKIE_METHOD_EXPLICIT_PARTITIONING) {
+                $atts[] = 'Partitioned';
+            }
+            core_cookie_helper::add_attributes_to_cookie_response_header('MoodleSession' . $CFG->sessioncookie, $atts);
+        }
+    }
+
+    /**
+     * Set a test cookie, using SameSite=None; Secure; attributes if possible, and with or without partitioning opt-in.
+     *
+     * @param string $name cookie name
+     * @param string $value cookie value
+     * @param bool $partitioned whether to try to add partitioning opt-in, which requires secure cookies (https sites).
+     * @return void
+     */
+    private static function set_test_cookie(string $name, string $value, bool $partitioned = false): void {
+        global $CFG;
+        require_once($CFG->libdir . '/sessionlib.php');
+
+        $atts = ['expires' => time() + 30];
+        if (is_moodle_cookie_secure()) {
+            $atts['samesite'] = 'none';
+            $atts['secure'] = true;
+        }
+        setcookie($name, $value, $atts);
+
+        if (is_moodle_cookie_secure() && $partitioned) {
+            core_cookie_helper::add_attributes_to_cookie_response_header($name, ['Partitioned']);
+        }
+    }
+}

auth/lti/classes/output/renderer.php

@@ -0,0 +1,86 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\output;
+
+use core\output\notification;
+
+/**
+ * Renderer class for auth_lti.
+ *
+ * @package    auth_lti
+ * @copyright  2021 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class renderer extends \plugin_renderer_base {
+    /**
+     * Render the account options view, displayed to instructors on first launch if no account binding exists.
+     *
+     * @param int $provisioningmode the desired account provisioning mode, see auth_plugin_lti constants for details.
+     * @return string the html.
+     */
+    public function render_account_binding_options_page(int $provisioningmode): string {
+
+        $formaction = new \moodle_url('/auth/lti/login.php');
+        $notification = new notification(get_string('firstlaunchnotice', 'auth_lti'), \core\notification::INFO, false);
+        $cancreateaccounts = !get_config('moodle', 'authpreventaccountcreation');
+        if ($provisioningmode == \auth_plugin_lti::PROVISIONING_MODE_PROMPT_EXISTING_ONLY) {
+            $cancreateaccounts = false;
+        }
+
+        $accountinfo = [];
+        if (isloggedin()) {
+            global $USER;
+            $accountinfo = [
+                'firstname' => $USER->firstname,
+                'lastname' => $USER->lastname,
+                'email' => $USER->email,
+                'picturehtml' => $this->output->user_picture($USER,  ['size' => 35, 'class' => 'round']),
+            ];
+        }
+
+        $context = [
+            'isloggedin' => isloggedin(),
+            'info' => $notification->export_for_template($this),
+            'formaction' => $formaction->out(),
+            'sesskey' => sesskey(),
+            'accountinfo' => $accountinfo,
+            'cancreateaccounts' => $cancreateaccounts,
+        ];
+        return parent::render_from_template('auth_lti/local/ltiadvantage/login', $context);
+    }
+
+    /**
+     * Render the page displayed when the account binding is complete, letting the user continue to the launch.
+     *
+     * Callers can provide different messages depending on which type of binding took place. For example, a newly
+     * provisioned account may require a slightly different message to an existing account being linked.
+     *
+     * The return URL is the page the user will be taken back to when they click 'Continue'. This is likely the launch
+     * or deeplink launch endpoint but could be any calling code in LTI which wants to use the account binding workflow.
+     *
+     * @param notification $notification the notification containing the message describing the binding success.
+     * @param \moodle_url $returnurl the URL to return to when the user clicks continue on the rendered page.
+     * @return string the rendered HTML
+     */
+    public function render_account_binding_complete(notification $notification, \moodle_url $returnurl): string {
+        $context = (object) [
+            'notification' => $notification->export_for_template($this),
+            'returnurl' => $returnurl->out()
+        ];
+        return parent::render_from_template('auth_lti/local/ltiadvantage/account_binding_complete', $context);
+    }
+}

