[BACK]Return to lonauth.pm CVS log [TXT] [DIR] Up to [LON-CAPA] / loncom / auth

Diff for /loncom/auth/lonauth.pm between versions 1.21 and 1.96

version 1.21, 2001/07/28 15:57:48 version 1.96, 2008/10/02 13:37:52
Line 1 Line 1
 # The LearningOnline Network  # The LearningOnline Network
 # User Authentication Module  # User Authentication Module
 # 5/21/99,5/22,5/25,5/26,5/27,5/29,6/2,6/11,6/14,6/15  #
 # 16/11,12/16,  # $Id$
 # 1/14,2/24,2/28,2/29,3/7,5/29,5/30,5/31,6/1,6/5,6/29,  #
 # 7/1,7/10,10/2,10/5,10/9,10/26,10/30,11/10,  # Copyright Michigan State University Board of Trustees
 # 05/28,05/29 Gerd Kortemeyer  #
 # 07/24 Scott Harrison  # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
 # 07/28 Gerd Kortemeyer  #
   # LON-CAPA is free software; you can redistribute it and/or modify
   # it under the terms of the GNU General Public License as published by
   # the Free Software Foundation; either version 2 of the License, or
   # (at your option) any later version.
   #
   # LON-CAPA is distributed in the hope that it will be useful,
   # but WITHOUT ANY WARRANTY; without even the implied warranty of
   # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   # GNU General Public License for more details.
   #
   # You should have received a copy of the GNU General Public License
   # along with LON-CAPA; if not, write to the Free Software
   # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
   #
   # /home/httpd/html/adm/gpl.txt
   #
   # http://www.lon-capa.org/
   #
   
 package Apache::lonauth;  package Apache::lonauth;
   
 use strict;  use strict;
   use LONCAPA;
 use Apache::Constants qw(:common);  use Apache::Constants qw(:common);
 use Apache::File;  
 use CGI qw(:standard);  use CGI qw(:standard);
 use CGI::Cookie();  use DynaLoader; # for Crypt::DES version
 use Crypt::DES;  use Crypt::DES;
 use Apache::lonnet();  use Apache::loncommon();
   use Apache::lonnet;
 use Apache::lonmenu();  use Apache::lonmenu();
   use Apache::createaccount;
 use Fcntl qw(:flock);  use Fcntl qw(:flock);
   use Apache::lonlocal;
    
 # ------------------------------------------------------------ Successful login  # ------------------------------------------------------------ Successful login
   
 sub success {  sub success {
     my ($r, $username, $domain, $authhost,$lowerurl) = @_;      my ($r, $username, $domain, $authhost, $lowerurl, $extra_env,
     my $lonids=$r->dir_config('lonIDsDir');   $form) = @_;
   
 # See if old ID present, if so, remove  # ------------------------------------------------------------ Get cookie ready
       my $cookie =
    &Apache::loncommon::init_user_environment($r, $username, $domain,
     $authhost, $form,
     {'extra_env' => $extra_env,});
   
       my $public=($username eq 'public' && $domain eq 'public');
   
       if ($public or $lowerurl eq 'noredirect') { return $cookie; }
   
     my $filename;  
     opendir(DIR,$lonids);  
     while ($filename=readdir(DIR)) {  
        if ($filename=~/^$username\_\d+\_$domain\_$authhost\.id$/) {  
   unlink($lonids.'/'.$filename);  
        }  
     }  
     closedir(DIR);  
   
 # Give them a new cookie  
   
     my $cookie;  
     my $now=time;  
     $cookie="$username\_$now\_$domain\_$authhost";  
   
 # Initialize roles  
   
     my $userroles=Apache::lonnet::rolesinit($domain,$username,$authhost);  
   
