--- loncom/auth/lonauth.pm	2017/08/08 16:43:54	1.144
+++ loncom/auth/lonauth.pm	2019/01/27 16:02:43	1.157
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.144 2017/08/08 16:43:54 raeburn Exp $
+# $Id: lonauth.pm,v 1.157 2019/01/27 16:02:43 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -36,6 +36,7 @@ use Apache::loncommon();
 use Apache::lonnet;
 use Apache::lonmenu();
 use Apache::createaccount;
+use Apache::ltiauth;
 use Fcntl qw(:flock);
 use Apache::lonlocal;
 use Apache::File();
@@ -45,7 +46,7 @@ use Digest::MD5;
 # ------------------------------------------------------------ Successful login
 sub success {
     my ($r, $username, $domain, $authhost, $lowerurl, $extra_env,
-	$form) = @_;
+	$form,$skipcritical) = @_;
 
 # ------------------------------------------------------------ Get cookie ready
     my $cookie =
@@ -64,17 +65,20 @@ sub success {
 
 # ------------------------------------------------- Check for critical messages
 
-    my @what=&Apache::lonnet::dump('critical',$domain,$username);
-    if ($what[0]) {
-	if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) {
-	    $lowerurl='/adm/email?critical=display';
+    unless ($skipcritical) {
+        my @what=&Apache::lonnet::dump('critical',$domain,$username);
+        if ($what[0]) {
+	    if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) {
+	        $lowerurl='/adm/email?critical=display';
+            }
         }
     }
 
 # ----------------------------------------------------------- Get cookies ready
     my ($securecookie,$defaultcookie);
-    if ($ENV{'SERVER_PORT'} == 443) {
-        $securecookie="lonID=$cookie; path=/; HttpOnly; secure";
+    my $ssl = $r->subprocess_env('https');
+    if ($ssl) {
+        $securecookie="lonSID=$cookie; path=/; HttpOnly; secure";
         my $lonidsdir=$r->dir_config('lonIDsDir');
         if (($lonidsdir) && (-e "$lonidsdir/$cookie.id")) {
             my $linkname=substr(Digest::MD5::md5_hex(Digest::MD5::md5_hex(time(). {}. rand(). $$)), 0, 32).'_linked';
@@ -85,7 +89,7 @@ sub success {
                                               "$lonidsdir/$linkname.id"); 1 };
             if ($made_symlink) {
                 $defaultcookie = "lonLinkID=$linkname; path=/; HttpOnly;";
-                &Apache::lonnet::appenv({'user.linkedenv' => "$lonidsdir/$linkname.id"});
+                &Apache::lonnet::appenv({'user.linkedenv' => $linkname});
             }
         }
     } else {
@@ -93,7 +97,34 @@ sub success {
     }
 # -------------------------------------------------------- Menu script and info
     my $destination = $lowerurl;
-
+    if ($env{'request.lti.login'}) {
+        if (($env{'request.lti.reqcrs'}) && ($env{'request.lti.reqrole'} eq 'cc')) {
+            &Apache::loncommon::content_type($r,'text/html');
+            if ($securecookie) {
+                $r->headers_out->add('Set-cookie' => $securecookie);
+            }
+            if ($defaultcookie) {
+                $r->headers_out->add('Set-cookie' => $defaultcookie);
+            }
+            $r->send_http_header;
+            if (ref($form) eq 'HASH') {
+                $form->{'lti.reqcrs'} = $env{'request.lti.reqcrs'};
+                $form->{'lti.reqrole'} = $env{'request.lti.reqrole'};
+                $form->{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'};
+            }
+            &Apache::ltiauth::lti_reqcrs($r,$domain,$form,$username,$domain);
+            return;
+        }
+        if ($env{'request.lti.selfenrollrole'}) {
+            if (&Apache::ltiauth::lti_enroll($username,$domain,
+                                             $env{'request.lti.selfenrollrole'}) eq 'ok') {
+                $form->{'role'} = $env{'request.lti.selfenrollrole'};
+                &Apache::lonnet::delenv('request.lti.selfenrollrole');
+            } else {
+                &Apache::ltiauth::invalid_request($r,24);
+            }
+        }
+    }
     if (defined($form->{role})) {
         my $envkey = 'user.role.'.$form->{role};
         my $now=time;
@@ -135,8 +166,11 @@ sub success {
         $destination .= 'source=login';
     }
 
