CVS log for loncom/cgi/lonauthcgi.pm

Up to [LON-CAPA] / loncom / cgi

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- For 2.11
  Backport 1.17

- Retrieval of requestor's IP address centralized in lonnet::get_requestor_ip()
- Domain configuration to allow domain's LON-CAPA nodes to operate behind a
  WAF/Reverse Proxy using aliased hostname (CNAME).
- Web requests from other nodes bypass the WAF as their requests are made
  directly to the server hostname (A record); same for internal LON-CAPA
  connections for lonc -> lond.

- For 2.11
  - Backport 1.16

- &Apache::lonnet::hostname expects to be passed a hostID not an IP address.

- Use Server Name Indication (SNI) and SSL when replicating content from
  /raw/.
- Domain status screen has link to show status of LON-CAPA SSL certificates.
- "SSL" domain config for (a) "internal" LON-CAPA SSL connection to servers/VMs
  in other domain, (b) Replication of domain's resources to other domains.
- Replication can use name-based virtual hosts with SSL, with verification of
  client certificate (cert: /home/httpd/lonCerts/lonhostnamecert.pem, signed
  by LON-CAPA CA, with Common Name of internal-<server hostname>, same IP address
  as server hostname).

- Display of Course/Community Catalog with enrollment data added to "server
  status" pages for which access can be IP-based or available to specified
  authenticated users (DC role not required).

- Display Course/Community Disk Usage on Domain Status page.

- Access to information about courses in a domain with six character
  unique codes (html, xml or csv format).
  - Initial use case is for a separate portal (token-based auth)
    where students enter the code to sign up for a specific "textbook"
    course.

- Eliminate duplication of domains in list returned by &can_view().

- Utilities to checksum LON-CAPA modules to verify integrity of
  LON-CAPA installation, and also to check the availibility of new
  LON-CAPA releases.

- New routine: loncgi::cgi_header() generates HTTP response headers using CGI.pm
- New arg in lonauthcgi::can_view() - $domain (optional),
  used if $page is needed for a specific domain.
- New return value: either 1, or a &-separated list of domains for which access is
  allowed.

- Rights to run /cgi-bin/ping.pl on any server in the cluster, from any other host
  in the cluster.
- For scripts using lonauthcgi::check_ipbased_access(), access permitted for both 127.0.0.1
  and also if remote IP is same as IP of host server.
- check_domain_ip() - new routine: allows access to scripts from any server which belongs
  to the same domain as the host server.
- update POD for check_ipbased_access().
- Add new global hash: Apache::lonnet::managerstab to store contents of:
  /home/httpd/lonTabs/managers.tab, loaded within BEGIN {} block.
- No automatic access to toggledebug and takeoffline items from server listed in
  managers.tab (unlike other keys in %serverstatus_titles).

- IP-based access to status information for manager in manager.tab

- Codng style
  - Consistent quoting style.

- Show/Hide Toggle Debug link in User Preferences now set via Domain Configuration (in place of hard-coded developer usernames).

-  early out was one loop too far out.

Changes to access control for /adm/test
- Access to /adm/test allowed if requestor has a DC role in requestor's domain,
  regardless of current role.
- For /adm/test, domain checked is requestor's domain, not domain(s) hosted on server.
- Update documentation.

- Typo.

- Create new module - lonauthcgi.pm -to contain modules previously in loncgi.pm
    which require lonnet.pm, so loncgi.pm need not import lonnet.pm.
- Moved &check_ipbased_access(), &can_view(), &unauthorized_msg(), and
    &serverstatus_titles() from  loncgi.pm to lonauthcgi.pm.