 # ------------------------------------ Check browser type and MathML capability  
   
     my @browsertype=split(/\&/,$r->dir_config("lonBrowsDet"));  
     my %mathcap=split(/\&/,$r->dir_config("lonMathML"));  
     my $httpbrowser=$ENV{"HTTP_USER_AGENT"};  
     my $i;  
     my $clientbrowser='unknown';  
     my $clientversion='0';  
     my $clientmathml='';  
     for ($i=0;$i<=$#browsertype;$i++) {  
         my ($bname,$match,$notmatch,$vreg,$minv)=split(/\:/,$browsertype[$i]);  
  if (($httpbrowser=~/$match/i)  && ($httpbrowser!~/$notmatch/i)) {  
     $clientbrowser=$bname;  
             $httpbrowser=~/$vreg/i;  
     $clientversion=$1;  
             $clientmathml=($clientversion>=$minv);  
         }  
     }  
     my $clientos='unknown';  
     if (($httpbrowser=~/linux/i) ||  
         ($httpbrowser=~/unix/i) ||  
         ($httpbrowser=~/ux/i) ||  
         ($httpbrowser=~/solaris/i)) { $clientos='unix'; }  
     if (($httpbrowser=~/vax/i) ||  
         ($httpbrowser=~/vms/i)) { $clientos='vms'; }  
     if ($httpbrowser=~/next/i) { $clientos='next'; }  
     if (($httpbrowser=~/mac/i) ||  
         ($httpbrowser=~/powerpc/i)) { $clientos='mac'; }  
     if ($httpbrowser=~/win/i) { $clientos='win'; }  
   
 # ------------------------------------------------------------- Get environment  
   
     my $userenv=Apache::lonnet::reply("dump:$domain:$username:environment",  
                                       $authhost);  
     if (($userenv eq 'con_lost') ||   
         ($userenv =~ /^error\:/)) {  
         $userenv='';  
     }  
     $userenv=~s/\&/\nenvironment\./g;  
     if ($userenv ne '') {  
  $userenv='environment.'.$userenv;  
     }  
 # --------------------------------------------------------- Write first profile  
   
        {  
     my $idf=Apache::File->new(">$lonids/$cookie.id");  
     unless (flock($idf,LOCK_EX)) {  
       &Apache::lonnet::logthis("<font color=blue>WARNING: ".  
     'Could not obtain exclusive lock in lonauth: '.$!);  
       $idf->close();  
       return 'error: '.$!;  
     }  
             if ($userenv ne '') { print $idf "$userenv\n"; }  
             print $idf "user.name=$username\n";  
             print $idf "user.domain=$domain\n";  
             print $idf "user.home=$authhost\n";  
             print $idf "browser.type=$clientbrowser\n";  
             print $idf "browser.version=$clientversion\n";  
             print $idf "browser.mathml=$clientmathml\n";  
             print $idf "browser.os=$clientos\n";  
             print $idf "request.course.fn=\n";  
             print $idf "request.course.uri=\n";  
             print $idf "request.course.sec=\n";  
             print $idf "request.role=cm\n";  
             print $idf "request.host=$ENV{'HTTP_HOST'}\n";   
             if ($userroles ne '') { print $idf "$userroles"; }  
     $idf->close();  
         }  
          $ENV{'request.role'}='cm';  
 # -------------------------------------------------------------------- Log this  # -------------------------------------------------------------------- Log this
   
     &Apache::lonnet::log($domain,$username,$authhost,      &Apache::lonnet::log($domain,$username,$authhost,
Line 124  sub success { Line 65  sub success {
   
     my @what=&Apache::lonnet::dump('critical',$domain,$username);      my @what=&Apache::lonnet::dump('critical',$domain,$username);
     if ($what[0]) {      if ($what[0]) {
  if ($what[0] ne 'con_lost') {   if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) {
     $lowerurl='/adm/email?critical=display';      $lowerurl='/adm/email?critical=display';
         }          }
     }      }
   
 # ------------------------------------------------------------ Get cookie ready  # ------------------------------------------------------------ Get cookie ready
   
