File:
[LON-CAPA] /
loncom /
auth /
switchserver.pm
Revision
1.63:
download - view:
text,
annotated -
select for diffs
Tue Sep 13 12:22:14 2022 UTC (23 months ago) by
raeburn
Branches:
MAIN
CVS tags:
HEAD
- In course context, switch server to resource's home server opens new tab
when editing published resource, and ca role is loaded, when user's domain
(by default) disallows session hosting of domain's users in resource's domain.
- New arg (skip_enc_check) in redirect args , used by loncommon::headtag()
it true, omit application of check_encrypt().
- New seventh item ($shownsymb) in args for lonhtmlcommon::jump_to_editres()
1: # The LearningOnline Network
2: # Switch Servers Handler
3: #
4: # $Id: switchserver.pm,v 1.63 2022/09/13 12:22:14 raeburn Exp $
5: #
6: # Copyright Michigan State University Board of Trustees
7: #
8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
9: #
10: # LON-CAPA is free software; you can redistribute it and/or modify
11: # it under the terms of the GNU General Public License as published by
12: # the Free Software Foundation; either version 2 of the License, or
13: # (at your option) any later version.
14: #
15: # LON-CAPA is distributed in the hope that it will be useful,
16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18: # GNU General Public License for more details.
19: #
20: # You should have received a copy of the GNU General Public License
21: # along with LON-CAPA; if not, write to the Free Software
22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23: #
24: # /home/httpd/html/adm/gpl.txt
25: #
26: # http://www.lon-capa.org/
27: #
28:
29: package Apache::switchserver;
30:
31: use strict;
32: use Apache::Constants qw(:common :remotehost);
33: use Apache::lonnet;
34: use Digest::MD5 qw(md5_hex);
35: use CGI::Cookie();
36: use Apache::lonlocal;
37: use LONCAPA qw(:DEFAULT :match);
38:
39: sub init_env {
40: my ($r) = @_;
41:
42: if (-e $env{'user.environment'}) {
43: return $env{'user.environment'};
44: }
45: my $requrl=$r->uri;
46: my $handle= &Apache::lonnet::check_for_valid_session($r);
47: if ($handle ne '') {
48: return undef;
49: }
50: my $lonidsdir=$r->dir_config('lonIDsDir');
51: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
52:
53: return $r->dir_config('lonIDsDir')."/$handle.id";
54: }
55:
56: sub do_redirect {
57: my ($r,$url,$only_body,$extra_text,$write_to_opener) = @_;
58: $r->send_http_header;
59: my $delay = 0.5;
60: if ($only_body && !$extra_text) {
61: $delay = 0;
62: }
63: my $start_page =
64: &Apache::loncommon::start_page('Switching Server ...',undef,
65: {'redirect' => [$delay,$url,'',$write_to_opener,1],
66: 'only_body' => $only_body,});
67: my $end_page = &Apache::loncommon::end_page();
68: $r->print($start_page.$extra_text.$end_page);
69: unless ($env{'user.name'} eq 'public' && ($env{'user.domain'} eq 'public')) {
70: $r->register_cleanup(\&flush_course_logs);
71: }
72: return OK;
73: }
74:
75: sub balancer_cookieid {
76: my ($r,$desthost,$uname,$udom) = @_;
77: my @hosts = &Apache::lonnet::current_machine_ids();
78: my $newcookieid;
79: unless (grep(/^\Q$desthost\E$/,@hosts)) {
80: my $balancedir=$r->dir_config('lonBalanceDir');
81: $newcookieid = &md5_hex(&md5_hex(time.{}.rand().$$));
82: my $cookie = $udom.'_'.$uname.'_'.$newcookieid;
83: my $balcookie = "balanceID=$cookie; path=/; HttpOnly;";
84: if (open(my $fh,'>',"$balancedir/$cookie.id")) {
85: print $fh $desthost;
86: close($fh);
87: $r->headers_out->add('Set-cookie' => $balcookie);
88: }
89: }
90: return $newcookieid;
91: }
92:
93: sub flush_course_logs {
94: &Apache::lonnet::flushcourselogs();
95: return OK;
96: }
97:
98: sub handler {
99: my ($r) = @_;
100:
101: my $handle=&init_env($r);
102: if (!defined($handle)) { return FORBIDDEN; }
103:
104: &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'},
105: ['otherserver','role','origurl','symb','lcssowin','edit']);
106:
107: my $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'});
108: if (! $env{'form.otherserver'}) {
109: $env{'form.otherserver'} =
110: &Apache::lonnet::find_existing_session($env{'user.domain'},
111: $env{'user.name'});
112: if (! $env{'form.otherserver'}) {
113: $env{'form.otherserver'} =
114: &Apache::lonnet::spareserver($r,30000,undef,1);
115: }
116: $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'});
117: }
118:
