--- loncom/auth/lonauth.pm 2021/08/09 15:36:28 1.165 +++ loncom/auth/lonauth.pm 2021/11/24 20:15:15 1.171 @@ -1,7 +1,7 @@ # The LearningOnline Network # User Authentication Module # -# $Id: lonauth.pm,v 1.165 2021/08/09 15:36:28 raeburn Exp $ +# $Id: lonauth.pm,v 1.171 2021/11/24 20:15:15 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -42,11 +42,12 @@ use Apache::lonlocal; use Apache::File(); use HTML::Entities; use Digest::MD5; +use CGI::Cookie(); # ------------------------------------------------------------ Successful login sub success { my ($r, $username, $domain, $authhost, $lowerurl, $extra_env, - $form,$skipcritical,$cid) = @_; + $form,$skipcritical,$cid,$expirepub) = @_; # ------------------------------------------------------------ Get cookie ready my $cookie = @@ -178,6 +179,22 @@ sub success { $destination .= 'source=login'; } + if (($env{'request.deeplink.login'} eq $lowerurl) && + (($env{'request.linkprot'}) || ($env{'request.linkkey'} ne ''))) { + my %info; + if ($env{'request.linkprot'}) { + $info{'linkprot'} = $env{'request.linkprot'}; + } elsif ($env{'request.linkkey'} ne '') { + $info{'linkkey'} = $env{'request.linkkey'}; + } + $info{'origurl'} = $lowerurl; + my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link'); + unless (($token eq 'con_lost') || ($token eq 'refused') || + ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) { + $destination .= (($destination =~ /\?/) ? '&' : '?') . 'ttoken='.$token; + } + } + my $windowname = 'loncapaclient'; if ($env{'request.lti.login'}) { $windowname .= 'lti'; @@ -217,6 +234,12 @@ sub success { if ($defaultcookie) { $r->headers_out->add('Set-cookie' => $defaultcookie); } + if ($expirepub) { + my $c = new CGI::Cookie(-name => 'lonPubID', + -value => '', + -expires => '-10y',); + $r->headers_out->add('Set-cookie' => $c); + } $r->send_http_header; my ($start_page,$js,$pagebody,$end_page); @@ -277,7 +300,7 @@ ENDSUCCESS # --------------------------------------------------------------- Failed login! sub failed { - my ($r,$message,$form) = @_; + my ($r,$message,$form,$authhost) = @_; (undef,undef,undef,my $clientmathml,my $clientunicode) = &Apache::loncommon::decode_user_agent(); my $args = {}; @@ -285,66 +308,88 @@ sub failed { $args = {'browser.unicode' => 1}; } + my @actions; my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef,$args); my $uname = &Apache::loncommon::cleanup_html($form->{'uname'}); my $udom = &Apache::loncommon::cleanup_html($form->{'udom'}); if (&Apache::lonnet::domain($udom,'description') eq '') { undef($udom); } + my $authtype; + if (($udom ne '') && ($uname ne '') && ($authhost eq 'no_host')) { + $authtype = &Apache::lonnet::queryauthenticate($uname,$udom); + } my $retry = '/adm/login'; - if ($uname eq $form->{'uname'}) { + if (($uname eq $form->{'uname'}) && ($authtype !~ /^lti:/)) { $retry .= '?username='.$uname; } if ($udom) { $retry .= (($retry=~/\?/)?'&':'?').'domain='.$udom; } - if (exists($form->{role})) { - my $role = &Apache::loncommon::cleanup_html($form->{role}); - if ($role ne '') { - $retry .= (($retry=~/\?/)?'&':'?').'role='.$role; - } - } - if (exists($form->{symb})) { - my $symb = &Apache::loncommon::cleanup_html($form->{symb}); - if ($symb ne '') { - $retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb; - } - } - if (exists($form->{firsturl})) { - my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl}); - if ($firsturl ne '') { - $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl; - if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) { - unless (exists($form->{linkprot})) { - if (exists($form->{linkkey})) { - $retry .= 'linkkey='.$form->{linkkey}; + my $lonhost = $r->dir_config('lonHostID'); + my $querystr; + my $result = &set_retry_token($form,$lonhost,\$querystr); + if ($result eq 'fail') { + if (exists($form->{role})) { + my $role = &Apache::loncommon::cleanup_html($form->{role}); + if ($role ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'role='.$role; + } + } + if (exists($form->{symb})) { + my $symb = &Apache::loncommon::cleanup_html($form->{symb}); + if ($symb ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'symb='.$symb; + } + } + if (exists($form->{firsturl})) { + my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl}); + if ($firsturl ne '') { + $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl; + if ($form->{firsturl} =~ m{^/tiny/$match_domain/\w+$}) { + unless (exists($form->{linkprot})) { + if (exists($form->{linkkey})) { + $retry .= 'linkkey='.$form->{linkkey}; + } } } } } - } - if (exists($form->{linkprot})) { - my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}}, - $r->dir_config('lonHostID')); - if ($ltoken) { - $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken; + if (exists($form->{linkprot})) { + my $ltoken = &Apache::lonnet::tmpput({linkprot => $form->{'linkprot'}}, + $r->dir_config('lonHostID'),'retry'); + if ($ltoken) { + $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken; + } } + } elsif ($querystr ne '') { + $retry .= (($retry=~/\?/)?'&':'?').$querystr; } my $end_page = &Apache::loncommon::end_page(); &Apache::loncommon::content_type($r,'text/html'); $r->send_http_header; - my @actions = - (&mt('Please [_1]log in again[_2].','','')); + if ($authtype =~ /^lti:/) { + $message = &mt('Direct login is not supported with the username you entered.'). + '

