--- loncom/interface/loncreateuser.pm 2002/04/23 21:05:45 1.33
+++ loncom/interface/loncreateuser.pm 2006/11/22 21:55:53 1.136
@@ -1,7 +1,7 @@
# The LearningOnline Network with CAPA
# Create a user
#
-# $Id: loncreateuser.pm,v 1.33 2002/04/23 21:05:45 matthew Exp $
+# $Id: loncreateuser.pm,v 1.136 2006/11/22 21:55:53 raeburn Exp $
#
# Copyright Michigan State University Board of Trustees
#
@@ -25,36 +25,48 @@
#
# http://www.lon-capa.org/
#
-# (Create a course
-# (My Desk
-#
-# (Internal Server Error Handler
-#
-# (Login Screen
-# 5/21/99,5/22,5/25,5/26,5/31,6/2,6/10,7/12,7/14,
-# 1/14/00,5/29,5/30,6/1,6/29,7/1,11/9 Gerd Kortemeyer)
-#
-# YEAR=2001
-# 3/1/1 Gerd Kortemeyer)
-#
-# 3/1 Gerd Kortemeyer)
-#
-# 2/14 Gerd Kortemeyer)
-#
-# 2/14,2/17,2/19,2/20,2/21,2/22,2/23,3/2,3/17,3/24,04/12 Gerd Kortemeyer
-# April Guy Albertelli
-# 05/10,10/16 Gerd Kortemeyer
-# 11/12,11/13,11/15 Scott Harrison
-# 02/11/02 Matthew Hall
-#
-# $Id: loncreateuser.pm,v 1.33 2002/04/23 21:05:45 matthew Exp $
###
package Apache::loncreateuser;
+=pod
+
+=head1 NAME
+
+Apache::loncreateuser - handler to create users and custom roles
+
+=head1 SYNOPSIS
+
+Apache::loncreateuser provides an Apache handler for creating users,
+ editing their login parameters, roles, and removing roles, and
+ also creating and assigning custom roles.
+
+=head1 OVERVIEW
+
+=head2 Custom Roles
+
+In LON-CAPA, roles are actually collections of privileges. "Teaching
+Assistant", "Course Coordinator", and other such roles are really just
+collection of privileges that are useful in many circumstances.
+
+Creating custom roles can be done by the Domain Coordinator through
+the Create User functionality. That screen will show all privileges
+that can be assigned to users. For a complete list of privileges,
+please see C.
+
+Custom role definitions are stored in the C file of the role
+author.
+
+=cut
+
use strict;
use Apache::Constants qw(:common :http);
use Apache::lonnet;
+use Apache::loncommon;
+use Apache::lonlocal;
+use Apache::longroup;
+use lib '/home/httpd/lib/perl/';
+use LONCAPA;
my $loginscript; # piece of javascript used in two separate instances
my $generalrule;
@@ -64,71 +76,120 @@ my $authformint;
my $authformfsys;
my $authformloc;
-BEGIN {
- $ENV{'SERVER_NAME'}=~/(\w+\.\w+)$/;
- my $krbdefdom=$1;
- $krbdefdom=~tr/a-z/A-Z/;
+sub initialize_authen_forms {
+ my ($krbdefdom)=( $ENV{'SERVER_NAME'}=~/(\w+\.\w+)$/);
+ $krbdefdom= uc($krbdefdom);
my %param = ( formname => 'document.cu',
kerb_def_dom => $krbdefdom
);
- $loginscript = &Apache::loncommon::authform_header(%param);
+# no longer static due to configurable kerberos defaults
+# $loginscript = &Apache::loncommon::authform_header(%param);
$generalrule = &Apache::loncommon::authform_authorwarning(%param);
$authformnop = &Apache::loncommon::authform_nochange(%param);
- $authformkrb = &Apache::loncommon::authform_kerberos(%param);
+# no longer static due to configurable kerberos defaults
+# $authformkrb = &Apache::loncommon::authform_kerberos(%param);
$authformint = &Apache::loncommon::authform_internal(%param);
$authformfsys = &Apache::loncommon::authform_filesystem(%param);
$authformloc = &Apache::loncommon::authform_local(%param);
}
+
+# ======================================================= Existing Custom Roles
+
+sub my_custom_roles {
+ my %returnhash=();
+ my %rolehash=&Apache::lonnet::dump('roles');
+ foreach my $key (keys %rolehash) {
+ if ($key=~/^rolesdef\_(\w+)$/) {
+ $returnhash{$1}=$1;
+ }
+ }
+ return %returnhash;
+}
+
+# ==================================================== Figure out author access
+
+sub authorpriv {
+ my ($auname,$audom)=@_;
+ unless ((&Apache::lonnet::allowed('cca',$audom.'/'.$auname))
+ || (&Apache::lonnet::allowed('caa',$audom.'/'.$auname))) { return ''; }
+ return 1;
+}
+
+# ====================================================
+
+sub portfolio_quota {
+ my ($ccuname,$ccdomain) = @_;
+ my %lt = &Apache::lonlocal::texthash(
+ 'disk' => "Disk space allocated to user's portfolio files",
+ );
+ my $output = '
'.$lt{'disk'}.'
