--- loncom/auth/lonauth.pm	2005/07/05 21:30:14	1.68
+++ loncom/auth/lonauth.pm	2009/07/03 10:22:00	1.99
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.68 2005/07/05 21:30:14 albertel Exp $
+# $Id: lonauth.pm,v 1.99 2009/07/03 10:22:00 bisitz Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -29,136 +29,33 @@
 package Apache::lonauth;
 
 use strict;
+use LONCAPA;
 use Apache::Constants qw(:common);
-use Apache::File;
 use CGI qw(:standard);
-use CGI::Cookie();
 use DynaLoader; # for Crypt::DES version
 use Crypt::DES;
 use Apache::loncommon();
 use Apache::lonnet;
 use Apache::lonmenu();
+use Apache::createaccount;
 use Fcntl qw(:flock);
 use Apache::lonlocal;
-
-my %FORM;
-
+ 
 # ------------------------------------------------------------ Successful login
-
 sub success {
-    my ($r, $username, $domain, $authhost,$lowerurl) = @_;
-    my $lonids=$r->dir_config('lonIDsDir');
-
-# See if old ID present, if so, remove
-
-    my $filename;
-    opendir(DIR,$lonids);
-    while ($filename=readdir(DIR)) {
-       if ($filename=~/^$username\_\d+\_$domain\_$authhost\.id$/) {
-	  unlink($lonids.'/'.$filename);
-       }
-    }
-    closedir(DIR);
+    my ($r, $username, $domain, $authhost, $lowerurl, $extra_env,
+	$form) = @_;
 
-# Give them a new cookie
-
-    my $cookie;
-    my $now=time;
-    $cookie="$username\_$now\_$domain\_$authhost";
-
-# Initialize roles
-
-    my $userroles=Apache::lonnet::rolesinit($domain,$username,$authhost);
-
-# ------------------------------------ Check browser type and MathML capability
-
-    my ($httpbrowser,$clientbrowser,$clientversion,$clientmathml,
-        $clientunicode,$clientos) = &Apache::loncommon::decode_user_agent($r);
+# ------------------------------------------------------------ Get cookie ready
+    my $cookie =
+	&Apache::loncommon::init_user_environment($r, $username, $domain,
+						  $authhost, $form,
+						  {'extra_env' => $extra_env,});
 
-# -------------------------------------- Any accessibility options to remember?
-    if (($FORM{'interface'}) && ($FORM{'remember'} eq 'true')) {
-	foreach ('imagesuppress','appletsuppress',
-		 'embedsuppress','fontenhance','blackwhite') {
-	    if ($FORM{$_} eq 'true') {
-		&Apache::lonnet::put('environment',{$_ => 'on'},
-				     $domain,$username);
-	    } else {
-		&Apache::lonnet::del('environment',[$_],$domain,$username);
-	    }
-	}
-    }
-# ------------------------------------------------------------- Get environment
+    my $public=($username eq 'public' && $domain eq 'public');
 
-    my $userenv;
-    my %userenv=Apache::lonnet::dump('environment',$domain,$username);
-    my ($tmp) = keys(%userenv);
-    if ($tmp !~ /^(con_lost|error|no_such_host)/i) {
-	foreach my $key (keys(%userenv)) {
-	    $userenv.="environment.$key=$userenv{$key}\n";
-	}
-    }
-    if (($userenv{'interface'}) && (!$FORM{'interface'})) {
-	$FORM{'interface'}=$userenv{'interface'};
-    }
-    $env{'environment.remote'}=$userenv{'remote'};
-    if ($userenv{'texengine'} eq 'ttm') { $clientmathml=1; }
+    if ($public or $lowerurl eq 'noredirect') { return $cookie; }
 
