--- loncom/auth/lonauth.pm 2024/10/09 18:12:23 1.121.2.24.2.8 +++ loncom/auth/lonauth.pm 2022/02/27 02:06:20 1.121.2.25 @@ -1,7 +1,7 @@ # The LearningOnline Network # User Authentication Module # -# $Id: lonauth.pm,v 1.121.2.24.2.8 2024/10/09 18:12:23 raeburn Exp $ +# $Id: lonauth.pm,v 1.121.2.25 2022/02/27 02:06:20 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -29,14 +29,13 @@ package Apache::lonauth; use strict; -use LONCAPA qw(:DEFAULT :match); +use LONCAPA; use Apache::Constants qw(:common); use CGI qw(:standard); use Apache::loncommon(); use Apache::lonnet; use Apache::lonmenu(); use Apache::createaccount; -use Apache::ltiauth; use Fcntl qw(:flock); use Apache::lonlocal; use Apache::File(); @@ -47,7 +46,7 @@ use CGI::Cookie(); # ------------------------------------------------------------ Successful login sub success { my ($r, $username, $domain, $authhost, $lowerurl, $extra_env, - $form,$skipcritical,$cid,$expirepub,$write_to_opener) = @_; + $form,$cid,$expirepub) = @_; # ------------------------------------------------------------ Get cookie ready my $cookie = @@ -67,12 +66,10 @@ sub success { # ------------------------------------------------- Check for critical messages - unless ($skipcritical) { - my @what=&Apache::lonnet::dump('critical',$domain,$username); - if ($what[0]) { - if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) { - $lowerurl='/adm/email?critical=display'; - } + my @what=&Apache::lonnet::dump('critical',$domain,$username); + if ($what[0]) { + if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) { + $lowerurl='/adm/email?critical=display'; } } @@ -99,35 +96,7 @@ sub success { } # -------------------------------------------------------- Menu script and info my $destination = $lowerurl; - if ($env{'request.lti.login'}) { - if (($env{'request.lti.reqcrs'}) && ($env{'request.lti.reqrole'} eq 'cc')) { - &Apache::loncommon::content_type($r,'text/html'); - if ($securecookie) { - $r->headers_out->add('Set-cookie' => $securecookie); - } - if ($defaultcookie) { - $r->headers_out->add('Set-cookie' => $defaultcookie); - } - $r->send_http_header; - if (ref($form) eq 'HASH') { - $form->{'lti.login'} = $env{'request.lti.login'}; - $form->{'lti.reqcrs'} = $env{'request.lti.reqcrs'}; - $form->{'lti.reqrole'} = $env{'request.lti.reqrole'}; - $form->{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'}; - } - &Apache::ltiauth::lti_reqcrs($r,$domain,$form,$username,$domain); - return; - } - if ($env{'request.lti.selfenrollrole'}) { - if (&Apache::ltiauth::lti_enroll($username,$domain, - $env{'request.lti.selfenrollrole'}) eq 'ok') { - $form->{'role'} = $env{'request.lti.selfenrollrole'}; - &Apache::lonnet::delenv('request.lti.selfenrollrole'); - } else { - &Apache::ltiauth::invalid_request($r,24); - } - } - } + if (defined($form->{role})) { my $envkey = 'user.role.'.$form->{role}; my $now=time; @@ -147,10 +116,6 @@ sub success { $destination .= 'selectrole=1&'.$newrole.'=1'; } } - } elsif (defined($form->{display})) { - if ($destination =~ m{^/adm/email($|\?)}) { - $destination .= ($destination =~ /\?/) ? '&' : '?' .'display='.&escape($form->{display}); - } } if (defined($form->{symb})) { my $destsymb = $form->{symb}; @@ -183,80 +148,22 @@ sub success { $destination .