Index: lams_admin/conf/language/lams/ApplicationResources_en_AU.properties
===================================================================
diff -u -r2808afde61e72ed316431219a592f53ec2ba05f6 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_admin/conf/language/lams/ApplicationResources_en_AU.properties	(.../ApplicationResources_en_AU.properties)	(revision 2808afde61e72ed316431219a592f53ec2ba05f6)
+++ lams_admin/conf/language/lams/ApplicationResources_en_AU.properties	(.../ApplicationResources_en_AU.properties)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -548,6 +548,6 @@
 label.theme  =Theme
 
 label.2FA.property.enable =Enable two-factor authentication
+sysadmin.lti.consumer.monitor.roles  =Comma-separated list of monitor roles
 
-
 #======= End labels: Exported 540 labels for en AU =====
Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/OrgManageAction.java
===================================================================
diff -u -rc92ea51a973dc03ece970c057dd9369eda6a8c24 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/OrgManageAction.java	(.../OrgManageAction.java)	(revision c92ea51a973dc03ece970c057dd9369eda6a8c24)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/OrgManageAction.java	(.../OrgManageAction.java)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -60,10 +60,6 @@
  * </p>
  *
  * @author <a href="mailto:fyang@melcoe.mq.edu.au">Fei Yang</a>
- *
- *
- *
- *
  */
 public class OrgManageAction extends LamsDispatchAction {
 
Index: lams_admin/web/WEB-INF/struts-config.xml
===================================================================
diff -u -r2808afde61e72ed316431219a592f53ec2ba05f6 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_admin/web/WEB-INF/struts-config.xml	(.../struts-config.xml)	(revision 2808afde61e72ed316431219a592f53ec2ba05f6)
+++ lams_admin/web/WEB-INF/struts-config.xml	(.../struts-config.xml)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -130,6 +130,7 @@
 	<form-property name="disabled" type="java.lang.Boolean" initial="false"/>
 	<form-property name="lessonFinishUrl" type="java.lang.String"/>
 	<form-property name="timeToLiveLoginRequestEnabled" type="java.lang.Boolean" initial="false"/>
+	<form-property name="ltiToolConsumerMonitorRoles" type="java.lang.String"/>
 </form-bean>
 
 <form-bean name="ConfigForm" type="org.apache.struts.action.DynaActionForm">
Index: lams_admin/web/lti/ltiConsumer.jsp
===================================================================
diff -u -rf4e34e708b87e42dea1b6d667135f09840d79aa3 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_admin/web/lti/ltiConsumer.jsp	(.../ltiConsumer.jsp)	(revision f4e34e708b87e42dea1b6d667135f09840d79aa3)
+++ lams_admin/web/lti/ltiConsumer.jsp	(.../ltiConsumer.jsp)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -78,6 +78,10 @@
 			<td><fmt:message key="sysadmin.lessonFinishUrl" />:</td>
 			<td>${lessonFinishUrl}</td>
 		</tr>
+		<tr>
+			<td><fmt:message key="sysadmin.lti.consumer.monitor.roles" />:</td>
+			<td><html:text property="ltiToolConsumerMonitorRoles" size="30"/></td>
+		</tr>
 	</table>
 	
 	<div class="pull-right">
Index: lams_admin/web/organisation/list.jsp
===================================================================
diff -u -rc6582530edf672794ec70ba3e910a262e583f2b5 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_admin/web/organisation/list.jsp	(.../list.jsp)	(revision c6582530edf672794ec70ba3e910a262e583f2b5)
+++ lams_admin/web/organisation/list.jsp	(.../list.jsp)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -2,7 +2,7 @@
 <%@ page import="org.lamsfoundation.lams.usermanagement.Role" %>
 <c:set var="lams"><lams:LAMSURL /></c:set>
 