-    my $windowinfo = Apache::lonhtmlcommon::scripttag('self.name="loncapaclient";');
-    my $header = '<meta HTTP-EQUIV="Refresh" CONTENT="0; url='.$destination.'" />';
+    my $windowname = 'loncapaclient';
+    if ($env{'request.lti.login'}) {
+        $windowname .= 'lti';
+    }
+    my $windowinfo = Apache::lonhtmlcommon::scripttag('self.name="'.$windowname.'";');
     my $brcrum = [{'href' => '',
                    'text' => 'Successful Login'},];
     my $args = {'bread_crumbs' => $brcrum,};
@@ -161,11 +195,7 @@ sub success {
             }
         }
     }
-    my $start_page=&Apache::loncommon::start_page('Successful Login',
-                                                  $header,$args);
-    my $end_page  =&Apache::loncommon::end_page();
 
-	my $continuelink='<a href="'.$destination.'">'.&mt('Continue').'</a>';
 # ------------------------------------------------- Output for successful login
 
     &Apache::loncommon::content_type($r,'text/html');
@@ -177,23 +207,56 @@ sub success {
     }
     $r->send_http_header;
 
-    my %lt=&Apache::lonlocal::texthash(
-				       'wel' => 'Welcome',
-				       'pro' => 'Login problems?',
-				       );
-    my $loginhelp = &loginhelpdisplay($domain);
-    if ($loginhelp) {
-        $loginhelp = '<p><a href="'.$loginhelp.'">'.$lt{'pro'}.'</a></p>';
+    my ($start_page,$js,$pagebody,$end_page);
+    if ($env{'request.lti.login'}) {
+        $args = {'only_body' => 1};
+        if ($env{'request.lti.target'} eq '') {
+            my $ltitarget = (($destination =~ /\?/) ? '&' : '?').
+                            'ltitarget=iframe';
+            $js = <<"ENDJS";
+
+<script type="text/javascript">
+// <![CDATA[
+function setLTItarget() {
+    var newloc = '$destination';
+    if (parent !== window) {
+        newloc += '$ltitarget';
     }
+    window.location.href=newloc;
+}
+// ]]>
+</script>
 