'. + &mt('You likely need to launch LON-CAPA from within a course in a different Learning Management System.'). + '
'. + &mt('You can also try to log in with a different username.'); + @actions = + (&mt('Try your [_1]log in again[_2].','','')); + } else { + $message = &mt($message); + @actions = + (&mt('Please [_1]log in again[_2].','','')); + } my $loginhelp = &loginhelpdisplay($udom); if ($loginhelp) { push(@actions, ''.&mt('Login problems?').''); } #FIXME: link to helpdesk might be added here - $r->print( $start_page .'

'.&mt('Sorry ...').'

' - .&Apache::lonhtmlcommon::confirm_success(&mt($message),1).'

' + .&Apache::lonhtmlcommon::confirm_success($message,1).'

' .&Apache::lonhtmlcommon::actionbox(\@actions) .$end_page ); @@ -386,50 +431,76 @@ sub handler { &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); &Apache::loncommon::content_type($r,'text/html'); $r->send_http_header; - my $start_page = + my $start_page = &Apache::loncommon::start_page('Already logged in'); my $end_page = &Apache::loncommon::end_page(); my $dest = '/adm/roles'; - if ($env{'form.firsturl'} ne '') { - $dest = $env{'form.firsturl'}; - if (($env{'form.firsturl'} =~ m{^/tiny/$match_domain/\w+$}) && - ($env{'request.course.id'})) { - my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'}; - my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'}; - my $symb = &Apache::loncommon::symb_from_tinyurl($env{'form.firsturl'},$cnum,$cdom); - if ($symb) { - my $buffer; - if ($r->header_in('Content-length') > 0) { - $r->read($buffer,$r->header_in('Content-length'),0); - } - my %form; - foreach my $pair (split(/&/,$buffer)) { - my ($name,$value) = split(/=/,$pair); - $value =~ tr/+/ /; - $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; - $form{$name}=$value; + my %form = &get_form_items($r); + if ($form{'logtoken'}) { + my $tmpinfo = &Apache::lonnet::reply('tmpget:'.$form{'logtoken'}, + $form{'serverid'}); + unless (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost') || + ($tmpinfo eq 'no_such_host')) { + my ($des_key,$firsturl,@rest)=split(/&/,$tmpinfo); + $firsturl = &unescape($firsturl); + my %info; + foreach my $item (@rest) { + my ($key,$value) = split(/=/,$item); + $info{$key} = &unescape($value); + } + if ($firsturl ne '') { + $info{'firsturl'} = $firsturl; + $dest = $firsturl; + my $relogin; + if ($dest =~ m{^/tiny/$match_domain/\w+$}) { + if ($env{'request.course.id'}) { + my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'}; + my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'}; + my $symb = &Apache::loncommon::symb_from_tinyurl($dest,$cnum,$cdom); + if ($symb) { + unless (&set_deeplink_login(%info) eq 'ok') { + $relogin = 1; + } + } + } + if ($relogin) { + $r->print( + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please [_1]log out[_2] first, and then try your access again', + '','') + .'