- <link rel="stylesheet" href="${lams}css/jquery.tablesorter.theme.bootstrap.css">
+<link rel="stylesheet" href="${lams}css/jquery.tablesorter.theme.bootstrap.css">
 <link type="text/css" href="${lams}css/jquery.tablesorter.pager.css" rel="stylesheet">
 <style>
 	table.infoDisplay {
Index: lams_build/lib/lams/lams.jar
===================================================================
diff -u -r75d371089c49a0ebc7dd90f64cb4746079c0b951 -r380ede712d98f28edcaea21f3525f12cc52b3237
Binary files differ
Index: lams_central/src/java/org/lamsfoundation/lams/web/LoginRequestLtiServlet.java
===================================================================
diff -u -r11b64f81e406ff277c7c35988304b0064300de57 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_central/src/java/org/lamsfoundation/lams/web/LoginRequestLtiServlet.java	(.../LoginRequestLtiServlet.java)	(revision 11b64f81e406ff277c7c35988304b0064300de57)
+++ lams_central/src/java/org/lamsfoundation/lams/web/LoginRequestLtiServlet.java	(.../LoginRequestLtiServlet.java)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -97,23 +97,23 @@
 	//verify whether request was correctly signed by OAuth
 	ExtServer extServer = integrationService.getExtServer(consumerKey);
 	String secret = extServer.getServerkey();// retrieve corresponding secret for key from db
-//	LtiVerificationResult ltiResult = null;
-//	try {
-//	    LtiVerifier ltiVerifier = new LtiOauthVerifier();
-//	    ltiResult = ltiVerifier.verify(request, secret);
-//	} catch (LtiVerificationException e) {
-//	    log.error("Authentication error: ", e);
-//	    response.sendError(HttpServletResponse.SC_UNAUTHORIZED,
-//		    "Login Failed - authentication error. " + e.getMessage());
-//	    return;
-//	}
-//	LtiLaunch ltiLaunch = ltiResult.getLtiLaunchResult();
-//	if (!ltiResult.getSuccess()) {
-//	    log.warn("Authentication error: " + ltiResult.getMessage());
-//	    response.sendError(HttpStatus.SC_UNAUTHORIZED,
-//		    "Login Failed - authentication error. " + ltiResult.getMessage());
-//	    return;
-//	}
+	LtiVerificationResult ltiResult = null;
+	try {
+	    LtiVerifier ltiVerifier = new LtiOauthVerifier();
+	    ltiResult = ltiVerifier.verify(request, secret);
+	} catch (LtiVerificationException e) {
+	    log.error("Authentication error: ", e);
+	    response.sendError(HttpServletResponse.SC_UNAUTHORIZED,
+		    "Login Failed - authentication error. " + e.getMessage());
+	    return;
+	}
+	LtiLaunch ltiLaunch = ltiResult.getLtiLaunchResult();
+	if (!ltiResult.getSuccess()) {
+	    log.warn("Authentication error: " + ltiResult.getMessage());
+	    response.sendError(HttpStatus.SC_UNAUTHORIZED,
+		    "Login Failed - authentication error. " + ltiResult.getMessage());
+	    return;
+	}
 
 	//provide default values for user names, as we can't fetch them from LTI Tool consumer
 	if (StringUtils.isBlank(firstName)) {
@@ -124,14 +124,15 @@
 	}
 	ExtServerLessonMap lesson = integrationService.getLtiConsumerLesson(consumerKey, resourceLinkId);
 
-	//determine method based on role parameter
+	//Determine method based on role parameter. Monitor roles can be either LTI standard ones or tool consumer's custom ones set
 	String method;
-	if (LtiUtils.isLearner(roles) && !LtiUtils.isStaff(roles) && !LtiUtils.isAdmin(roles)) {
-	    method = LoginRequestDispatcher.METHOD_LEARNER_STRICT_AUTHENTICATION;
-	} else if (lesson == null) {
-	    method = LoginRequestDispatcher.METHOD_AUTHOR;
+	boolean isCustomMonitorRole = LtiUtils.isToolConsumerCustomRole(roles,
+		extServer.getLtiToolConsumerMonitorRoles());
+	if (LtiUtils.isStaff(roles) || LtiUtils.isAdmin(roles) || isCustomMonitorRole) {
+	    method = (lesson == null) ? LoginRequestDispatcher.METHOD_AUTHOR : LoginRequestDispatcher.METHOD_MONITOR;
+
 	} else {
-	    method = LoginRequestDispatcher.METHOD_MONITOR;
+	    method = LoginRequestDispatcher.METHOD_LEARNER_STRICT_AUTHENTICATION;
 	}
 	