-# --------------- Do not trust query string to be put directly into environment
-    foreach ('imagesuppress','appletsuppress',
-	     'embedsuppress','fontenhance','blackwhite',
-	     'interface','localpath','localres') {
-	$FORM{$_}=~s/[\n\r\=]//gs;
-    }
-# --------------------------------------------------------- Write first profile
-
-    {
-	my $idf=Apache::File->new(">$lonids/$cookie.id");
-	unless (flock($idf,LOCK_EX)) {
-	    &Apache::lonnet::logthis("<font color=blue>WARNING: ".
-			   'Could not obtain exclusive lock in lonauth: '.$!);
-	    $idf->close();
-	    return 'error: '.$!;
-	}
-	if ($userenv ne '') { print $idf "$userenv\n"; }
-	print $idf "user.name=$username\n";
-	print $idf "user.domain=$domain\n";
-	print $idf "user.home=$authhost\n";
-	print $idf "browser.type=$clientbrowser\n";
-	print $idf "browser.version=$clientversion\n";
-	print $idf "browser.mathml=$clientmathml\n";
-	print $idf "browser.unicode=$clientunicode\n";
-	print $idf "browser.os=$clientos\n";
-        if ($FORM{'localpath'}) {
-           print $idf "browser.localpath=$FORM{'localpath'}\n";
-           print $idf "browser.localres=$FORM{'localres'}\n";
-        }
-	print $idf "request.course.fn=\n";
-	print $idf "request.course.uri=\n";
-	print $idf "request.course.sec=\n";
-	print $idf "request.role=cm\n";
-        print $idf "request.role.adv=$env{'user.adv'}\n";
-	print $idf "request.host=$ENV{'REMOTE_ADDR'}\n";
-	if ($username eq 'public' && $domain eq 'public') { 
-	    print $idf "environment.remote=off\n";
-	}
-	if ($FORM{'interface'}) {
-	    $FORM{'interface'}=~s/\W//gs;
-	    print $idf "browser.interface=$FORM{'interface'}\n";
-	    $env{'browser.interface'}=$FORM{'interface'};
-	    foreach ('imagesuppress','appletsuppress',
-		     'embedsuppress','fontenhance','blackwhite') {
-		if (($FORM{$_} eq 'true') ||
-		    ($userenv{$_} eq 'on')) {
-		    print $idf "browser.$_=on\n";
-		}
-	    }
-	}
-	if ($userroles ne '') { print $idf "$userroles"; }
-	$idf->close();
-    }
-    $env{'request.role'}='cm';
-    $env{'request.role.adv'}=$env{'user.adv'};
-    $env{'browser.type'}=$clientbrowser;
 # -------------------------------------------------------------------- Log this
 
     &Apache::lonnet::log($domain,$username,$authhost,
@@ -174,121 +71,88 @@ sub success {
     }
 
 # ------------------------------------------------------------ Get cookie ready
-
-    if ($username eq 'public' && $domain eq 'public') {
-	return $cookie;
-    }
     $cookie="lonID=$cookie; path=/";
 # -------------------------------------------------------- Menu script and info
-    my $windowinfo=&Apache::lonmenu::open($clientos);
+    my $windowinfo=&Apache::lonmenu::open($env{'browser.os'});
     my $startupremote=&Apache::lonmenu::startupremote($lowerurl);
     my $remoteinfo=&Apache::lonmenu::load_remote_msg($lowerurl);
     my $setflags=&Apache::lonmenu::setflags();
     my $maincall=&Apache::lonmenu::maincall();
-    my $bodytag=&Apache::loncommon::bodytag('Successful Login');
-    my $add=&addcontent();
+    my $brcrum = [{'href' => '',
+                   'text' => 'Successful Login'},];
+    my $start_page=&Apache::loncommon::start_page('Successful Login',
+                                                  $startupremote,
+                                                  {'no_inline_link' => 1,
+                                                   'bread_crumbs' => $brcrum,});
+    my $end_page  =&Apache::loncommon::end_page();
+
     my $continuelink;
-    if (($env{'browser.interface'} eq 'textual') ||
-        ($env{'environment.remote'} eq 'off')) {
+    if ($env{'environment.remote'} eq 'off') {
 	$continuelink="<a href=\"$lowerurl\">".&mt('Continue')."</a>";
     }
 # ------------------------------------------------- Output for successful login
 
-    $r->send_cgi_header(<<ENDHEADER);
-Content-type: text/html$add
-Set-cookie: $cookie
+    &Apache::loncommon::content_type($r,'text/html');
+    $r->header_out('Set-cookie' => $cookie);
+    $r->send_http_header;
 