-    my $welcome = &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','<i>','</i>'); 
+ENDJS
+            $args->{'add_entries'} = {'onload' => "javascript:setLTItarget();"};
+            $pagebody =  '<noscript><span class="LC_warning">'
+                        .&mt('Use of LON-CAPA requires Javascript to be enabled in your web browser.')
+                        .'</span></noscript>';
+        } else {
+            $args->{'redirect'} = [0,$destination,1];
+        }
+        $start_page=&Apache::loncommon::start_page('',$js,$args);
+    } else {
+        $args->{'redirect'} = [0,$destination];
+        $start_page=&Apache::loncommon::start_page('Successful Login',
+                                                   $js,$args);
+
+        my %lt=&Apache::lonlocal::texthash(
+				           'wel' => 'Welcome',
+				           'pro' => 'Login problems?',
+				          );
+        $pagebody = "<h1>$lt{'wel'}</h1>\n".
+                    &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','<i>','</i>');
+        my $loginhelp = &loginhelpdisplay($domain);
+        if ($loginhelp) {
+            $pagebody .= '<p><a href="'.$loginhelp.'">'.$lt{'pro'}.'</a></p>';
+        }
+    }
+    $end_page = &Apache::loncommon::end_page();
     $r->print(<<ENDSUCCESS);
 $start_page
 $windowinfo
-<h1>$lt{'wel'}</h1>
-$welcome
-$loginhelp
-$continuelink
+$pagebody
 $end_page
 ENDSUCCESS
     return;
@@ -235,6 +298,26 @@ sub failed {
             $retry .= (($retry=~/\?/)?'&amp;':'?').'symb='.$symb;
         }
     }
+    if (exists($form->{firsturl})) {
+        my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl});
+        if ($firsturl ne '') {
+            $retry .= (($retry=~/\?/)?'&amp;':'?').'firsturl='.$firsturl;
+            if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) {
+                unless (exists($form->{linkprot})) {
+                    if (exists($form->{linkkey})) {
+                        $retry .= 'linkkey='.$form->{linkkey};
+                    }
+                }
+            }
+        }
+    }
+    if (exists($form->{linkprot})) {
+        my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}},
+                                             $r->dir_config('lonHostID'));
+        if ($ltoken) {
+            $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken;
+        }
+    }
     my $end_page = &Apache::loncommon::end_page();
     &Apache::loncommon::content_type($r,'text/html');
     $r->send_http_header;
@@ -298,6 +381,9 @@ sub handler {
             my $dest = '/adm/roles';
             if ($env{'form.firsturl'} ne '') {
                 $dest = $env{'form.firsturl'};
+                if ($env{'form.firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                    &Apache::lonnet::appenv({'request.deeplink.login' => $env{'form.firsturl'}}); 
+                }
             }
             $r->print(
                $start_page
@@ -334,10 +420,11 @@ sub handler {
 
 # split user logging in and "su"-user
 
-    ($form{'uname'},$form{'suname'})=split(/\:/,$form{'uname'});
+    ($form{'uname'},$form{'suname'},$form{'sudom'})=split(/\:/,$form{'uname'});
     $form{'uname'} = &LONCAPA::clean_username($form{'uname'});
     $form{'suname'}= &LONCAPA::clean_username($form{'suname'});
-    $form{'udom'}  = &LONCAPA::clean_domain(  $form{'udom'});
+    $form{'udom'}  = &LONCAPA::clean_domain($form{'udom'});
+    $form{'sudom'} = &LONCAPA::clean_domain($form{'sudom'});
 
     my $role   = $r->dir_config('lonRole');
     my $domain = $r->dir_config('lonDefDomain');
@@ -368,7 +455,7 @@ sub handler {
         return OK;
     }
 
-    my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr)=split(/&/,$tmpinfo);
+    my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr,$linkstr)=split(/&/,$tmpinfo);
     if ($rolestr) {
         $rolestr = &unescape($rolestr);
     }
@@ -378,6 +465,12 @@ sub handler {
     if ($iptokenstr) {
         $iptokenstr = &unescape($iptokenstr);
     }
+    if ($linkstr) {
+        $linkstr = &unescape($linkstr);
+    }
+    if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) {
+        $form{'firsturl'} = $firsturl;
+    }
     if ($rolestr =~ /^role=/) {
         (undef,$form{'role'}) = split('=',$rolestr);
     }
@@ -387,6 +480,11 @@ sub handler {
     if ($iptokenstr =~ /^iptoken=/) {
         (undef,$form{'iptoken'}) = split('=',$iptokenstr);
     }
+    if ($linkstr =~ /^linkprot=/) {
+        (undef,$form{'linkprot'}) = split('=',$linkstr);
+    } elsif ($linkstr =~ /^linkkey=/) {
+        (undef,$form{'linkkey'}) = split('=',$linkstr);
+    }
 
     my $upass = $ENV{HTTPS} ? $form{'upass0'} 
         : &Apache::loncommon::des_decrypt($key,$form{'upass0'});
@@ -406,7 +504,7 @@ sub handler {
     my $authhost=Apache::lonnet::authenticate($form{'uname'},$upass,
                                               $form{'udom'},$defaultauth,
                                               $clientcancheckhost);
-    
+
 # --------------------------------------------------------------------- Failed?
 