'.
+ ' Mb';
+ return $output;
+}
+
# =================================================================== Phase one
-sub phase_one {
- my $r=shift;
- my $defdom=$ENV{'user.domain'};
+sub print_username_entry_form {
+ my ($r) = @_;
+ my $defdom=$env{'request.role.domain'};
my @domains = &Apache::loncommon::get_domains();
my $domform = &Apache::loncommon::select_dom_form($defdom,'ccdomain');
+ my $selscript=&Apache::loncommon::studentbrowser_javascript();
+ my $start_page =
+ &Apache::loncommon::start_page('Create Users, Change User Privileges',
+ $selscript);
+
+ my $sellink=&Apache::loncommon::selectstudent_link
+ ('crtuser','ccuname','ccdomain');
+ my %existingroles=&my_custom_roles();
+ my $choice=&Apache::loncommon::select_form('make new role','rolename',
+ ('make new role' => 'Generate new role ...',%existingroles));
+ my %lt=&Apache::lonlocal::texthash(
+ 'siur' => "Set Individual User Roles",
+ 'usr' => "Username",
+ 'dom' => "Domain",
+ 'usrr' => "User Roles",
+ 'ecrp' => "Edit Custom Role Privileges",
+ 'nr' => "Name of Role",
+ 'cre' => "Custom Role Editor"
+ );
+ my $help = &Apache::loncommon::help_open_menu(undef,undef,282,'Instructor Interface');
+ my $helpsiur=&Apache::loncommon::help_open_topic('Course_Change_Privileges');
+ my $helpecpr=&Apache::loncommon::help_open_topic('Course_Editing_Custom_Roles');
$r->print(<<"ENDDOCUMENT");
-
-
-The LearningOnline Network with CAPA
-
-
-
ENDCHANGEUSER
# Get the users information
my %userenv = &Apache::lonnet::get('environment',
- ['firstname','middlename','lastname','generation'],
- $ccdomain,$ccuname);
+ ['firstname','middlename','lastname','generation',
+ 'portfolioquota'],$ccdomain,$ccuname);
my %rolesdump=&Apache::lonnet::dump('roles',$ccdomain,$ccuname);
- $r->print(<
-
'.
+ &Apache::loncommon::end_data_table_header_row().
+ &Apache::loncommon::start_data_table_row());
+ foreach my $item ('firstname','middlename','lastname','generation') {
if (&Apache::lonnet::allowed('mau',$ccdomain)) {
- $r->print(<<"END");
-
+ $r->print(<<"END");
+
END
} else {
- $r->print('
'.$userenv{$_}.'
');
+ $r->print('
'.$userenv{$item}.'
');
}
}
- $r->print(<
-
-END
+ $r->print(&Apache::loncommon::end_data_table_row().
