I've made some changes to the IMS Enterprise enrolment plugin. Please see the attached patch. Below is a summary of the changes.

function process_person_tag() contains a regular expression to match a username specified in an IMS Enterprise XML document. However, it cannot match a tag that contains the user's password as an attribute. I've fixed that.

I've also added a stanza that captures the password, if specified, and sets the newly-created user's password to that value. It also sets the user's auth-type to 'manual', as that must be why you've specified the password in the IMS document.

The original script checks to see if the user already exists in the Moodle database, and skips processing if it does. However, the original script only matches person.sourcedid.id against idnumber in the Moodle database. It is possible (as is the case at our site) that a user account may exist that has no idnumber specified. I've added code that checks to see if person.userid matches a 'username' field in the Moodle database. If the user account exists, but idnumber is empty, this field is populated from person.sourcedid.id.

I've changed the line that specifies the auth plugin to see if it's been set earlier in the function. If not, it is set to $CFG->auth. However, this is a bug in Moodle 1.9, as $CFG->auth can return a comma-separated list of auth plugins. I've marked this as a bug elsewhere (MDL-15863).

function process_group_membership handles adding users to groups and courses. I've made some changes that handle the situation where an account exists in Moodle, but it doesn't have an idnumber set. I hope this hasn't caused any regressions, as the old way of processing the data is still in there.

I made a small change so the script uses groups_get_group_by_name instead of get_record, and added some lines that log group membership changes.

I hope this explains the changes, but you may find all this easier to understand if you just look at the patch