119: if (!defined($switch_to)) { return FORBIDDEN; }
120:
121: my $protocol = 'http';
122: if ($env{'form.otherserver'}) {
123: if ($Apache::lonnet::protocol{$env{'form.otherserver'}} eq 'https') {
124: $protocol = $Apache::lonnet::protocol{$env{'form.otherserver'}};
125: }
126: unless ($env{'form.otherserver'} eq $r->dir_config('lonHostID')) {
127: my $alias = &Apache::lonnet::use_proxy_alias($r,$env{'form.otherserver'});
128: $switch_to = $alias if ($alias ne '');
129: }
130: }
131:
132: if ($env{'user.name'} eq 'public'
133: && $env{'user.domain'} eq 'public') {
134: my $url = $protocol.'://'.$switch_to.$r->uri;
135: unlink($handle);
136: #expire the cookie
137: my $c = new CGI::Cookie(-name => 'lonPubID',
138: -value => '',
139: -expires => '-10y',);
140: $r->header_out('Set-cookie' => $c);
141: return &do_redirect($r,$url,1)
142: }
143:
144: my $skip_canhost_check = '';
145: my $now = time;
146: if ($env{'form.role'}) {
147: if (!exists($env{'user.role.'.$env{'form.role'}})) {
148: delete($env{'form.role'});
149: } else {
150: my ($start,$end) = split(/\./,$env{'user.role.'.$env{'form.role'}});
151: if (($start && $start > $now) || ($end && $end < $now)) {
152: delete($env{'form.role'});
153: } elsif ($env{'form.role'} eq 'au./'.$env{'user.domain'}.'/') {
154: if (&Apache::lonnet::homeserver($env{'user.name'},$env{'user.domain'}) eq $env{'form.otherserver'}) {
155: $skip_canhost_check = 1;
156: }
157: } elsif ($env{'form.role'} =~ m{^[ac]a\./($match_domain)/($match_username)$}) {
158: my ($audom,$auname) = ($1,$2);
159: if (&Apache::lonnet::homeserver($auname,$audom) eq $env{'form.otherserver'}) {
160: if ((&Apache::lonnet::will_trust('othcoau',$env{'user.domain'},$audom)) &&
161: (&Apache::lonnet::will_trust('coaurem',$audom,$env{'user.domain'}))) {
162: $skip_canhost_check = 1;
163: }
164: }
165: }
166: }
167: }
168:
169: unless ($skip_canhost_check) {
170: my $canhost = &Apache::lonnet::can_switchserver($env{'user.domain'},$env{'form.otherserver'});
171: unless ($canhost) {
172: if (($env{'request.course.id'}) && ($env{'form.symb'} ne '') &&
173: (&Apache::lonnet::allowed('mdc',$env{'request.course.id'}))) {
174: my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
175: my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
176: if (($cdom ne '') && ($cnum ne '') && ($env{'form.role'} =~ m{^([^.]+)\Q./$cdom/$cnum\E$})) {
177: my $symb = &Apache::lonnet::symbclean($env{'form.symb'});
178: my ($map,$idx,$url) = &Apache::lonnet::decode_symb($symb);
179: if (&Apache::lonnet::symbverify($symb,$url)) {
180: my $fileloc = &Apache::lonnet::declutter(&Apache::lonnet::filelocation("",$url));
181: my $resurl = &Apache::lonnet::clutter($url);
182: if ($resurl =~ m{^/res/($match_domain)/($match_username)/}) {
183: my ($audom,$auname) = ($1,$2);
184: if (&Apache::lonnet::homeserver($auname,$audom) eq $env{'form.otherserver'}) {
185: my @possroles = ("user.role.au./$audom/","user.role.ca./$audom/$auname","user.role.aa./$audom/$auname");
186: my $hasrole;
187: foreach my $rolekey (@possroles) {
188: if (exists($env{$rolekey})) {
189: my ($start,$end) = split(/\./,$env{$rolekey});
190: unless (($start && $start > $now) || ($end && $end < $now)) {
191: if ($rolekey eq "user.role.au./$audom/") {
192: $hasrole = $rolekey;
193: } elsif ((&Apache::lonnet::will_trust('othcoau',$env{'user.domain'},$audom)) &&
194: (&Apache::lonnet::will_trust('coaurem',$audom,$env{'user.domain'}))) {
195: $hasrole = $rolekey;
196: }
197: }
198: if ($hasrole) {
199: $hasrole =~ s/^\Quser.role.\E//;
200: last;
201: }
202: }
203: }
204: if ($hasrole) {
205: $env{'form.role'} = $hasrole;
206: $env{'form.origurl'} = &Apache::lonnet::deversion($resurl);
207: $env{'form.origurl'} =~ s{^/res/}{/priv/};
208: delete($env{'form.symb'});
209: $canhost = 1;
210: if ($env{'form.edit'}) {
211: my $ip = &Apache::lonnet::get_requestor_ip($r,REMOTE_NOLOOKUP);
212: my %info=('ip' => $ip,
213: 'domain' => $env{'user.domain'},
214: 'username' => $env{'user.name'},
215: 'home' => $env{'user.home'},
216: 'role' => $env{'form.role'},
217: 'server' => $r->dir_config('lonHostID'),
218: 'origurl' => $env{'form.origurl'});
219: &Apache::loncommon::content_type($r,'text/html');
220: my $token = &Apache::lonnet::tmpput(\%info,$env{'form.otherserver'});
221: my $url = $protocol.'://'.$switch_to.'/adm/login?'.