+ &Apache::loncommon::end_data_table());
# Build up table of user roles to allow revocation of a role.
my ($tmp) = keys(%rolesdump);
unless ($tmp =~ /^(con_lost|error)/i) {
my $now=time;
- $r->print('
Revoke Existing Roles
'.
- '
Revoke
Role
Extent
'.
- '
Start
End
');
- foreach my $area (keys(%rolesdump)) {
- if ($area!~/^rolesdef/) {
- my $role = $rolesdump{$area};
- my $thisrole=$area;
- $area=~s/\_\w\w$//;
- my ($role_code,$role_end_time,$role_start_time) =
- split(/_/,$role);
- my $bgcol='ffffff';
- my $allows=0;
- if ($area=~/^\/(\w+)\/(\d\w+)/) {
- my %coursedata=
- &Apache::lonnet::coursedescription($1.'_'.$2);
- my $carea='Course: '.$coursedata{'description'};
- $inccourses{$1.'_'.$2}=1;
- if (&Apache::lonnet::allowed('c'.$role_code,$1.'/'.$2)) {
- $allows=1;
- }
- # Compute the background color based on $area
- $bgcol=$1.'_'.$2;
- $bgcol=~s/[^8-9b-e]//g;
- $bgcol=substr($bgcol.$bgcol.$bgcol.'ffffff',0,6);
- if ($area=~/^\/(\w+)\/(\d\w+)\/(\w+)/) {
- $carea.=' Section/Group: '.$3;
- }
- $area=$carea;
- } else {
- # Determine if current user is able to revoke privileges
- if ($area=~/^\/(\w+)\//) {
- if (&Apache::lonnet::allowed('c'.$role_code,$1)) {
- $allows=1;
- }
- } else {
- if (&Apache::lonnet::allowed('c'.$role_code,'/')) {
- $allows=1;
- }
- }
- }
- $r->print('
');
- my $active=1;
- $active=0 if (($role_end_time) && ($now>$role_end_time));
- if (($active) && ($allows)) {
- $r->print('');
- } else {
- $r->print(' ');
- }
- $r->print('
+END
+ foreach my $type ('Construction Space','Course','Group','Domain','System','Unknown') {
+ if ($output{$type}) {
+ $r->print($output{$type}."\n");
+ }
+ }
+ $r->print('
');
+ }
} # End of unless
my $currentauth=&Apache::lonnet::queryauthenticate($ccuname,$ccdomain);
- if ($currentauth=~/^krb4:/) {
- $currentauth=~/^krb4:(.*)/;
- my $krbdefdom2=$1;
+ if ($currentauth=~/^krb(4|5):/) {
+ $currentauth=~/^krb(4|5):(.*)/;
+ my $krbdefdom=$2;
my %param = ( formname => 'document.cu',
kerb_def_dom => $krbdefdom
);
$loginscript = &Apache::loncommon::authform_header(%param);
}
# Check for a bad authentication type
- unless ($currentauth=~/^krb4:/ or
+ unless ($currentauth=~/^krb(4|5):/ or
$currentauth=~/^unix:/ or
$currentauth=~/^internal:/ or
$currentauth=~/^localauth:/
) { # bad authentication scheme
- if (&Apache::lonnet::allowed('mau',$ENV{'user.domain'})) {
+ if (&Apache::lonnet::allowed('mau',$ccdomain)) {
+ &initialize_authen_forms();
+ my %lt=&Apache::lonlocal::texthash(
+ 'err' => "ERROR",
+ 'uuas' => "This user has an unrecognized authentication scheme",
+ 'sldb' => "Please specify login data below",
+ 'ld' => "Login Data"
+ );
$r->print(<
-ERROR:
-This user has an unrecognized authentication scheme ($currentauth).
-Please specify login data below.
-
@@ -344,23 +822,25 @@ Please specify login data below.
$authformloc
ENDBADAUTH
} else {
- # This user is not allowed to modify the users
+ # This user is not allowed to modify the user's
# authentication scheme, so just notify them of the problem
+ my %lt=&Apache::lonlocal::texthash(
+ 'err' => "ERROR",
+ 'uuas' => "This user has an unrecognized authentication scheme",
+ 'adcs' => "Please alert a domain coordinator of this situation"
+ );
$r->print(<
-
- ERROR:
-This user has an unrecognized authentication scheme ($currentauth).