-ENDHEADER
     my %lt=&Apache::lonlocal::texthash(
 				       'wel' => 'Welcome',
-				       'mes' => 'Welcome to the Learning<i>Online</i> Network with CAPA. Please wait while your session is being set up',
-				       'pro' => 'Problems',
+				       'mes' => 'Welcome to the Learning<i>Online</i> Network with CAPA. Please wait while your session is being set up.',
+				       'pro' => 'Login problems?',
 				       'log' => 'loginproblems.html',
 				       );
     $r->print(<<ENDSUCCESS);
-<html>
-<head>
-<title>Successful Login to the LearningOnline Network with CAPA</title>
-$startupremote
-</head>
-$bodytag
+$start_page
 $setflags
 $windowinfo
 <h1>$lt{'wel'}</h1>
-$lt{'mes'}.<p>
-<a href="/adm/$lt{'log'}">$lt{'pro'}?</a></p>
+$lt{'mes'}<p>
+<a href="/adm/$lt{'log'}">$lt{'pro'}</a></p>
 $remoteinfo
 $maincall
 $continuelink
-</body>
-</html>
+$end_page
 ENDSUCCESS
 }
 
 # --------------------------------------------------------------- Failed login!
 
 sub failed {
-    my ($r,$message) = @_;
-    my $bodytag=&Apache::loncommon::bodytag('Unsuccessful Login');
-    my $add=&addcontent();
-    $r->send_cgi_header(<<ENDFHEADER);
-Content-type: text/html$add
-
-ENDFHEADER
-    $r->print(<<ENDFAILED);
-<html>
-<head>
-<title>Unsuccessful Login to the LearningOnline Network with CAPA</title>
-</head>
-$bodytag
-<h1>Sorry ...</h1>
-<p><b>$message</b></p>
-<p>Please <a href="/adm/login?username=$FORM{'uname'}&domain=$FORM{'udom'}">log in again</a>.</p>
-<p>
-<a href="/adm/loginproblems.html">Problems?</a></p>
-</body>
-</html>
-ENDFAILED
-}
-
-# --------------------------------------------------------------------- Charset
-
-sub addcontent {
-    my $encoding=&Apache::lonlocal::current_encoding;
-    if ($encoding) {
-	return '; charset='.$encoding;
-    } else {
-	return '';
-    }
-}
+    my ($r,$message,$form) = @_;
+    my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef,
+						    {'no_inline_link' => 1,});
+    my $end_page   = &Apache::loncommon::end_page();
+    &Apache::loncommon::content_type($r,'text/html');
+    $r->send_http_header;
+    $r->print(
+       $start_page
+      .'<h1>'.&mt('Sorry ...').'</h1>'
+      .'<p class="LC_warning">'.&mt($message).'</p>'
+      .'<p>'.&mt('Please [_1]log in again[_2].'
+                ,"<a href=\"/adm/login?username=$form->{'uname'}&domain=$form->{'udom'}\">",'</a>')
+      .'</p>'
+      .'<p><a href="/adm/loginproblems.html">'.&mt('Login problems?').'</a></p>'
+      .$end_page
+    );
+ }
 
 # ------------------------------------------------------------------ Rerouting!
 
 sub reroute {
-    my $r=shift;
-    my $bodytag=&Apache::loncommon::bodytag('Rerouting');
-    $r->send_cgi_header(<<ENDRFHEADER);
-Content-type: text/html
-
-ENDRFHEADER
-    $r->print(<<ENDRFAILED);
-<html>
-<head>
-<title>Rerouting Login to the LearningOnline Network with CAPA</title>
-</head>
-$bodytag
-<h1>Sorry ...</h1>
-Please <a href="/">log in again</a>.
-</body>
-</html>
-ENDRFAILED
+    my ($r) = @_;
+    &Apache::loncommon::content_type($r,'text/html');
+    $r->send_http_header;
+    my $msg='<h1>'.&mt('Sorry ...').'</h1>'
+           .&mt('Please [_1]log in again[_2].');
+    &Apache::loncommon::simple_error_page($r,'Rerouting',$msg);
 }
 