222: 'domain='.$env{'user.domain'}.
223: '&username='.$env{'user.name'}.
224: '&token='.$token;
225: return &do_redirect($r,$url,0);
226: }
227: }
228: }
229: }
230: }
231: }
232: }
233: }
234: unless ($canhost) { return FORBIDDEN; }
235: }
236:
237: #remove session env, and log event
238: if (unlink($handle)) {
239: if ($env{'user.linkedenv'} ne '') {
240: my $lonidsdir=$r->dir_config('lonIDsDir');
241: if (($env{'user.linkedenv'} =~ /^[a-f0-9]+_linked$/) &&
242: (-l "$lonidsdir/$env{'user.linkedenv'}.id") &&
243: (readlink("$lonidsdir/$env{'user.linkedenv'}.id") eq $handle)) {
244: unlink("$lonidsdir/$env{'user.linkedenv'}.id");
245: }
246: }
247: }
248: my %temp=('switchserver' => $now.':'.$env{'form.otherserver'},
249: $env{'form.role'});
250: &Apache::lonnet::put('email_status',\%temp);
251: my $logmsg = "Switch Server to $env{'form.otherserver'}";
252: if ($env{'form.role'}) {
253: $logmsg .= " with role: $env{'form.role'}";
254: } elsif (($env{'form.lti.reqcrs'}) && ($env{'form.lti.reqrole'} eq 'cc')) {
255: $logmsg .= " to create new LTI course";
256: } elsif ($env{'form.lti.selfenrollrole'}) {
257: $logmsg .= " to selfenroll with role: $env{'form.lti.selfenrollrole'}";
258: } else {
259: $logmsg .= " (no role)";
260: }
261: my $ip = &Apache::lonnet::get_requestor_ip($r,REMOTE_NOLOOKUP);
262: $logmsg .= ' '.$ip;
263: &Apache::lonnet::log($env{'user.domain'},$env{'user.name'},
264: $env{'user.home'},$logmsg);
265:
266: &Apache::loncommon::content_type($r,'text/html');
267:
268: #expire the cookies
269: my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
270: foreach my $name (keys(%cookies)) {
271: next unless ($name =~ /^lon(|S|Link|Pub)ID$/);
272: my $c = new CGI::Cookie(-name => $name,
273: -value => '',
274: -expires => '-10y',);
275: $r->headers_out->add('Set-cookie' => $c);
276: }
277: if ($r->header_only) {
278: $r->send_http_header;
279: return OK;
280: }
281: # -------------------------------------------------------- Menu script and info
282:
283: # ---------------------------------------------------------------- Get handover
284:
285: my ($is_balancer,$setcookie,$newcookieid,$otherbalcookie,$offloadto,$dom_balancers);
286: my $only_body = 0;
287: ($is_balancer,undef,$setcookie,$offloadto,$dom_balancers) =
288: &Apache::lonnet::check_loadbalancing($env{'user.name'},$env{'user.domain'},'switchserver');
289: if ($is_balancer && $setcookie && $env{'form.otherserver'}) {
290:
291: # Set a balancer cookie unless browser already sent LON-CAPA load balancer
292: # cookie which points at the target server
293: my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r,1);
294:
295: if (($found_server eq $env{'form.otherserver'}) &&
296: ($balancer_cookie =~ /^\Q$env{'user.domain'}\E_\Q$env{'user.name'}\E_/)) {
297: $only_body = 1;
298: } else {
299: $newcookieid = &balancer_cookieid($r,$env{'form.otherserver'},
300: $env{'user.name'},$env{'user.domain'});
301: }
302: }
303: if ((!$is_balancer) && ($env{'request.balancercookie'})) {
304: $otherbalcookie = $env{'request.balancercookie'};
305: }
306:
307: my %info=('ip' => $ip,
308: 'domain' => $env{'user.domain'},
309: 'username' => $env{'user.name'},
310: 'home' => $env{'user.home'},
311: 'role' => $env{'form.role'},
312: 'server' => $r->dir_config('lonHostID'),
313: 'balancer' => $is_balancer,
314: 'dom_balancers' => $dom_balancers,
315: 'offloadto' => '');
316: if (ref($offloadto) eq 'HASH') {
317: foreach my $key (keys(%{$offloadto})) {
318: if (ref($offloadto->{$key}) eq 'ARRAY') {