     $cookie="lonID=$cookie; path=/";      $cookie="lonID=$cookie; path=/";
 # -------------------------------------------------------- Menu script and info  # -------------------------------------------------------- Menu script and info
     my $windowinfo=&Apache::lonmenu::open();      my $windowinfo=&Apache::lonmenu::open($env{'browser.os'});
 # ------------------------------------------------------------- Info for Remote      my $startupremote=&Apache::lonmenu::startupremote($lowerurl);
     my $configmenu=&Apache::lonmenu::rawconfig();      my $remoteinfo=&Apache::lonmenu::load_remote_msg($lowerurl);
       my $setflags=&Apache::lonmenu::setflags();
       my $maincall=&Apache::lonmenu::maincall();
       my $start_page=&Apache::loncommon::start_page('Successful Login',
     $startupremote,
     {'no_inline_link' => 1,});
       my $end_page  =&Apache::loncommon::end_page();
   
       my $continuelink;
       if (($env{'browser.interface'} eq 'textual') ||
           ($env{'environment.remote'} eq 'off')) {
    $continuelink="<a href=\"$lowerurl\">".&mt('Continue')."</a>";
       }
 # ------------------------------------------------- Output for successful login  # ------------------------------------------------- Output for successful login
   
     $r->send_cgi_header(<<ENDHEADER);      &Apache::loncommon::content_type($r,'text/html');
 Content-type: text/html      $r->header_out('Set-cookie' => $cookie);
 Set-cookie: $cookie      $r->send_http_header;
   
 ENDHEADER      my %lt=&Apache::lonlocal::texthash(
          'wel' => 'Welcome',
          'mes' => 'Welcome to the Learning<i>Online</i> Network with CAPA. Please wait while your session is being set up.',
          'pro' => 'Login problems?',
          'log' => 'loginproblems.html',
          );
     $r->print(<<ENDSUCCESS);      $r->print(<<ENDSUCCESS);
 <html>  $start_page
 <head>  $setflags
 <title>Successful Login to the LearningOnline Network with CAPA</title>  
 <script>  
   
 // --------------------------------------------- Checks if server frame defined  
   
 function checkdef() {  
    if ((menuloaded==0) && (tim==0)) { setTimeout('checkdef()',100); }  
 }  
   
 // ---------------------------------------------------------- The wait function  
   
 function wait() {  
    if ((menuloaded==1) || (tim==1)) {  
       if (tim==0) {  
          clearTimeout(canceltim);  
          $configmenu  
          window.location='$lowerurl';    
       } else {  
          alert("Remote Control Timed Out.");  
       }  
    } else {  
       setTimeout('wait();',100);  
    }  
 }  
   
 function main() {  
    canceltim=setTimeout('tim=1;',20000);  
    checkdef();  
    wait();  
 }  
   
 </script>  
 </head>  
 <body bgcolor="#FFFFFF">  
 <script>  
     menuloaded=0;  
     tim=0;  
 </script>  
 $windowinfo  $windowinfo
 <h1>Welcome!</h1>  <h1>$lt{'wel'}</h1>
 <script>  $lt{'mes'}<p>
     main();  <a href="/adm/$lt{'log'}">$lt{'pro'}</a></p>
 </script>  $remoteinfo
 </body>  $maincall
 </html>  $continuelink
   $end_page
 ENDSUCCESS  ENDSUCCESS
 }  }
   
 # --------------------------------------------------------------- Failed login!  # --------------------------------------------------------------- Failed login!
   