 # ---------------------------------------------------------------- Main handler
 
 sub handler {
     my $r = shift;
-
+    my $form;
 # Are we re-routing?
     if (-e '/home/httpd/html/lon-status/reroute.txt') {
 	&reroute($r);
@@ -298,84 +162,81 @@ sub handler {
     &Apache::lonlocal::get_language_handle($r);
 
 # -------------------------------- Prevent users from attempting to login twice
-    my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
-    my $lonid=$cookies{'lonID'};
-    my $cookie;
-    if ($lonid) {
-	my $handle=$lonid->value;
-        $handle=~s/\W//g;
-        my $lonidsdir=$r->dir_config('lonIDsDir');
-        if ((-e "$lonidsdir/$handle.id") && ($handle ne '')) {
+    my $handle = &Apache::lonnet::check_for_valid_session($r);
+    if ($handle ne '') {
 # Indeed, a valid token is found
-	    $r->send_cgi_header(<<ENDFHEADER);
-Content-type: text/html
-
-ENDFHEADER
-	    my $bodytag=&Apache::loncommon::bodytag('Already logged in');
-	    $r->print(<<ENDFAILED);
-<html>
-<head>
-<title>Already logged in</title>
-</head>
-$bodytag
-<h1>You are already logged in</h1>
-<p>Please either <a href="/adm/roles">continue the current session</a> or
-<a href="/adm/logout">logout</a>.</p>
-<p>
-<a href="/adm/loginproblems.html">Problems?</a></p>
-</body>
-</html>
-ENDFAILED
-           return OK;
-	}
+	&Apache::loncommon::content_type($r,'text/html');
+	$r->send_http_header;
+	my $start_page = 
+	    &Apache::loncommon::start_page('Already logged in');
+	my $end_page = 
+	    &Apache::loncommon::end_page();
+        $r->print(
+           $start_page
+          .'<h1>'.&mt('You are already logged in!').'</h1>'
+          .'<p>'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4].'
+                    ,'<a href="/adm/roles">','</a>','<a href="/adm/logout">','</a>')
+          .'</p>'
+          .'<p><a href="/adm/loginproblems.html">'.&mt('Login problems?').'</a></p>'
+          .$end_page
+        );
+        return OK;
     }
 
 # ---------------------------------------------------- No valid token, continue
 
 
     my $buffer;
-    $r->read($buffer,$r->header_in('Content-length'),0);
-    my @pairs=split(/&/,$buffer);
-    my $pair; my $name; my $value;
-    undef %FORM;
-    %FORM=();
-    foreach $pair (@pairs) {
-       ($name,$value) = split(/=/,$pair);
+    if ($r->header_in('Content-length') > 0) {
+	$r->read($buffer,$r->header_in('Content-length'),0);
+    }
+    my %form;
+    foreach my $pair (split(/&/,$buffer)) {
+       my ($name,$value) = split(/=/,$pair);
        $value =~ tr/+/ /;
        $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
-       $FORM{$name}=$value;
+       $form{$name}=$value;
     } 
 
-    if ((!$FORM{'uname'}) || (!$FORM{'upass0'}) || (!$FORM{'udom'})) {
-	failed($r,'Username, password and domain need to be specified.');
+    if ((!$form{'uname'}) || (!$form{'upass0'}) || (!$form{'udom'})) {
+	&failed($r,'Username, password and domain need to be specified.',
+		\%form);
         return OK;
     }
 
 # split user logging in and "su"-user
 
-    ($FORM{'uname'},$FORM{'suname'})=split(/\:/,$FORM{'uname'});
-    $FORM{'uname'} =~ s/\W//g;
-    $FORM{'suname'} =~ s/\W//g;
-    $FORM{'udom'}  =~ s/\W//g;
+    ($form{'uname'},$form{'suname'})=split(/\:/,$form{'uname'});
+    $form{'uname'} = &LONCAPA::clean_username($form{'uname'});
+    $form{'suname'}= &LONCAPA::clean_username($form{'suname'});
+    $form{'udom'}  = &LONCAPA::clean_domain(  $form{'udom'});
 
     my $role   = $r->dir_config('lonRole');
     my $domain = $r->dir_config('lonDefDomain');
     my $prodir = $r->dir_config('lonUsersDir');
+    my $contact_name = &mt('LON-CAPA helpdesk');
 