= 'source=login'; } - my $brcrum = [{'href' => '', - 'text' => 'Successful Login'},]; - my $args = {'no_inline_link' => 1, - 'bread_crumbs' => $brcrum,}; - if (($env{'request.deeplink.login'} eq $lowerurl) && - (($env{'request.linkprot'}) || ($env{'request.linkkey'} ne ''))) { - my %info; - if ($env{'request.linkprot'}) { - $info{'linkprot'} = $env{'request.linkprot'}; - foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') { - if ($form->{$item}) { - $info{$item} = $form->{$item}; - } - } - $args = {'only_body' => 1,}; - } elsif ($env{'request.linkkey'} ne '') { - $info{'linkkey'} = $env{'request.linkkey'}; - } - $info{'origurl'} = $lowerurl; - my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link'); - unless (($token eq 'con_lost') || ($token eq 'refused') || - ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) { - $destination .= (($destination =~ /\?/) ? '&' : '?') . 'ttoken='.$token; - } - } - if (($env{'request.deeplink.login'}) || ($env{'request.lti.login'})) { - if ($env{'environment.remote'} eq 'on') { - &Apache::lonnet::appenv({'environment.remote' => 'off'}); - } - } - my $startupremote; - if ($write_to_opener) { - if ($env{'environment.remote'} eq 'on') { - &Apache::lonnet::appenv({'environment.remote' => 'off'}); - } - $args->{'redirect'} = [0,$destination,'',$write_to_opener]; - } else { - if ($env{'environment.remote'} eq 'on') { - my $checkexempt; - if ($env{'user.loadbalexempt'} eq $r->dir_config('lonHostID')) { - if ($env{'user.loadbalcheck.time'} + 600 > time) { - $checkexempt = 1; - } - } - if ($env{'user.noloadbalance'} eq $r->dir_config('lonHostID')) { - $checkexempt = 1; - } - unless (($checkexempt) || - (($destination =~ m{^/adm/switchserver}) && (!$r->is_initial_req()))) { - my ($is_balancer,$otherserver) = - &Apache::lonnet::check_loadbalancing($env{'user.name'}, - $env{'user.domain'}); - if (($is_balancer) && ($otherserver ne '') && - ($otherserver ne $r->dir_config('lonHostID'))) { - $env{'environment.remote'} = 'off'; - } - } - } - $startupremote=&Apache::lonmenu::startupremote($destination); - } - my $windowinfo=&Apache::lonmenu::open($env{'browser.os'}); + my $startupremote=&Apache::lonmenu::startupremote($destination); my $remoteinfo=&Apache::lonmenu::load_remote_msg($lowerurl); my $setflags=&Apache::lonmenu::setflags(); my $maincall=&Apache::lonmenu::maincall(); + my $brcrum = [{'href' => '', + 'text' => 'Successful Login'},]; my $start_page=&Apache::loncommon::start_page('Successful Login', - $startupremote,$args); + $startupremote, + {'no_inline_link' => 1, + 'bread_crumbs' => $brcrum,}); my $end_page =&Apache::loncommon::end_page(); my $continuelink; if ($env{'environment.remote'} eq 'off') { - unless ($write_to_opener) { - $continuelink=''.&mt('Continue').''; - } + $continuelink=''.&mt('Continue').''; } # ------------------------------------------------- Output for successful login @@ -275,24 +182,17 @@ sub success { } $r->send_http_header; - if (($env{'request.linkprot'}) || ($env{'request.lti.login'})) { - $r->print(<$continuelink -$end_page -END - } else { - my %lt=&Apache::lonlocal::texthash( - 'wel' => 'Welcome', - 'pro' => 'Login problems?', - ); - my $loginhelp = &loginhelpdisplay($domain); - if ($loginhelp) { - $loginhelp = '

