--- loncom/auth/lonauth.pm 2017/08/08 16:43:54 1.144
+++ loncom/auth/lonauth.pm 2018/03/23 01:01:29 1.149
@@ -1,7 +1,7 @@
# The LearningOnline Network
# User Authentication Module
#
-# $Id: lonauth.pm,v 1.144 2017/08/08 16:43:54 raeburn Exp $
+# $Id: lonauth.pm,v 1.149 2018/03/23 01:01:29 raeburn Exp $
#
# Copyright Michigan State University Board of Trustees
#
@@ -36,6 +36,7 @@ use Apache::loncommon();
use Apache::lonnet;
use Apache::lonmenu();
use Apache::createaccount;
+use Apache::ltiauth;
use Fcntl qw(:flock);
use Apache::lonlocal;
use Apache::File();
@@ -45,7 +46,7 @@ use Digest::MD5;
# ------------------------------------------------------------ Successful login
sub success {
my ($r, $username, $domain, $authhost, $lowerurl, $extra_env,
- $form) = @_;
+ $form,$skipcritical) = @_;
# ------------------------------------------------------------ Get cookie ready
my $cookie =
@@ -64,10 +65,12 @@ sub success {
# ------------------------------------------------- Check for critical messages
- my @what=&Apache::lonnet::dump('critical',$domain,$username);
- if ($what[0]) {
- if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) {
- $lowerurl='/adm/email?critical=display';
+ unless ($skipcritical) {
+ my @what=&Apache::lonnet::dump('critical',$domain,$username);
+ if ($what[0]) {
+ if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) {
+ $lowerurl='/adm/email?critical=display';
+ }
}
}
@@ -93,7 +96,29 @@ sub success {
}
# -------------------------------------------------------- Menu script and info
my $destination = $lowerurl;
-
+ if ($env{'request.lti.login'}) {
+ if (($env{'request.lti.reqcrs'}) && ($env{'request.lti.reqrole'} eq 'cc')) {
+ &Apache::loncommon::content_type($r,'text/html');
+ if ($securecookie) {
+ $r->headers_out->add('Set-cookie' => $securecookie);
+ }
+ if ($defaultcookie) {
+ $r->headers_out->add('Set-cookie' => $defaultcookie);
+ }
+ $r->send_http_header;
+ &Apache::ltiauth::lti_reqcrs($r,$domain,$form,$username,$domain);
+ return;
+ }
+ if ($env{'request.lti.selfenrollrole'}) {
+ if (&Apache::ltiauth::lti_enroll($username,$domain,
+ $env{'request.lti.selfenrollrole'}) eq 'ok') {
+ $form->{'role'} = $env{'request.lti.selfenrollrole'};
+ &Apache::lonnet::delenv('request.lti.selfenrollrole');
+ } else {
+ &Apache::ltiauth::invalid_request($r,24);
+ }
+ }
+ }
if (defined($form->{role})) {
my $envkey = 'user.role.'.$form->{role};
my $now=time;
@@ -161,11 +186,7 @@ sub success {
}
}
}
- my $start_page=&Apache::loncommon::start_page('Successful Login',
- $header,$args);
- my $end_page =&Apache::loncommon::end_page();
- my $continuelink=''.&mt('Continue').'';
# ------------------------------------------------- Output for successful login
&Apache::loncommon::content_type($r,'text/html');
@@ -177,6 +198,12 @@ sub success {
}
$r->send_http_header;
+ my $start_page=&Apache::loncommon::start_page('Successful Login',
+ $header,$args);
+ my $end_page =&Apache::loncommon::end_page();
+
+ my $continuelink=''.&mt('Continue').'';
+
my %lt=&Apache::lonlocal::texthash(
'wel' => 'Welcome',
'pro' => 'Login problems?',
@@ -334,10 +361,11 @@ sub handler {
# split user logging in and "su"-user
- ($form{'uname'},$form{'suname'})=split(/\:/,$form{'uname'});
+ ($form{'uname'},$form{'suname'},$form{'sudom'})=split(/\:/,$form{'uname'});
$form{'uname'} = &LONCAPA::clean_username($form{'uname'});
$form{'suname'}= &LONCAPA::clean_username($form{'suname'});
- $form{'udom'} = &LONCAPA::clean_domain( $form{'udom'});
+ $form{'udom'} = &LONCAPA::clean_domain($form{'udom'});
+ $form{'sudom'} = &LONCAPA::clean_domain($form{'sudom'});
my $role = $r->dir_config('lonRole');
my $domain = $r->dir_config('lonDefDomain');
@@ -406,7 +434,7 @@ sub handler {
my $authhost=Apache::lonnet::authenticate($form{'uname'},$upass,
$form{'udom'},$defaultauth,
$clientcancheckhost);