 	//provide empty lessonId in case of learner accesses LTI link before teacher authored it
Index: lams_common/conf/hibernate/mappings/org/lamsfoundation/lams/integration/ExtServerOrgMap.hbm.xml
===================================================================
diff -u -r11b64f81e406ff277c7c35988304b0064300de57 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_common/conf/hibernate/mappings/org/lamsfoundation/lams/integration/ExtServerOrgMap.hbm.xml	(.../ExtServerOrgMap.hbm.xml)	(revision 11b64f81e406ff277c7c35988304b0064300de57)
+++ lams_common/conf/hibernate/mappings/org/lamsfoundation/lams/integration/ExtServerOrgMap.hbm.xml	(.../ExtServerOrgMap.hbm.xml)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -161,6 +161,16 @@
             insert="true"
             column="time_to_live_login_request"
         />
+        
+        <property
+			name="ltiToolConsumerMonitorRoles"
+			type="java.lang.String"
+			update="true"
+			insert="true"
+			column="lti_consumer_monitor_roles"
+			length="65535"
+			not-null="false"
+        />
 
         <set
             name="extCourseClassMaps"
Index: lams_common/src/java/org/lamsfoundation/lams/dbupdates/patch2040076.sql
===================================================================
diff -u
--- lams_common/src/java/org/lamsfoundation/lams/dbupdates/patch2040076.sql	(revision 0)
+++ lams_common/src/java/org/lamsfoundation/lams/dbupdates/patch2040076.sql	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -0,0 +1,8 @@
+-- Turn off autocommit, so nothing is committed if there is an error
+SET AUTOCOMMIT = 0;
+
+-- LDEV-4096 Add role management feature for LTI tool consumers
+ALTER TABLE lams_ext_server_org_map ADD COLUMN lti_consumer_monitor_roles text DEFAULT NULL;
+
+COMMIT;
+SET AUTOCOMMIT = 1;
Index: lams_common/src/java/org/lamsfoundation/lams/integration/ExtServer.java
===================================================================
diff -u -r11b64f81e406ff277c7c35988304b0064300de57 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_common/src/java/org/lamsfoundation/lams/integration/ExtServer.java	(.../ExtServer.java)	(revision 11b64f81e406ff277c7c35988304b0064300de57)
+++ lams_common/src/java/org/lamsfoundation/lams/integration/ExtServer.java	(.../ExtServer.java)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -65,6 +65,11 @@
 
     /** persistent field */
     private Set extUserUseridMaps;
+    
+    /**
+     * Comma-separated list of roles that LTI tool consumer uses to indicate user monitor role
+     */
+    private String ltiToolConsumerMonitorRoles;
 
     /** default constructor */
     public ExtServer() {
@@ -211,6 +216,14 @@
     public void setExtUserUseridMaps(Set extUserUseridMaps) {
 	this.extUserUseridMaps = extUserUseridMaps;
     }
+    
+    public String getLtiToolConsumerMonitorRoles() {
+	return this.ltiToolConsumerMonitorRoles;
+    }
+    
+    public void setLtiToolConsumerMonitorRoles(String ltiToolConsumerMonitorRoles) {
+	this.ltiToolConsumerMonitorRoles = ltiToolConsumerMonitorRoles;
+    }
 
     @Override
     public String toString() {
Index: lams_common/src/java/org/lamsfoundation/lams/integration/util/LtiUtils.java
===================================================================
diff -u -rde884cf8c730a25d2f2296f7a768d3fd45508c99 -r380ede712d98f28edcaea21f3525f12cc52b3237
--- lams_common/src/java/org/lamsfoundation/lams/integration/util/LtiUtils.java	(.../LtiUtils.java)	(revision de884cf8c730a25d2f2296f7a768d3fd45508c99)
+++ lams_common/src/java/org/lamsfoundation/lams/integration/util/LtiUtils.java	(.../LtiUtils.java)	(revision 380ede712d98f28edcaea21f3525f12cc52b3237)
@@ -1,5 +1,6 @@
 package org.lamsfoundation.lams.integration.util;
 
+import java.util.Arrays;
 import java.util.LinkedList;
 import java.util.List;
 
@@ -37,6 +38,15 @@
 	
 	return hasRole(roles, rolesToSearchFor);
     }
+    
+    public static boolean isToolConsumerCustomRole(String roles, String toolConsumerCustomRoles) {
+	if (roles == null || toolConsumerCustomRoles == null) {
+	    return false;
+	}
+	
+	List<String> rolesToSearchFor = Arrays.asList(toolConsumerCustomRoles.split(","));
+	return hasRole(roles, rolesToSearchFor);
+    }
 
     /**
      * Return <code>true</code> if the user is a learner.