     if ($authhost eq 'no_host') {
@@ -462,20 +560,68 @@ sub handler {
 
 # --------------------------------- Are we attempting to login as somebody else?
     if ($form{'suname'}) {
+        my ($suname,$sudom,$sudomref);
+        $suname = $form{'suname'};
+        $sudom = $form{'udom'};
+        if ($form{'sudom'}) {
+            unless ($sudom eq $form{'sudom'}) {
+                if (&Apache::lonnet::domain($form{'sudom'})) {
+                    $sudomref = [$form{'sudom'}];
+                    $sudom = $form{'sudom'};
+                }
+            }
+        }
 # ------------ see if the original user has enough privileges to pull this stunt
-	if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'})) {
+	if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'},$sudomref)) {
 # ---------------------------------------------------- see if the su-user exists
-	    unless (&Apache::lonnet::homeserver($form{'suname'},$form{'udom'})
-		eq 'no_host') {
-		&Apache::lonnet::logthis(&Apache::lonnet::homeserver($form{'suname'},$form{'udom'}));
+	    unless (&Apache::lonnet::homeserver($suname,$sudom) eq 'no_host') {
 # ------------------------------ see if the su-user is not too highly privileged
-		unless (&Apache::lonnet::privileged($form{'suname'},$form{'udom'})) {
+		if (&Apache::lonnet::privileged($suname,$sudom)) {
+                    &Apache::lonnet::logthis('Attempted switch user to privileged user');
+                } else {
+                    my $noprivswitch;
+#
+# su-user's home server and user's home server must have one of:
+# (a) same domain
+# (b) same primary library server for the two domains
+# (c) same "internet domain" for primary library server(s) for home servers' domains
+#
+                    my $suprim = &Apache::lonnet::domain($sudom,'primary');
+                    my $suintdom = &Apache::lonnet::internet_dom($suprim);
+                    unless ($sudom eq $form{'udom'}) {
+                        my $uprim = &Apache::lonnet::domain($form{'udom'},'primary');
+                        my $uintdom = &Apache::lonnet::internet_dom($uprim);
+                        unless ($suprim eq $uprim) {
+                            unless ($suintdom eq $uintdom) {
+                                &Apache::lonnet::logthis('Attempted switch user '
+                                   .'to user with different "internet domain".');                        
+                                $noprivswitch = 1;
+                            }
+                        }
+                    }
+
+                    unless ($noprivswitch) {
+#
+# server where log-in occurs must have same "internet domain" as su-user's home
+# server
+#
+                        my $lonhost = $r->dir_config('lonHostID');
+                        my $hostintdom = &Apache::lonnet::internet_dom($lonhost);
+                        if ($hostintdom ne $suintdom) {
+                            &Apache::lonnet::logthis('Attempted switch user on a '
+                                .'server with a different "internet domain".'); 
+                        } else {
+
 # -------------------------------------------------------- actually switch users
-		    &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.$form{'udom'}.
-			' logging in as '.$form{'suname'});
-		    $form{'uname'}=$form{'suname'};
-		} else {
-		    &Apache::lonnet::logthis('Attempted switch user to privileged user');
+
+		            &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.
+                              $form{'udom'}.' logging in as '.$suname.':'.$sudom);
+		            $form{'uname'}=$suname;
+                            if ($form{'udom'} ne $sudom) {
+                                $form{'udom'}=$sudom;
+                            }
+                        }
+                    }
 		}
 	    }
 	} else {
@@ -511,7 +657,7 @@ sub handler {
                      \%form);
             my $switchto = '/adm/switchserver?otherserver='.$otherserver;
             if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) {
-                $switchto .= '&origurl='.$firsturl;
+                $switchto .= '&origurl='.$firsturl; #should escape
             }
             if ($form{'role'}) {
                 $switchto .= '&role='.$form{'role'};
@@ -519,6 +665,14 @@ sub handler {
             if ($form{'symb'}) {
                 $switchto .= '&symb='.$form{'symb'};
             }
+            if ($form{'linkprot'}) {
+                $env{'request.linkprot'} = $form{'linkprot'};
+            } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                if ($form{'linkkey'}) {