-Please alert a domain coordinator of this situation.
+ $lt{'err'}:
+$lt{'uuas'} ($currentauth). $lt{'adcs'}.
ENDBADAUTH
}
} else { # Authentication type is valid
my $authformcurrent='';
my $authform_other='';
- if ($currentauth=~/^krb4:/) {
+ &initialize_authen_forms();
+ if ($currentauth=~/^krb(4|5):/) {
$authformcurrent=$authformkrb;
$authform_other="
Changing this value will overwrite existing authentication for the user; you should notify the user of this change.
-
-ENDCURRENTAUTH
- if (&Apache::lonnet::allowed('mau',$ENV{'user.domain'})) {
+ $authformcurrent.=' (will override current values) ';
+ if (&Apache::lonnet::allowed('mau',$ccdomain)) {
# Current user has login modification privileges
+ my %lt=&Apache::lonlocal::texthash(
+ 'ccld' => "Change Current Login Data",
+ 'enld' => "Enter New Login Data"
+ );
$r->print(<
-
Change Current Login Data
+
$lt{'ccld'}
$generalrule
$authformnop
$authformcurrent
-
Enter New Login Data
+
$lt{'enld'}
$authform_other
ENDOTHERAUTHS
+ } else {
+ if (&Apache::lonnet::allowed('mau',$env{'request.role.domain'})) {
+ my %lt=&Apache::lonlocal::texthash(
+ 'ccld' => "Change Current Login Data",
+ 'yodo' => "You do not have privileges to modify the authentication configuration for this user.",
+ 'ifch' => "If a change is required, contact a domain coordinator for the domain",
+ );
+ $r->print(<
+
$lt{'ccld'}
+$lt{'yodo'} $lt{'ifch'}: $ccdomain
+ENDNOPRIV
+ }
+ }
+ if (&Apache::lonnet::allowed('mpq',$env{'request.role.domain'})) {
+ # Current user has quota modification privileges
+ $r->print(&portfolio_quota($ccuname,$ccdomain));
}
} ## End of "check for bad authentication type" logic
} ## End of new user/old user logic
- $r->print('
Add Roles
');
+ $r->print('
'.&mt('Add Roles').'
');
#
# Co-Author
#
-
- if (&Apache::lonnet::allowed('cca',$ENV{'user.domain'})) {
- my $cuname=$ENV{'user.name'};
- my $cudom=$ENV{'user.domain'};
- $r->print(<Construction Space
-
Activate
Role
Extent
-
Start
End
-
-
-
Co-Author
-
$cudom\_$cuname
-
+ if (&authorpriv($env{'user.name'},$env{'request.role.domain'}) &&
+ ($env{'user.name'} ne $ccuname || $env{'user.domain'} ne $ccdomain)) {
+ # No sense in assigning co-author role to yourself
+ my $cuname=$env{'user.name'};
+ my $cudom=$env{'request.role.domain'};
+ my %lt=&Apache::lonlocal::texthash(
+ 'cs' => "Construction Space",
+ 'act' => "Activate",
+ 'rol' => "Role",
+ 'ext' => "Extent",
+ 'sta' => "Start",
+ 'end' => "End",
+ 'cau' => "Co-Author",
+ 'caa' => "Assistant Co-Author",
+ 'ssd' => "Set Start Date",
+ 'sed' => "Set End Date"
+ );
+ $r->print('
+"javascript:pjump('."'date_end','End Date Co-Author',document.cu.end_$cudom\_$cuname\_ca.value,'end_$cudom\_$cuname\_ca','cu.pres','dateset'".')">'.$lt{'sed'}.'
+"javascript:pjump('."'date_start','Start Date $plrole',document.cu.start_$thisdomain\_$role.value,'start_$thisdomain\_$role','cu.pres','dateset'".')">'.$lt{'ssd'}.'