319: $info{'offloadto'} .= $key.'='.join(',',@{$offloadto->{$key}}).'&';
320: }
321: }
322: $info{'offloadto'} =~ s/\&$//;
323: } elsif (ref($offloadto) eq 'ARRAY') {
324: $info{'offloadto'} = join(',',@{$offloadto});
325: }
326: if ($newcookieid) {
327: $info{'balcookie'} = $newcookieid;
328: } elsif ($otherbalcookie) {
329: $info{'otherbalcookie'} = $otherbalcookie;
330: }
331: if ($env{'form.origurl'}) {
332: $info{'origurl'} = $env{'form.origurl'};
333: }
334: if ($env{'form.symb'}) {
335: $info{'symb'} = $env{'form.symb'};
336: }
337: my $ssologoutscript = '';
338: my $write_to_opener;
339: if ($env{'request.sso.login'}) {
340: $info{'sso.login'} = $env{'request.sso.login'};
341: if (defined($r->dir_config("lonSSOUserLogoutScriptFile_$info{domain}"))) {
342: if (open(my $fh,'<',$r->dir_config("lonSSOUserLogoutScriptFile_$info{domain}"))) {
343: $ssologoutscript .= join('',<$fh>);
344: close($fh);
345: }
346: }
347: if (defined($r->dir_config('lonSSOUserLogoutScriptFile'))) {
348: if (open(my $fh,'<',$r->dir_config('lonSSOUserLogoutScriptFile'))) {
349: $ssologoutscript .= join('',<$fh>);
350: close($fh);
351: }
352: }
353: }
354: if ($env{'request.sso.reloginserver'}) {
355: $info{'sso.reloginserver'} = $env{'request.sso.reloginserver'};
356: }
357: if ($env{'request.linkprot'}) {
358: $info{'linkprot'} = $env{'request.linkprot'};
359: foreach my $item ('linkprotuser','linkprotexit') {
360: if ($env{'request.'.$item}) {
361: $info{$item} = $env{'request.'.$item};
362: }
363: }
364: } elsif ($env{'request.linkkey'} ne '') {
365: $info{'linkkey'} = $env{'request.linkkey'};
366: }
367: if ($env{'request.deeplink.login'}) {
368: $info{'deeplink.login'} = $env{'request.deeplink.login'};
369: }
370: if ($env{'request.lti.login'}) {
371: $info{'lti.login'} = $env{'request.lti.login'};
372: }
373: if ($env{'request.lti.uri'}) {
374: $info{'lti.uri'} = $env{'request.lti.uri'};
375: }
376: if ($env{'request.lti.reqcrs'}) {
377: $info{'lti.reqcrs'} = $env{'request.lti.reqcrs'};
378: }
379: if ($env{'request.lti.reqrole'}) {
380: $info{'lti.reqrole'} = $env{'request.lti.reqrole'};
381: }
382: if ($env{'request.lti.selfenrollrole'}) {
383: $info{'lti.selfenrollrole'} = $env{'request.lti.selfenrollrole'};
384: }
385: if ($env{'request.lti.sourcecrs'}) {
386: $info{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'};
387: }
388: if ($env{'request.lti.passbackid'}) {
389: $info{'lti.passbackid'} = $env{'request.lti.passbackid'};
390: }
391: if ($env{'request.lti.passbackurl'}) {
392: $info{'lti.passbackurl'} = $env{'request.lti.passbackurl'};
393: }
394: if ($env{'request.lti.rosterid'}) {
395: $info{'lti.rosterid'} = $env{'request.lti.rosterid'};
396: }
397: if ($env{'request.lti.rosterurl'}) {
398: $info{'lti.rosterurl'} = $env{'request.lti.rosterurl'};
399: }
400: if ($env{'request.lti.target'}) {
401: $info{'lti.target'} = $env{'request.lti.target'};
402: }
403: my $token = &Apache::lonnet::tmpput(\%info,$env{'form.otherserver'});
404: my @args = ("domain=$env{'user.domain'}",
405: "username=$env{'user.name'}",
406: "token=$token");
407: my $url = $protocol.'://'.$switch_to.'/adm/login?';
408: if ($env{'form.lcssowin'}) {
409: $url .= join('&',@args);
410: $only_body = 1;
411: } else {
412: $url .= join('&',@args);
413: }
414: # --------------------------------------------------------------- Screen Output
415: return &do_redirect($r, $url, $only_body, $ssologoutscript, $env{'form.lcssowin'});
416: }
417:
418: 1;
419: __END__
420:
421:
422:
423:
424:
425:
426:
427:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>