' + .$end_page); + } else { + if (($info{'linkprot'}) || ($info{'linkkey'} ne '')) { + my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link'); + unless (($token eq 'con_lost') || ($token eq 'refused') || + ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) { + $dest .= (($dest =~ /\?/) ? '&' : '?') . 'ttoken='.$token; + } + } + $r->print( + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4] first, and then try your access again', + '','', + '','') + .'

' + .$end_page); + } + return OK; } - &set_deeplink_login(%form); - } else { - $r->print( - $start_page - .'

'.&mt('You are already logged in!').'

' - .'

'.&mt('Please [_1]log out[_2] first, and then try your access again', - '','') - .'

' - .$end_page); - return OK; } } } $r->print( - $start_page - .'

'.&mt('You are already logged in!').'

' - .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4].' - ,'','','','') - .'

' - .$end_page + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4].' + ,'','','','') + .'

' + .$end_page ); return OK; } @@ -437,19 +508,7 @@ sub handler { # ---------------------------------------------------- No valid token, continue - - my $buffer; - if ($r->header_in('Content-length') > 0) { - $r->read($buffer,$r->header_in('Content-length'),0); - } - my %form; - foreach my $pair (split(/&/,$buffer)) { - my ($name,$value) = split(/=/,$pair); - $value =~ tr/+/ /; - $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; - $form{$name}=$value; - } - + my %form = &get_form_items($r); if ((!$form{'uname'}) || (!$form{'upass0'}) || (!$form{'udom'})) { &failed($r,'Username, password and domain need to be specified.', \%form); @@ -493,39 +552,17 @@ sub handler { return OK; } - my ($key,$firsturl,$rolestr,$symbstr,$iptokenstr,$linkstr)=split(/&/,$tmpinfo); - if ($rolestr) { - $rolestr = &unescape($rolestr); - } - if ($symbstr) { - $symbstr= &unescape($symbstr); - } - if ($iptokenstr) { - $iptokenstr = &unescape($iptokenstr); - } - if ($linkstr) { - $linkstr = &unescape($linkstr); + my ($des_key,$firsturl,@rest)=split(/&/,$tmpinfo); + $firsturl = &unescape($firsturl); + foreach my $item (@rest) { + my ($key,$value) = split(/=/,$item); + $form{$key} = &unescape($value); } if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) { $form{'firsturl'} = $firsturl; } - if ($rolestr =~ /^role=/) { - (undef,$form{'role'}) = split('=',$rolestr); - } - if ($symbstr =~ /^symb=/) { - (undef,$form{'symb'}) = split('=',$symbstr); - } - if ($iptokenstr =~ /^iptoken=/) { - (undef,$form{'iptoken'}) = split('=',$iptokenstr); - } - if ($linkstr =~ /^linkprot=/) { - (undef,$form{'linkprot'}) = split('=',$linkstr); - } elsif ($linkstr =~ /^linkkey=/) { - (undef,$form{'linkkey'}) = split('=',$linkstr); - } - my $upass = $ENV{HTTPS} ? $form{'upass0'} - : &Apache::loncommon::des_decrypt($key,$form{'upass0'}); + : &Apache::loncommon::des_decrypt($des_key,$form{'upass0'}); # ---------------------------------------------------------------- Authenticate @@ -547,7 +584,7 @@ sub handler { if ($authhost eq 'no_host') { &failed($r,'Username and/or password could not be authenticated.', - \%form); + \%form,$authhost); return OK; } elsif ($authhost eq 'no_account_on_host') { if ($defaultauth) { @@ -556,7 +593,8 @@ sub handler { return OK; } my $start_page = - &Apache::loncommon::start_page('Create a user account in LON-CAPA'); + &Apache::loncommon::start_page('Create a user account in LON-CAPA', + '',{'no_inline_link' => 1,}); my $lonhost = $r->dir_config('lonHostID'); my $origmail = $Apache::lonnet::perlvar{'lonSupportEMail'}; my $contacts = @@ -586,9 +624,9 @@ sub handler { $firsturl='/adm/roles'; } - my $hosthere; + my ($hosthere,%sessiondata); if ($form{'iptoken'}) { - my %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'}); + %sessiondata = &Apache::lonnet::tmpget($form{'iptoken'}); my $delete = &Apache::lonnet::tmpdel($form{'iptoken'}); if (($sessiondata{'domain'} eq $form{'udom'}) && ($sessiondata{'username'} eq $form{'uname'})) { @@ -632,7 +670,7 @@ sub handler { unless ($suprim eq $uprim) { unless ($suintdom eq $uintdom) { &Apache::lonnet::logthis('Attempted switch user ' - .'to user with different "internet domain".'); + .'to user with different "internet domain".'); $noprivswitch = 1; } } @@ -700,7 +738,7 @@ sub handler { \%form); my $switchto = '/adm/switchserver?otherserver='.$otherserver; if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) { - $switchto .= '&origurl='.$firsturl; #should escape + $switchto .= '&origurl='.$firsturl; } if ($form{'role'}) { $switchto .= '&role='.$form{'role'}; @@ -710,7 +748,7 @@ sub handler { } if ($form{'linkprot'}) { $env{'request.linkprot'} = $form{'linkprot'}; - } elsif ($form{'linkkey'}) { + } elsif ($form{'linkkey'} ne '') { $env{'request.linkkey'} = $form{'linkkey'}; } if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { @@ -731,7 +769,7 @@ sub handler { \%form); my $switchto = '/adm/switchserver?otherserver='.$otherserver; if (($firsturl) && ($firsturl ne '/adm/switchserver') && ($firsturl ne '/adm/roles')) { - $switchto .= '&origurl='.$firsturl; #should escape + $switchto .= '&origurl='.$firsturl; } if ($form{'role'}) { $switchto .= '&role='.$form{'role'}; @@ -741,7 +779,7 @@ sub handler { } if ($form{'linkprot'}) { $env{'request.linkprot'} = $form{'linkprot'}; - } elsif ($form{'linkkey'}) { + } elsif ($form{'linkkey'} ne '') { $env{'request.linkkey'} = $form{'linkkey'}; } if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { @@ -780,7 +818,7 @@ sub handler { undef,\%form); if ($form{'linkprot'}) { $env{'request.linkprot'} = $form{'linkprot'}; - } elsif ($form{'linkkey'}) { + } elsif ($form{'linkkey'} ne '') { $env{'request.linkkey'} = $form{'linkkey'}; } if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { @@ -794,18 +832,43 @@ sub handler { $form{'noloadbalance'} = $hosthere; } my $extra_env; + if (($hosthere) && ($sessiondata{'sessionserver'} ne '')) { + if ($sessiondata{'origurl'} ne '') { + $firsturl = $sessiondata{'origurl'}; + $form{'firsturl'} = $sessiondata{'origurl'}; + my @names = ('role','symb','linkprot','linkkey'); + foreach my $item (@names) { + if ($sessiondata{$item} ne '') { + $form{$item} = $sessiondata{$item}; + } + } + } + } if ($form{'linkprot'}) { my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2); if ($linkprotector) { $extra_env = {'user.linkprotector' => $linkprotector, 'user.linkproturi' => $uri}; } - } elsif ($form{'linkkey'}) { - $extra_env = {'user.deeplinkkey' => $form{'linkkey'}, + } elsif ($form{'linkkey'} ne '') { + $extra_env = {'user.deeplinkkey' => $form{'linkkey'}, 'user.keyedlinkuri' => $form{'firsturl'}}; } if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { &set_deeplink_login(%form); + if ($form{'linkprot'}) { + if (ref($extra_env) eq 'HASH') { + %{$extra_env} = ( %{$extra_env}, 'request.linkprot' => $form{'linkprot'} ); + } else { + $extra_env = {'request.linkprot' => $form{'linkprot'}}; + } + } elsif ($form{'linkkey'} ne '') { + if (ref($extra_env) eq 'HASH') { + %{$extra_env} = ( %{$extra_env}, 'request.linkkey' => $form{'linkkey'} ); + } else { + $extra_env = {'request.linkkey' => $form{'linkkey'}}; + } + } if ($env{'request.deeplink.login'}) { if (ref($extra_env) eq 'HASH') { %{$extra_env} = ( %{$extra_env}, 'request.deeplink.login' => $form{'firsturl'} ); @@ -820,34 +883,95 @@ sub handler { } } +sub get_form_items { + my ($r) = @_; + my $buffer; + if ($r->header_in('Content-length') > 0) { + $r->read($buffer,$r->header_in('Content-length'),0); + } + my %form; + foreach my $pair (split(/&/,$buffer)) { + my ($name,$value) = split(/=/,$pair); + $value =~ tr/+/ /; + $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; + $form{$name}=$value; + } + return %form; +} + sub set_deeplink_login { my (%form) = @_; + my $disallow; if ($form{'firsturl'} =~ m{^/tiny/($match_domain)/\w+$}) { my $cdom = $1; my ($cnum,$symb) = &Apache::loncommon::symb_from_tinyurl($form{'firsturl'},'',$cdom); if ($symb) { - my $disallow; - my $deeplink = &Apache::lonnet::EXT("resource.0.deeplink",$symb); - if ($deeplink ne '') { - my ($state,$others,$listed,$scope,$protect) = split(/,/,$deeplink); - if (($protect ne 'none') && ($protect ne '')) { - my ($acctype,$item) = split(/:/,$protect); - if (($acctype eq 'ltic') || ($acctype eq 'ltid')) { - unless ($form{'linkprot'} eq $protect) { - $disallow = 1; - } - } elsif ($acctype eq 'key') { - unless ($form{'linkkey'} eq $item) { - $disallow = 1; + if ($env{'request.course.id'} eq $cdom.'_'.$cnum) { + my $deeplink; + if ($symb =~ /\.(page|sequence)$/) { + my $mapname = &Apache::lonnet::deversion((&Apache::lonnet::decode_symb($symb))[2]); + my $navmap = Apache::lonnavmaps::navmap->new(); + if (ref($navmap)) { + $deeplink = $navmap->get_mapparam(undef,$mapname,'0.deeplink'); + } + } else { + $deeplink = &Apache::lonnet::EXT('resource.0.deeplink',$symb); + } + if ($deeplink ne '') { + my ($state,$others,$listed,$scope,$protect) = split(/,/,$deeplink); + if (($protect ne 'none') && ($protect ne '')) { + my ($acctype,$item) = split(/:/,$protect); + if ($acctype =~ /lti(c|d)$/) { + unless ($form{'linkprot'} eq $item.$1.':'.$env{'request.deeplink.login'}) { + $disallow = 1; + } + } elsif ($acctype eq 'key') { + unless ($form{'linkkey'} eq $item) { + $disallow = 1; + } } } } - } - unless ($disallow) { + unless ($disallow) { + $env{'request.deeplink.login'} = $form{'firsturl'}; + } + } else { $env{'request.deeplink.login'} = $form{'firsturl'}; } } } + if ($disallow) { + return; + } + return 'ok'; +} + +sub set_retry_token { + my ($form,$lonhost,$querystr) = @_; + if (ref($form) eq 'HASH') { + my ($firsturl,$token,$extras,@names); + @names = ('role','symb','linkprot','linkkey','iptoken'); + foreach my $name (@names) { + if ($form->{$name} ne '') { + $extras .= '&'.$name.'='.&escape($form->{$name}); + last if ($name eq 'linkprot'); + } + } + my $firsturl = $form->{'firsturl'}; + if (($firsturl ne '') || ($extras ne '')) { + $extras .= ':retry'; + $token = &Apache::lonnet::reply('tmpput:'.&escape($firsturl). + $extras,$lonhost); + if (($token eq 'con_lost') || ($token eq 'no_such_host')) { + return 'fail'; + } else { + if (ref($querystr)) { + $$querystr = 'retry='.$token; + } + return 'ok'; + } + } + } return; } @@ -911,13 +1035,13 @@ sub check_can_host { } else { &success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef, $form); + if ($form->{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + $env{'request.deeplink.login'} = $form->{'firsturl'}; + } if ($form->{'linkprot'}) { $env{'request.linkprot'} = $form->{'linkprot'}; - } elsif ($form->{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - if ($form->{'linkkey'}) { - $env{'request.linkkey'} = $form->{'linkkey'}; - } - $env{'request.deeplink.login'} = $form->{'firsturl'}; + } elsif ($form->{'linkkey'} ne '') { + $env{'request.linkkey'} = $form->{'linkkey'}; } my ($otherserver) = &Apache::lonnet::choose_server($udom); $r->internal_redirect('/adm/switchserver?otherserver='.$otherserver);