private function getssotoken($readwrite = 'read') {
        global $USER;

        if (empty($USER->username)) {
            return false;
        }

        if ($readwrite == 'write') {

            foreach (self::get_all_editing_roles() as $role) {
                if (user_has_role_assignment($USER->id, $role->id, $this->context->id)) {
                    // See if the user has a role that is linked to an equella role.
                    $shareid = $this->get_option("equella_{$role->shortname}_shareid");
                    if (!empty($shareid)) {
                        return $this->getssotoken_raw($USER->username, $shareid,
                            $this->get_option("equella_{$role->shortname}_sharedsecret"));
                    }
                }
            }
        }
        // If we are only reading, use the unadorned shareid and secret.
        $shareid = $this->get_option('equella_shareid');
        if (!empty($shareid)) {
            return $this->getssotoken_raw($USER->username, $shareid, $this->get_option('equella_sharedsecret'));
        }
    }