'.$lt{'pro'}.'

'; - } + my %lt=&Apache::lonlocal::texthash( + 'wel' => 'Welcome', + 'pro' => 'Login problems?', + ); + my $loginhelp = &loginhelpdisplay($domain); + if ($loginhelp) { + $loginhelp = '

'.$lt{'pro'}.'

'; + } - my $welcome = &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','',''); - $r->print(<',''); + $r->print(< 1}; } - if ($form->{firsturl} =~ m{^/tiny/$match_domain/\w+$}) { - if ($form->{linkprot}) { - $args->{only_body} = 1; - } - } - my @actions; my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef,$args); my $uname = &Apache::loncommon::cleanup_html($form->{'uname'}); my $udom = &Apache::loncommon::cleanup_html($form->{'udom'}); if (&Apache::lonnet::domain($udom,'description') eq '') { undef($udom); } - my $authtype; - if (($udom ne '') && ($uname ne '') && ($authhost eq 'no_host')) { - $authtype = &Apache::lonnet::queryauthenticate($uname,$udom); - } my $retry = '/adm/login'; - if (($uname eq $form->{'uname'}) && ($authtype !~ /^lti:/)) { + if ($uname eq $form->{'uname'}) { $retry .= '?username='.$uname; } if ($udom) { @@ -362,28 +251,6 @@ sub failed { my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl}); if ($firsturl ne '') { $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl; - if ($form->{firsturl} =~ m{^/tiny/$match_domain/\w+$}) { - unless (exists($form->{linkprot})) { - if (exists($form->{linkkey})) { - $retry .= 'linkkey='.$form->{linkkey}; - } - } - } - } - } - if (exists($form->{linkprot})) { - my %info = ( - 'linkprot' => $form->{'linkprot'}, - ); - foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') { - if ($form->{$item} ne '') { - $info{$item} = $form->{$item}; - } - } - my $ltoken = &Apache::lonnet::tmpput(\%info, - $r->dir_config('lonHostID'),'retry'); - if ($ltoken) { - $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken; } } } elsif ($querystr ne '') { @@ -392,28 +259,18 @@ sub failed { my $end_page = &Apache::loncommon::end_page(); &Apache::loncommon::content_type($r,'text/html'); $r->send_http_header; - if ($authtype =~ /^lti:/) { - $message = &mt('Direct login is not supported with the username you entered.'). - '

'. - &mt('You likely need to launch LON-CAPA from within a course in a different Learning Management System.'). - '
'. - &mt('You can also try to log in with a different username.'); - @actions = - (&mt('Try your [_1]log in again[_2].','','')); - } else { - $message = &mt($message); - @actions = - (&mt('Please [_1]log in again[_2].','','')); - } + my @actions = + (&mt('Please [_1]log in again[_2].','','')); my $loginhelp = &loginhelpdisplay($udom); if ($loginhelp) { push(@actions, ''.&mt('Login problems?').''); } #FIXME: link to helpdesk might be added here + $r->print( $start_page .'

'.&mt('Sorry ...').'

' - .&Apache::lonhtmlcommon::confirm_success($message,1).'

' + .&Apache::lonhtmlcommon::confirm_success(&mt($message),1).'

' .&Apache::lonhtmlcommon::actionbox(\@actions) .$end_page ); @@ -476,58 +333,6 @@ sub handler { if ($firsturl ne '') { $info{'firsturl'} = $firsturl; $dest = $firsturl; - my $relogin; - if ($dest =~ m{^/tiny/$match_domain/\w+$}) { - if ($env{'request.course.id'}) { - my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'}; - my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'}; - my $symb = &Apache::loncommon::symb_from_tinyurl($dest,$cnum,$cdom); - if ($symb) { - unless (&set_deeplink_login(%info) eq 'ok') { - $relogin = 1; - } - } - } - if ($relogin) { - $r->print( - $start_page - .'

'.&mt('You are already logged in!').'

' - .'

'.&mt('Please [_1]log out[_2] first, and then try your access again', - '','') - .'

' - .$end_page); - } else { - if (($info{'linkprot'}) || ($info{'linkkey'} ne '')) { - if (($info{'linkprot'}) && ($info{'linkprotuser'} ne '')) { - unless ($info{'linkprotuser'} eq $env{'user.name'}.':'.$env{'user.domain'}) { - $r->print( - $start_page - .'

'.&mt('You are already logged in, but as a different user from the one expected for the link you followed from another system').'

' - .'

'.&mt('Please [_1]log out[_2] first, and then try following the link again from the other system', - '','') - - .'

' - .$end_page); - return OK; - } - } - my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link'); - unless (($token eq 'con_lost') || ($token eq 'refused') || - ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) { - $dest .= (($dest =~ /\?/) ? '&' : '?') . 'ttoken='.$token; - } - } - $r->print( - $start_page - .'

'.&mt('You are already logged in!').'

' - .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4] first, and then try your access again', - '','', - '','') - .'