auth/lti/classes/privacy/provider.php

@@ -0,0 +1,184 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_lti\privacy;
+
+use core_privacy\local\metadata\collection;
+use core_privacy\local\request\approved_contextlist;
+use core_privacy\local\request\approved_userlist;
+use core_privacy\local\request\context;
+use core_privacy\local\request\contextlist;
+use core_privacy\local\request\transform;
+use core_privacy\local\request\userlist;
+use core_privacy\local\request\writer;
+
+/**
+ * Privacy Subsystem for auth_lti implementing null_provider.
+ *
+ * @copyright  2018 Carlos Escobedo <carlos@moodle.com>
+ * @package    auth_lti
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class provider implements
+    \core_privacy\local\metadata\provider,
+    \core_privacy\local\request\plugin\provider,
+    \core_privacy\local\request\core_userlist_provider {
+
+    /**
+     * Get all contexts contain user information for the given user.
+     *
+     * @param int $userid the id of the user.
+     * @return contextlist the list of contexts containing user information.
+     */
+    public static function get_contexts_for_userid(int $userid): contextlist {
+        $sql = "SELECT ctx.id
+                  FROM {auth_lti_linked_login} ll
+                  JOIN {context} ctx ON ctx.instanceid = ll.userid AND ctx.contextlevel = :contextlevel
+                 WHERE ll.userid = :userid";
+        $params = ['userid' => $userid, 'contextlevel' => CONTEXT_USER];
+        $contextlist = new contextlist();
+        $contextlist->add_from_sql($sql, $params);
+
+        return $contextlist;
+    }
+
+    /**
+     * Export all user data for the user in the identified contexts.
+     *
+     * @param approved_contextlist $contextlist the list of approved contexts for the user.
+     */
+    public static function export_user_data(approved_contextlist $contextlist) {
+        global $DB;
+
+        $user = $contextlist->get_user();
+
+        $linkedlogins = $DB->get_records('auth_lti_linked_login', ['userid' => $user->id], '',
+            'issuer, issuer256, sub, sub256, timecreated, timemodified');
+        foreach ($linkedlogins as $login) {
+            $data = (object)[
+                'timecreated' => transform::datetime($login->timecreated),
+                'timemodified' => transform::datetime($login->timemodified),
+                'issuer' => $login->issuer,
+                'issuer256' => $login->issuer256,
+                'sub' => $login->sub,
+                'sub256' => $login->sub256
+            ];
+            writer::with_context(\context_user::instance($user->id))->export_data([
+                get_string('privacy:metadata:auth_lti', 'auth_lti'), $login->issuer
+            ], $data);
+        }
+
+    }
+
+    /**
+     * Delete all user data for this context.
+     *
+     * @param  \context $context The context to delete data for.
+     */
+    public static function delete_data_for_all_users_in_context(\context $context) {
+        if ($context->contextlevel != CONTEXT_USER) {
+            return;
+        }
+        static::delete_user_data($context->instanceid);
+    }
+
+    /**
+     * Delete user data in the list of given contexts.
+     *
+     * @param approved_contextlist $contextlist the list of contexts.
+     */
+    public static function delete_data_for_user(approved_contextlist $contextlist) {
+        if (empty($contextlist->count())) {
+            return;
+        }
+        $userid = $contextlist->get_user()->id;
+        foreach ($contextlist->get_contexts() as $context) {
+            if ($context->contextlevel != CONTEXT_USER) {
+                continue;
+            }
+            if ($context->instanceid == $userid) {
+                static::delete_user_data($context->instanceid);
+            }
+        }
+    }
+
+    /**
+     * Get the list of users within a specific context.
+     *
+     * @param userlist $userlist The userlist containing the list of users who have data in this context/plugin combination.
+     */
+    public static function get_users_in_context(userlist $userlist) {
+        $context = $userlist->get_context();
+
+        if (!$context instanceof \context_user) {
+            return;
+        }
+
+        $sql = "SELECT userid
+                  FROM {auth_lti_linked_login}
+                 WHERE userid = ?";
+        $params = [$context->instanceid];
+        $userlist->add_from_sql('userid', $sql, $params);
+    }
+
+    /**
+     * Delete multiple users within a single context.
+     *
+     * @param approved_userlist $userlist The approved context and user information to delete information for.
+     */
+    public static function delete_data_for_users(approved_userlist $userlist) {
+        $context = $userlist->get_context();
+
+        if ($context instanceof \context_user) {
+            static::delete_user_data($context->instanceid);
+        }
+    }
+
+    /**
+     * Description of the metadata stored for users in auth_lti.
+     *
+     * @param collection $collection a collection to add to.
+     * @return collection the collection, with relevant metadata descriptions for auth_lti added.
+     */
+    public static function get_metadata(collection $collection): collection {
+        $authfields = [
+            'userid' => 'privacy:metadata:auth_lti:userid',
+            'issuer' => 'privacy:metadata:auth_lti:issuer',
+            'issuer256' => 'privacy:metadata:auth_lti:issuer256',
+            'sub' => 'privacy:metadata:auth_lti:sub',
+            'sub256' => 'privacy:metadata:auth_lti:sub256',
+            'timecreated' => 'privacy:metadata:auth_lti:timecreated',
+            'timemodified' => 'privacy:metadata:auth_lti:timemodified'
+        ];
+
+        $collection->add_database_table('auth_lti_linked_login', $authfields, 'privacy:metadata:auth_lti:tableexplanation');
+        $collection->link_subsystem('core_auth', 'privacy:metadata:auth_lti:authsubsystem');
+
+        return $collection;
+    }
+
+    /**
+     * Delete user data for the user.
+     *
+     * @param  int $userid The id of the user.
+     */
+    protected static function delete_user_data(int $userid) {
+        global $DB;
+
+        // Because we only use user contexts the instance ID is the user ID.
+        $DB->delete_records('auth_lti_linked_login', ['userid' => $userid]);
+    }
+}