-
+
# --------------------------------------------------------------------- Failed?
if ($authhost eq 'no_host') {
@@ -462,20 +490,68 @@ sub handler {
# --------------------------------- Are we attempting to login as somebody else?
if ($form{'suname'}) {
+ my ($suname,$sudom,$sudomref);
+ $suname = $form{'suname'};
+ $sudom = $form{'udom'};
+ if ($form{'sudom'}) {
+ unless ($sudom eq $form{'sudom'}) {
+ if (&Apache::lonnet::domain($form{'sudom'})) {
+ $sudomref = [$form{'sudom'}];
+ $sudom = $form{'sudom'};
+ }
+ }
+ }
# ------------ see if the original user has enough privileges to pull this stunt
- if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'})) {
+ if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'},$sudomref)) {
# ---------------------------------------------------- see if the su-user exists
- unless (&Apache::lonnet::homeserver($form{'suname'},$form{'udom'})
- eq 'no_host') {
- &Apache::lonnet::logthis(&Apache::lonnet::homeserver($form{'suname'},$form{'udom'}));
+ unless (&Apache::lonnet::homeserver($suname,$sudom) eq 'no_host') {
# ------------------------------ see if the su-user is not too highly privileged
- unless (&Apache::lonnet::privileged($form{'suname'},$form{'udom'})) {
+ if (&Apache::lonnet::privileged($suname,$sudom)) {
+ &Apache::lonnet::logthis('Attempted switch user to privileged user');
+ } else {
+ my $noprivswitch;
+#
+# su-user's home server and user's home server must have one of:
+# (a) same domain
+# (b) same primary library server for the two domains
+# (c) same "internet domain" for primary library server(s) for home servers' domains
+#
+ my $suprim = &Apache::lonnet::domain($sudom,'primary');
+ my $suintdom = &Apache::lonnet::internet_dom($suprim);
+ unless ($sudom eq $form{'udom'}) {
+ my $uprim = &Apache::lonnet::domain($form{'udom'},'primary');
+ my $uintdom = &Apache::lonnet::internet_dom($uprim);
+ unless ($suprim eq $uprim) {
+ unless ($suintdom eq $uintdom) {
+ &Apache::lonnet::logthis('Attempted switch user '
+ .'to user with different "internet domain".');
+ $noprivswitch = 1;
+ }
+ }
+ }
+
+ unless ($noprivswitch) {
+#
+# server where log-in occurs must have same "internet domain" as su-user's home
+# server
+#
+ my $lonhost = $r->dir_config('lonHostID');
+ my $hostintdom = &Apache::lonnet::internet_dom($lonhost);
+ if ($hostintdom ne $suintdom) {
+ &Apache::lonnet::logthis('Attempted switch user on a '
+ .'server with a different "internet domain".');
+ } else {
+
# -------------------------------------------------------- actually switch users
- &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.$form{'udom'}.
- ' logging in as '.$form{'suname'});
- $form{'uname'}=$form{'suname'};
- } else {
- &Apache::lonnet::logthis('Attempted switch user to privileged user');
+
+ &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.
+ $form{'udom'}.' logging in as '.$suname.':'.$sudom);
+ $form{'uname'}=$suname;
+ if ($form{'udom'} ne $sudom) {
+ $form{'udom'}=$sudom;
+ }
+ }
+ }
}
}
} else {