Annotation of loncom/html/adm/help/tex/Domain_Configuration_IP_Access.tex, revision 1.2
1.1 raeburn 1: \label{Domain_Configuration_IP_Access}
2:
3: To accommodate use of LON-CAPA within a dedicated Computer Based Testing Facility (CBTF), a domain configuration is available to set IP-based restrictions on availability of student roles in course(s) and access to LON-CAPA tools used for communication and collaboration.
4:
5: This complements domain settings in the ``Blogs, personal web pages, webDAV/quotas, portfolios'' section \ref{Domain_Configuration_IP_Access} which apply by default, regardless of a user's IP address, to specific types of user (e.g., Student, Staff etc.). IP-based access controls set at a domain level also complement time-limited blocks a Course Cordinator can set in a course via Settings $>$ Content Settings $>$ Blocking Communication/Resource Access, some of which can impact functionality in other courses, e.g.,, Chat, Messaging, Portfolio and Blogs.
6:
7: Configuration of IP-based access control in a domain supports multiple access control items, and each item in use will be assigned the following:
8:
9: \begin{itemize}
10:
11: \item Location(s)
12:
13: An identifier, typically the name of the location where IP-based access control is needed, e.g., CBTF.
14:
15: \item IP Range(s)
16:
1.2 ! raeburn 17: The IP address(es) of users' web browsers from which access to specific courses is allowed, while blocked for all other course roles, and also for which communication blocking will be in effect. Each set of IP addresses should either be in the format: IP netblock/prefix (i.e., A.B.C.D/N) or a hyphen-separated IP range (i.e., A.B.C.D-E.F.G.H). If multiple sets apply for a single location, each set should be separated by a comma from other set(s). Range(s) will be stored in LON-CAPA as IP netblock(s) in CIDR notation (comma separated).
1.1 raeburn 18:
19: \item Functionality Blocked?
20:
21: Choose communication and/or collaboration functions in LON-CAPA to block for non-privileged users, i.e., users without the ``Evade communication blocking'' (evb) privilege (Course Coordinators or Instructors). The only LON-CAPA messages a non-privileged user can display are ``Critical Messages'' sent by course personnel or by a Domain Coordinator. Users will still be able to send regular LON-CAPA messages, but they will not be viewable by non-privileged recipient(s) also subject to IP-based communication blocking. For functions subject to blocking, a ``Communication blocked'' link will be shown, which when followed will pop-up open a window to explain the cause of the block.
22:
23: \item Courses/Communities allowed
24:
25: Choose which course(s) and/or communities should be exclusively selectable by students when accessing LON-CAPA from a web browser with an IP address which falls within the IP range(s) designated for the particular location. Those same courses will be unavailable for selection from other locations, unless another access control item in the domain is in effect for IP address(es) elsewhere. Users with the `evb' privilege are exempt from restrictions on role selections in a course, unless selecting a student role.
26:
27: As a user may potentially have been assigned roles in different LON-CAPA domains it is important to understand that IP-based access control rules on a course will only apply to users who meet at least one of the following conditions:
28:
29: \begin{itemize}
30:
31: \item User's domain and course's domain are the same
32:
33: \item User's domain is one of the current server's domain(s)
34:
35: \item User's domain is one of the institution's domain(s)
36:
37: \end{itemize}
38:
1.2 ! raeburn 39: Accordingly, either the domain should be configured so LON-CAPA sessions for the domain's users may only be hosted on the institution's own server(s), see the ``User session hosting/offloading'' section \ref{Domain_Configuration_User_Sessions}, or web browsers in the location (or local network) should be "locked down" such that the only LON-CAPA servers which may be contacted by browsers in the location are servers in the institution's domain(s).
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>