 sub failed {  sub failed {
     my ($r,$message) = @_;      my ($r,$message,$form) = @_;
     $r->send_cgi_header(<<ENDFHEADER);      my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef,
 Content-type: text/html      {'no_inline_link' => 1,});
       my $end_page   = &Apache::loncommon::end_page();
 ENDFHEADER      &Apache::loncommon::content_type($r,'text/html');
     $r->print(<<ENDFAILED);      $r->send_http_header;
 <html>      $r->print(
 <head>         $start_page
 <title>Unsuccessful Login to the LearningOnline Network with CAPA</title>        .'<h1>'.&mt('Sorry ...').'</h1>'
 </head>        .'<p class="LC_warning">'.&mt($message).'</p>'
 <html>        .'<p>'.&mt('Please [_1]log in again[_2].'
 <body bgcolor="#FFFFFF">                  ,"<a href=\"/adm/login?username=$form->{'uname'}&domain=$form->{'udom'}\">",'</a>')
 <h1>Sorry ...</h1>        .'</p>'
 <h2>$message to use the Learning<i>Online</i> Network with CAPA</h2>        .'<p><a href="/adm/loginproblems.html">'.&mt('Login problems?').'</a></p>'
 </body>        .$end_page
 </html>      );
 ENDFAILED   }
   
   # ------------------------------------------------------------------ Rerouting!
   
   sub reroute {
       my ($r) = @_;
       &Apache::loncommon::content_type($r,'text/html');
       $r->send_http_header;
       my $msg='<h1>'.&mt('Sorry ...').'</h1>'
              .&mt('Please [_1]log in again[_2].');
       &Apache::loncommon::simple_error_page($r,'Rerouting',$msg);
 }  }
   
 # ---------------------------------------------------------------- Main handler  # ---------------------------------------------------------------- Main handler
   
 sub handler {  sub handler {
     my $r = shift;      my $r = shift;
       my $form;
   # Are we re-routing?
       if (-e '/home/httpd/html/lon-status/reroute.txt') {
    &reroute($r);
    return OK;
       }
   
       &Apache::lonlocal::get_language_handle($r);
   
   # -------------------------------- Prevent users from attempting to login twice
       my $handle = &Apache::lonnet::check_for_valid_session($r);
       if ($handle ne '') {
   # Indeed, a valid token is found
    &Apache::loncommon::content_type($r,'text/html');
    $r->send_http_header;
    my $start_page = 
       &Apache::loncommon::start_page('Already logged in');
    my $end_page = 
       &Apache::loncommon::end_page();
           $r->print(
              $start_page
             .'<h1>'.&mt('You are already logged in!').'</h1>'
             .'<p>'.&mt('Please either [_1]continue the current session[_2] or [_3]logout[_4].'
                       ,'<a href="/adm/roles">','</a>','<a href="/adm/logout">','</a>')
             .'</p>'
             .'<p><a href="/adm/loginproblems.html">'.&mt('Login problems?').'</a></p>'
             .$end_page
           );
           return OK;
       }
   
   # ---------------------------------------------------- No valid token, continue
   
   
     my $buffer;      my $buffer;
     $r->read($buffer,$r->header_in('Content-length'));      if ($r->header_in('Content-length') > 0) {
     my @pairs=split(/&/,$buffer);   $r->read($buffer,$r->header_in('Content-length'),0);
     my $pair; my $name; my $value; my %FORM;      }
     foreach $pair (@pairs) {      my %form;
        ($name,$value) = split(/=/,$pair);      foreach my $pair (split(/&/,$buffer)) {
          my ($name,$value) = split(/=/,$pair);
        $value =~ tr/+/ /;         $value =~ tr/+/ /;
        $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;         $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
        $FORM{$name}=$value;         $form{$name}=$value;
     }       } 
   
     if ((!$FORM{'uname'}) || (!$FORM{'upass'}) || (!$FORM{'udom'})) {      if ((!$form{'uname'}) || (!$form{'upass0'}) || (!$form{'udom'})) {
  failed($r,'Username, password and domain need to be specified');   &failed($r,'Username, password and domain need to be specified.',
    \%form);
         return OK;          return OK;
     }      }
     $FORM{'uname'} =~ s/\W//g;  
     $FORM{'udom'}  =~ s/\W//g;  # split user logging in and "su"-user
   