 # ---------------------------------------- Get the information from login token
 
-    my $tmpinfo=Apache::lonnet::reply('tmpget:'.$FORM{'logtoken'},
-                                      $FORM{'serverid'});
+    my $tmpinfo=Apache::lonnet::reply('tmpget:'.$form{'logtoken'},
+                                      $form{'serverid'});
 
     if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) {
-	failed($r,'Information needed to verify your login information is missing, inaccessible or expired.');
+	&failed($r,'Information needed to verify your login information is missing, inaccessible or expired.',\%form);
         return OK;
     } else {
-        unless (&Apache::lonnet::reply('tmpdel:'.$FORM{'logtoken'},
-                                         $FORM{'serverid'}) eq 'ok') {
-            &failed($r,'Session could not be opened.');
+	my $reply = &Apache::lonnet::reply('tmpdel:'.$form{'logtoken'},
+					   $form{'serverid'});
+        if ( $reply ne 'ok' ) {
+            &failed($r,'Session could not be opened.',\%form);
+	    &Apache::lonnet::logthis("ERROR got a reply of $reply when trying to contact ". $form{'serverid'}." to get login token");
+	    return OK;
 	}
     }
+    if (!&Apache::lonnet::domain($form{'udom'})) {
+        &failed($r,'The domain you provided is not a valid LON-CAPA domain.',\%form);
+        return OK;
+    }
     my ($key,$firsturl)=split(/&/,$tmpinfo);
 
     my $keybin=pack("H16",$key);
@@ -390,25 +251,69 @@ ENDFAILED
     my $upass='';
     for (my $i=0;$i<=2;$i++) {
 	my $chunk=
-	    $cipher->decrypt(unpack("a8",pack("H16",substr($FORM{'upass'.$i},0,16))));
+	    $cipher->decrypt(unpack("a8",pack("H16",substr($form{'upass'.$i},0,16))));
 
 	$chunk.=
-	    $cipher->decrypt(unpack("a8",pack("H16",substr($FORM{'upass'.$i},16,16))));
+	    $cipher->decrypt(unpack("a8",pack("H16",substr($form{'upass'.$i},16,16))));
 
 	$chunk=substr($chunk,1,ord(substr($chunk,0,1)));
 	$upass.=$chunk;
     }
 
 # ---------------------------------------------------------------- Authenticate
-    my $authhost=Apache::lonnet::authenticate($FORM{'uname'},
-                                              $upass,
-                                              $FORM{'udom'});
+    my @cancreate;
+    my %domconfig = &Apache::lonnet::get_dom('configuration',['usercreation'],$form{'udom'});
+    if (ref($domconfig{'usercreation'}) eq 'HASH') {
+        if (ref($domconfig{'usercreation'}{'cancreate'}) eq 'HASH') {
+            if (ref($domconfig{'usercreation'}{'cancreate'}{'selfcreate'}) eq 'ARRAY') {
+                @cancreate = @{$domconfig{'usercreation'}{'cancreate'}{'selfcreate'}};
+            } elsif (($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne 'none') && 
+                     ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'} ne '')) {
+                @cancreate = ($domconfig{'usercreation'}{'cancreate'}{'selfcreate'});
+            }
+        }
+    }
+    my $defaultauth;
+    if (grep(/^login$/,@cancreate)) {
+        $defaultauth = 1;
+    }
+    my $authhost=Apache::lonnet::authenticate($form{'uname'},$upass,
+                                              $form{'udom'},$defaultauth);
     