' - .$end_page); - } - return OK; - } } } } @@ -595,9 +400,6 @@ sub handler { my ($key,$value) = split(/=/,$item); $form{$key} = &unescape($value); } - if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) { - $form{'firsturl'} = $firsturl; - } my $upass = &Apache::loncommon::des_decrypt($des_key,$form{'upass0'}); # ---------------------------------------------------------------- Authenticate @@ -643,7 +445,7 @@ sub handler { } unless ($pwdverify) { &failed($r,'Username and/or password could not be authenticated.', - \%form,$authhost); + \%form); return OK; } } elsif ($authhost eq 'no_account_on_host') { @@ -765,18 +567,6 @@ sub handler { } } - if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - if (($form{'linkprot'}) && ($form{'linkprotuser'} ne '')) { - unless($form{'linkprotuser'} eq $form{'uname'}.':'.$form{'udom'}) { - delete($form{'udom'}); - delete($form{'uname'}); - &failed($r,'Username and/or domain are different to that expected for the link you followed from another system', - \%form,$authhost); - return OK; - } - } - } - my ($is_balancer,$otherserver); unless ($hosthere) { @@ -818,24 +608,6 @@ sub handler { if ($form{'symb'}) { $switchto .= '&symb='.$form{'symb'}; } - if ($form{'linkprot'}) { - $env{'request.linkprot'} = $form{'linkprot'}; - foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') { - if ($form{$item}) { - $env{'request.'.$item} = $form{$item}; - } - } - } elsif ($form{'linkkey'} ne '') { - $env{'request.linkkey'} = $form{'linkkey'}; - } - if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - &set_deeplink_login(%form); - } elsif ($firsturl eq '/adm/email') { - if ($form{'display'} && ($form{'mailrecip'} eq "$form{'uname'}:$form{'udom'}")) { - $env{'request.display'} = $form{'display'}; - $env{'request.mailrecip'} = $form{'mailrecip'}; - } - } $r->internal_redirect($switchto); } else { &Apache::loncommon::content_type($r,'text/html'); @@ -859,24 +631,6 @@ sub handler { if ($form{'symb'}) { $switchto .= '&symb='.$form{'symb'}; } - if ($form{'linkprot'}) { - $env{'request.linkprot'} = $form{'linkprot'}; - foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') { - if ($form{$item}) { - $env{'request.'.$item} = $form{$item}; - } - } - } elsif ($form{'linkkey'} ne '') { - $env{'request.linkkey'} = $form{'linkkey'}; - } - if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - &set_deeplink_login(%form); - } elsif ($firsturl eq '/adm/email') { - if ($form{'display'} && ($form{'mailrecip'} eq "$form{'uname'}:$form{'udom'}")) { - $env{'request.display'} = $form{'display'}; - $env{'request.mailrecip'} = $form{'mailrecip'}; - } - } $r->internal_redirect($switchto); } else { &Apache::loncommon::content_type($r,'text/html'); @@ -908,19 +662,6 @@ sub handler { if ($unloaded) { &success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect', undef,\%form); - if ($form{'linkprot'}) { - $env{'request.linkprot'} = $form{'linkprot'}; - } elsif ($form{'linkkey'} ne '') { - $env{'request.linkkey'} = $form{'linkkey'}; - } - if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - &set_deeplink_login(%form); - } elsif ($firsturl eq '/adm/email') { - if ($form{'display'} && ($form{'mailrecip'} eq "$form{'uname'}:$form{'udom'}")) { - $env{'request.display'} = $form{'display'}; - $env{'request.mailrecip'} = $form{'mailrecip'}; - } - } $r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl); return OK; } @@ -939,59 +680,9 @@ sub handler { $form{$item} = $sessiondata{$item}; } } - if ($sessiondata{'origurl'} eq '/adm/email') { - if (($sessiondata{'display'}) && ($sessiondata{'mailrecip'})) { - if (&unescape($sessiondata{'mailrecip'}) eq "$form{'uname'}:$form{'udom'}") { - $form{'display'} = &unescape($sessiondata{'display'}); - $form{'mailrecip'} = &unescape($sessiondata{'mailrecip'}); - } - } - } - } - } - if ($form{'linkprot'}) { - my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2); - if ($linkprotector) { - $extra_env = {'user.linkprotector' => $linkprotector, - 'user.linkproturi' => $uri}; - } - } elsif ($form{'linkkey'} ne '') { - $extra_env = {'user.deeplinkkey' => $form{'linkkey'}, - 'user.keyedlinkuri' => $form{'firsturl'}}; - } - if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - &set_deeplink_login(%form); - if ($form{'linkprot'}) { - if (ref($extra_env) eq 'HASH') { - %{$extra_env} = ( %{$extra_env}, 'request.linkprot' => $form{'linkprot'} ); - } else { - $extra_env = {'request.linkprot' => $form{'linkprot'}}; - } - if ($form{'linkprotexit'}) { - $extra_env->{'request.linkprotexit'} = $form{'linkprotexit'}; - } - if ($form{'linkprotpbid'}) { - $extra_env->{'request.linkprotpbid'} = $form{'linkprotpbid'}; - } - if ($form{'linkprotpburl'}) { - $extra_env->{'request.linkprotpburl'} = $form{'linkprotpburl'}; - } - } elsif ($form{'linkkey'} ne '') { - if (ref($extra_env) eq 'HASH') { - %{$extra_env} = ( %{$extra_env}, 'request.linkkey' => $form{'linkkey'} ); - } else { - $extra_env = {'request.linkkey' => $form{'linkkey'}}; - } - } - if ($env{'request.deeplink.login'}) { - if (ref($extra_env) eq 'HASH') { - %{$extra_env} = ( %{$extra_env}, 'request.deeplink.login' => $form{'firsturl'} ); - } else { - $extra_env = {'request.deeplink.login' => $form{'firsturl'}}; - } } } - &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env, + &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef, \%form); return OK; } @@ -1013,58 +704,11 @@ sub get_form_items { return %form; } -sub set_deeplink_login { - my (%form) = @_; - my $disallow; - if ($form{'firsturl'} =~ m{^/tiny/($match_domain)/\w+$}) { - my $cdom = $1; - my ($cnum,$symb) = &Apache::loncommon::symb_from_tinyurl($form{'firsturl'},'',$cdom); - if ($symb) { - if ($env{'request.course.id'} eq $cdom.'_'.$cnum) { - my $deeplink; - if ($symb =~ /\.(page|sequence)$/) { - my $mapname = &Apache::lonnet::deversion((&Apache::lonnet::decode_symb($symb))[2]); - my $navmap = Apache::lonnavmaps::navmap->new(); - if (ref($navmap)) { - $deeplink = $navmap->get_mapparam(undef,$mapname,'0.deeplink'); - } - } else { - $deeplink = &Apache::lonnet::EXT('resource.0.deeplink',$symb); - } - if ($deeplink ne '') { - my ($state,$others,$listed,$scope,$protect) = split(/,/,$deeplink); - if (($protect ne 'none') && ($protect ne '')) { - my ($acctype,$item) = split(/:/,$protect); - if ($acctype =~ /lti(c|d)$/) { - unless ($form{'linkprot'} eq $item.$1.':'.$env{'request.deeplink.login'}) { - $disallow = 1; - } - } elsif ($acctype eq 'key') { - unless ($form{'linkkey'} eq $item) { - $disallow = 1; - } - } - } - } - unless ($disallow) { - $env{'request.deeplink.login'} = $form{'firsturl'}; - } - } else { - $env{'request.deeplink.login'} = $form{'firsturl'}; - } - } - } - if ($disallow) { - return; - } - return 'ok'; -} - sub set_retry_token { my ($form,$lonhost,$querystr) = @_; if (ref($form) eq 'HASH') { my ($firsturl,$token,$extras,@names); - @names = ('role','symb','linkprotuser','linkprotexit','linkprot','linkkey','iptoken','linkprotpbid','linkprotpburl'); + @names = ('role','symb','iptoken'); foreach my $name (@names) { if ($form->{$name} ne '') { $extras .= '&'.$name.'='.&escape($form->{$name}); @@ -1132,7 +776,6 @@ sub check_can_host { my $alias = &Apache::lonnet::use_proxy_alias($r,$login_host); $hostname = $alias if ($alias ne ''); my $newurl = $protocol.'://'.$hostname.'/adm/createaccount'; -#FIXME Should preserve where user was going and linkprot by setting ltoken at $login_host $r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA'). '

'.&mt('Account creation').'

'. &mt('You do not currently have a LON-CAPA account at this institution.').'
'. @@ -1149,19 +792,6 @@ sub check_can_host { } else { &success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef, $form); - if ($form->{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { - $env{'request.deeplink.login'} = $form->{'firsturl'}; - } elsif ($form->{'firsturl'} eq '/adm/email') { - if ($form->{'display'} && ($form->{'mailrecip'} eq $form->{'uname'}.':'.$form->{'udom'})) { - $env{'request.display'} = $form->{'mailrecip'}; - $env{'request.mailrecip'} = $form->{'mailrecip'}; - } - } - if ($form->{'linkprot'}) { - $env{'request.linkprot'} = $form->{'linkprot'}; - } elsif ($form->{'linkkey'} ne '') { - $env{'request.linkkey'} = $form->{'linkkey'}; - } my ($otherserver) = &Apache::lonnet::choose_server($udom); $r->internal_redirect('/adm/switchserver?otherserver='.$otherserver); }