       ($form{'uname'},$form{'suname'})=split(/\:/,$form{'uname'});
       $form{'uname'} = &LONCAPA::clean_username($form{'uname'});
       $form{'suname'}= &LONCAPA::clean_username($form{'suname'});
       $form{'udom'}  = &LONCAPA::clean_domain(  $form{'udom'});
   
     my $role   = $r->dir_config('lonRole');      my $role   = $r->dir_config('lonRole');
     my $domain = $r->dir_config('lonDefDomain');      my $domain = $r->dir_config('lonDefDomain');
     my $prodir = $r->dir_config('lonUsersDir');      my $prodir = $r->dir_config('lonUsersDir');
       my $contact_name = &mt('LON-CAPA helpdesk');
   
 # ---------------------------------------- Get the information from login token  # ---------------------------------------- Get the information from login token
   
     my $tmpinfo=Apache::lonnet::reply('tmpget:'.$FORM{'logtoken'},      my $tmpinfo=Apache::lonnet::reply('tmpget:'.$form{'logtoken'},
                                       $FORM{'serverid'});                                        $form{'serverid'});
   
     if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) {      if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) {
  failed($r,'Login token missing, inaccessible or expired');   &failed($r,'Information needed to verify your login information is missing, inaccessible or expired.',\%form);
           return OK;
       } else {
    my $reply = &Apache::lonnet::reply('tmpdel:'.$form{'logtoken'},
      $form{'serverid'});
           if ( $reply ne 'ok' ) {
               &failed($r,'Session could not be opened.',\%form);
       &Apache::lonnet::logthis("ERROR got a reply of $reply when trying to contact ". $form{'serverid'}." to get login token");
       return OK;
    }
       }
       if (!&Apache::lonnet::domain($form{'udom'})) {
           &failed($r,'The domain you provided is not a valid LON-CAPA domain.',\%form);
         return OK;          return OK;
     }      }
       
     my ($key,$firsturl)=split(/&/,$tmpinfo);      my ($key,$firsturl)=split(/&/,$tmpinfo);
   
     my $keybin=pack("H16",$key);      my $keybin=pack("H16",$key);
   
     my $cipher=new DES $keybin;      my $cipher;
       if ($Crypt::DES::VERSION>=2.03) {
     my $upass=$cipher->decrypt(   $cipher=new Crypt::DES $keybin;
        unpack("a8",pack("H16",substr($FORM{'upass'},0,16))));      }
       else {
    $cipher=new DES $keybin;
       }
       my $upass='';
       for (my $i=0;$i<=2;$i++) {
    my $chunk=
       $cipher->decrypt(unpack("a8",pack("H16",substr($form{'upass'.$i},0,16))));
   
     $upass.=$cipher->decrypt(   $chunk.=
        unpack("a8",pack("H16",substr($FORM{'upass'},16,16))));      $cipher->decrypt(unpack("a8",pack("H16",substr($form{'upass'.$i},16,16))));
   
     $upass=substr($upass,1,ord(substr($upass,0,1)));   $chunk=substr($chunk,1,ord(substr($chunk,0,1)));
    $upass.=$chunk;
       }
   
 # ---------------------------------------------------------------- Authenticate  # ---------------------------------------------------------------- Authenticate
     my $authhost=Apache::lonnet::authenticate($FORM{'uname'},      my @cancreate;
                                               $upass,      my %domconfig = &Apache::lonnet::get_dom('configuration',['usercreation'],$form{'udom'});
                                               $FORM{'udom'});      if (ref($domconfig{'usercreation'}) eq 'HASH') {
           if (ref($domconfig{'usercreation'}{'cancreate'}) eq 'HASH') {
               if (ref($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}) eq 'ARRAY') {
                   @cancreate = @{$domconfig{'usercreation'}{'cancreate'}{'selfcreate'}};
               } elsif (($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne 'none') && 
                        ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne '')) {
                   @cancreate = ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'});
               }
           }
       }
       my $defaultauth;
       if (grep(/^login$/,@cancreate)) {
           $defaultauth = 1;
       }
       my $authhost=Apache::lonnet::authenticate($form{'uname'},$upass,
                                                 $form{'udom'},$defaultauth);
           