 # --------------------------------------------------------------------- Failed?
 
     if ($authhost eq 'no_host') {
-	failed($r,'Username and/or password could not be authenticated.');
+	&failed($r,'Username and/or password could not be authenticated.',
+		\%form);
         return OK;
+    } elsif ($authhost eq 'no_account_on_host') {
+        my %domconfig = 
+            &Apache::lonnet::get_dom('configuration',['usercreation'],$form{'udom'});
+        if (grep(/^login$/,@cancreate)) {
+            my $start_page = 
+                &Apache::loncommon::start_page('Create a user account in LON-CAPA',
+                                               '',{'no_inline_link'   => 1,});
+            my $domdesc = &Apache::lonnet::domain($form{'udom'},'description');
+            my $lonhost = $r->dir_config('lonHostID');
+            my $origmail = $Apache::lonnet::perlvar{'lonSupportEMail'};
+            my $contacts = 
+                &Apache::loncommon::build_recipient_list(undef,'helpdeskmail',
+                                                        $form{'udom'},$origmail);
+            my ($contact_email) = split(',',$contacts); 
+            my $output = &Apache::createaccount::username_check($form{'uname'}, 
+                                                                $form{'udom'},$domdesc,'',
+                                                                $lonhost,$contact_email,$contact_name);
+            &Apache::loncommon::content_type($r,'text/html');
+            $r->send_http_header;
+            &Apache::createaccount::print_header($r,$start_page);
+            $r->print('<h3>'.&mt('Account creation').'</h3>'.
+                      &mt('Although your username and password were authenticated, you do not currently have a LON-CAPA account at this institution.').'<br />'.
+                      $output.&Apache::loncommon::end_page());
+            return OK;
+        } else {
+            &failed($r,'Although your username and password were authenticated, you do not currently have a LON-CAPA account in this domain, and you are not permitted to create one.',\%form);
+            return OK;
+        }
     }
 
     if (($firsturl eq '') || 
@@ -416,19 +321,19 @@ ENDFAILED
 	$firsturl='/adm/roles';
     }
 # --------------------------------- Are we attempting to login as somebody else?
-    if ($FORM{'suname'}) {
+    if ($form{'suname'}) {
 # ------------ see if the original user has enough privileges to pull this stunt
-	if (&Apache::lonnet::privileged($FORM{'uname'},$FORM{'udom'})) {
+	if (&Apache::lonnet::privileged($form{'uname'},$form{'udom'})) {
 # ---------------------------------------------------- see if the su-user exists
-	    unless (&Apache::lonnet::homeserver($FORM{'suname'},$FORM{'udom'})
+	    unless (&Apache::lonnet::homeserver($form{'suname'},$form{'udom'})
 		eq 'no_host') {
-		&Apache::lonnet::logthis(&Apache::lonnet::homeserver($FORM{'suname'},$FORM{'udom'}));
+		&Apache::lonnet::logthis(&Apache::lonnet::homeserver($form{'suname'},$form{'udom'}));
 # ------------------------------ see if the su-user is not too highly privileged
-		unless (&Apache::lonnet::privileged($FORM{'suname'},$FORM{'udom'})) {
+		unless (&Apache::lonnet::privileged($form{'suname'},$form{'udom'})) {
 # -------------------------------------------------------- actually switch users
-		    &Apache::lonnet::logperm('User '.$FORM{'uname'}.' at '.$FORM{'udom'}.
-			' logging in as '.$FORM{'suname'});
-		    $FORM{'uname'}=$FORM{'suname'};
+		    &Apache::lonnet::logperm('User '.$form{'uname'}.' at '.$form{'udom'}.
+			' logging in as '.$form{'suname'});
+		    $form{'uname'}=$form{'suname'};
 		} else {
 		    &Apache::lonnet::logthis('Attempted switch user to privileged user');
 		}
@@ -437,7 +342,15 @@ ENDFAILED
 	    &Apache::lonnet::logthis('Non-privileged user attempting switch user');
 	}
     }
-    &success($r,$FORM{'uname'},$FORM{'udom'},$authhost,$firsturl);
+
+    if ($r->dir_config("lonBalancer") eq 'yes') {
+	&success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect',undef,
+		 \%form);
+	$r->internal_redirect('/adm/switchserver');
+    } else {
+	&success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef,
+		 \%form);
+    }
     return OK;
 }