+                    $env{'request.linkkey'} = $form{'linkkey'};
+                }
+                $env{'request.deeplink.login'} = $form{'firsturl'};
+            }
             $r->internal_redirect($switchto);
         } else {
             $r->print(&noswitch());
@@ -532,7 +686,7 @@ sub handler {
                          \%form);
                 my $switchto = '/adm/switchserver?otherserver='.$otherserver;
                 if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) {
-                    $switchto .= '&origurl='.$firsturl;
+                    $switchto .= '&origurl='.$firsturl; #should escape
                 }
                 if ($form{'role'}) {
                     $switchto .= '&role='.$form{'role'};
@@ -540,6 +694,15 @@ sub handler {
                 if ($form{'symb'}) {
                     $switchto .= '&symb='.$form{'symb'};
                 }
+                if ($form{'linkprot'}) {
+                    $env{'request.linkprot'} = $form{'linkprot'};
+                } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                    if ($form{'linkkey'}) {
+                        $env{'request.linkkey'} = $form{'linkkey'};
+                    }
+                    $env{'request.deeplink.login'} = $form{'firsturl'};
+
+                }
                 $r->internal_redirect($switchto);
             } else {
                 $r->print(&noswitch());
@@ -569,6 +732,14 @@ sub handler {
             if ($unloaded) {
                 &success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect',
                          undef,\%form);
+                if ($form{'linkprot'}) {
+                    $env{'request.linkprot'} = $form{'linkprot'};
+                } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                    if ($form{'linkkey'}) {
+                        $env{'request.linkkey'} = $form{'linkkey'};
+                    }
+                    $env{'request.deeplink.login'} = $form{'firsturl'};
+                }
                 $r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl);
                 return OK;
             }
@@ -576,7 +747,23 @@ sub handler {
         if (($is_balancer) && ($hosthere)) {
             $form{'noloadbalance'} = $hosthere;
         }
-        &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef,
+        my $extra_env;
+        if ($form{'linkprot'}) {
+            my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2);
+            if ($linkprotector) {
+                $extra_env = {'user.linkprotector' => $linkprotector,
+                              'user.linkproturi'   => $uri,};
+            }
+        } elsif ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+            if ($form{'linkkey'}) {
+                $extra_env = {'user.deeplinkkey' => $form{'linkkey'},
+                              'user.keyedlinkuri' => $form{'firsturl'},
+                              'request.deeplink.login' => $form{'firsturl'}};
+            } else {
+                $extra_env = {'request.deeplink.login' => $form{'firsturl'}};
+            }
+        }
+        &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env,
                  \%form);
         return OK;
     }
@@ -623,6 +810,7 @@ sub check_can_host {
                 my $protocol = $Apache::lonnet::protocol{$login_host};
                 $protocol = 'http' if ($protocol ne 'https');
                 my $newurl = $protocol.'://'.$hostname.'/adm/createaccount';
+#FIXME Should preserve where user was going and linkprot by setting ltoken at $login_host
                 $r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA').
                           '<h3>'.&mt('Account creation').'</h3>'.
                           &mt('You do not currently have a LON-CAPA account at this institution.').'<br />'.
@@ -639,6 +827,14 @@ sub check_can_host {
         } else {
             &success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef,
                      $form);
+            if ($form->{'linkprot'}) {
+                $env{'request.linkprot'} = $form->{'linkprot'};
+            } elsif ($form->{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) {
+                if ($form->{'linkkey'}) {
+                    $env{'request.linkkey'} = $form->{'linkkey'};
+                }
+                $env{'request.deeplink.login'} = $form->{'firsturl'};
+            }
             my ($otherserver) = &Apache::lonnet::choose_server($udom);
             $r->internal_redirect('/adm/switchserver?otherserver='.$otherserver);
         }