 # --------------------------------------------------------------------- Failed?  # --------------------------------------------------------------------- Failed?
   
     if ($authhost eq 'no_host') {      if ($authhost eq 'no_host') {
  failed($r,'Username and/or password could not be authenticated');   &failed($r,'Username and/or password could not be authenticated.',
    \%form);
         return OK;          return OK;
       } elsif ($authhost eq 'no_account_on_host') {
           my %domconfig = 
               &Apache::lonnet::get_dom('configuration',['usercreation'],$form{'udom'});
           if (grep(/^login$/,@cancreate)) {
               my $start_page = 
                   &Apache::loncommon::start_page('Create a user account in LON-CAPA',
                                                  '',{'no_inline_link'   => 1,});
               my $domdesc = &Apache::lonnet::domain($form{'udom'},'description');
               my $lonhost = $r->dir_config('lonHostID');
               my $origmail = $Apache::lonnet::perlvar{'lonSupportEMail'};
               my $contacts = 
                   &Apache::loncommon::build_recipient_list(undef,'helpdeskmail',
                                                           $form{'udom'},$origmail);
               my ($contact_email) = split(',',$contacts); 
               my $output = &Apache::createaccount::username_check($form{'uname'}, 
                                                                   $form{'udom'},$domdesc,'',
                                                                   $lonhost,$contact_email,$contact_name);
               &Apache::loncommon::content_type($r,'text/html');
               $r->send_http_header;
               &Apache::createaccount::print_header($r,$start_page);
               $r->print('<h3>'.&mt('Account creation').'</h3>'.
                         &mt('Although your username and password were authenticated, you do not currently have a LON-CAPA account at this institution.').'<br />'.
                         $output.&Apache::loncommon::end_page());
               return OK;
           } else {
               &failed($r,'Although your username and password were authenticated, you do not currently have a LON-CAPA account in this domain, and you are not permitted to create one.',\%form);
               return OK;
           }
     }      }
   
     if (($firsturl eq '') || ($firsturl eq '/adm/logout')) {      if (($firsturl eq '') || 
  $firsturl='/res/adm/pages/index.html';   ($firsturl=~/^\/adm\/(logout|remote)/)) {
    $firsturl='/adm/roles';
       }
   # --------------------------------- Are we attempting to login as somebody else?
       if ($form{'suname'}) {
   # ------------ see if the original user has enough privileges to pull this stunt
    if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'})) {
   # ---------------------------------------------------- see if the su-user exists
       unless (&Apache::lonnet::homeserver($form{'suname'},$form{'udom'})
    eq 'no_host') {
    &Apache::lonnet::logthis(&Apache::lonnet::homeserver($form{'suname'},$form{'udom'}));
   # ------------------------------ see if the su-user is not too highly privileged
    unless (&Apache::lonnet::privileged($form{'suname'},$form{'udom'})) {
   # -------------------------------------------------------- actually switch users
       &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.$form{'udom'}.
    ' logging in as '.$form{'suname'});
       $form{'uname'}=$form{'suname'};
    } else {
       &Apache::lonnet::logthis('Attempted switch user to privileged user');
    }
       }
    } else {
       &Apache::lonnet::logthis('Non-privileged user attempting switch user');
    }
     }      }
   
     success($r,$FORM{'uname'},$FORM{'udom'},$authhost,$firsturl);      if ($r->dir_config("lonBalancer") eq 'yes') {
    &success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect',undef,
    \%form);
    $r->internal_redirect('/adm/switchserver');
       } else {
    &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef,
    \%form);
       }
     return OK;      return OK;
 }  }
   
Removed from v.1.21  
changed lines
  Added in v.1.96

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
500 Internal Server Error

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator at root@localhost to inform them of the time this error occurred, and the actions you performed just before this error.

More information about this error may be available in the server error log.