--- loncom/auth/lonauth.pm 2008/10/01 11:11:08 1.95 +++ loncom/auth/lonauth.pm 2011/02/24 23:37:50 1.111 @@ -1,7 +1,7 @@ # The LearningOnline Network # User Authentication Module # -# $Id: lonauth.pm,v 1.95 2008/10/01 11:11:08 bisitz Exp $ +# $Id: lonauth.pm,v 1.111 2011/02/24 23:37:50 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -40,6 +40,8 @@ use Apache::lonmenu(); use Apache::createaccount; use Fcntl qw(:flock); use Apache::lonlocal; +use Apache::File (); +use HTML::Entities; # ------------------------------------------------------------ Successful login sub success { @@ -73,21 +75,61 @@ sub success { # ------------------------------------------------------------ Get cookie ready $cookie="lonID=$cookie; path=/"; # -------------------------------------------------------- Menu script and info - my $windowinfo=&Apache::lonmenu::open($env{'browser.os'}); - my $startupremote=&Apache::lonmenu::startupremote($lowerurl); - my $remoteinfo=&Apache::lonmenu::load_remote_msg($lowerurl); - my $setflags=&Apache::lonmenu::setflags(); - my $maincall=&Apache::lonmenu::maincall(); + my $destination = $lowerurl; + + if (defined($form->{role})) { + my $envkey = 'user.role.'.$form->{role}; + my $now=time; + my $then=$env{'user.login.time'}; + my $refresh=$env{'user.refresh.time'}; + my $update=$env{'user.update.time'}; + if (!$update) { + $update = $then; + } + if (exists($env{$envkey})) { + my ($role,$where,$trolecode,$tstart,$tend,$tremark,$tstatus); + &Apache::lonnet::role_status($envkey,$update,$refresh,$now,\$role,\$where, + \$trolecode,\$tstatus,\$tstart,\$tend); + if ($tstatus eq 'is') { + $destination .= ($destination =~ /\?/) ? '&' : '?'; + my $newrole = &HTML::Entities::encode($form->{role},'"<>&'); + $destination .= 'selectrole=1&'.$newrole.'=1'; + } + } + } + if (defined($form->{symb})) { + my $destsymb = $form->{symb}; + $destination .= ($destination =~ /\?/) ? '&' : '?'; + if ($destsymb =~ /___/) { + # FIXME Need to deal with encrypted symbs and urls as needed. + my ($map,$resid,$desturl)=split(/___/,$destsymb); + unless ($desturl=~/^(adm|uploaded|editupload|public)/) { + $desturl = &Apache::lonnet::clutter($desturl); + } + $desturl = &HTML::Entities::encode($desturl,'"<>&'); + $destsymb = &HTML::Entities::encode($destsymb,'"<>&'); + $destination .= '&destinationurl='.$desturl. + '&destsymb='.$destsymb; + } else { + $destsymb = &HTML::Entities::encode($destsymb,'"<>&'); + $destination .= '&destinationurl='.$destsymb; + } + } + if ($destination =~ m{^/adm/roles}) { + $destination .= ($destination =~ /\?/) ? '&' : '?'; + $destination .= 'source=login'; + } + + my $windowinfo = Apache::lonhtmlcommon::scripttag('self.name="loncapaclient";'); + my $header = ''; + my $brcrum = [{'href' => '', + 'text' => 'Successful Login'},]; my $start_page=&Apache::loncommon::start_page('Successful Login', - $startupremote, - {'no_inline_link' => 1,}); + $header, + {'bread_crumbs' => $brcrum,}); my $end_page =&Apache::loncommon::end_page(); - my $continuelink; - if (($env{'browser.interface'} eq 'textual') || - ($env{'environment.remote'} eq 'off')) { - $continuelink="".&mt('Continue').""; - } + my $continuelink=''.&mt('Continue').''; # ------------------------------------------------- Output for successful login &Apache::loncommon::content_type($r,'text/html'); @@ -102,13 +144,10 @@ sub success { ); $r->print(<$lt{'wel'} $lt{'mes'}

$lt{'pro'}

-$remoteinfo -$maincall $continuelink $end_page ENDSUCCESS @@ -118,18 +157,23 @@ ENDSUCCESS sub failed { my ($r,$message,$form) = @_; - my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef, - {'no_inline_link' => 1,}); + my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef); + my $retry = '/adm/login?username='.$form->{'uname'}. + '&domain='.$form->{'udom'}; + if (exists($form->{role})) { + $retry .= '&role='.$form->{role}; + } + if (exists($form->{symb})) { + $retry .= '&symb='.$form->{symb}; + } my $end_page = &Apache::loncommon::end_page(); &Apache::loncommon::content_type($r,'text/html'); - sleep 1; # brute force counteraction: slow down attackers, which try to hack user authentication with automated scripts $r->send_http_header; $r->print( $start_page .'

'.&mt('Sorry ...').'

' .'

'.&mt($message).'

' - .'

'.&mt('Please [_1]log in again[_2].' - ,"{'uname'}&domain=$form->{'udom'}\">",'') + .'

'.&mt('Please [_1]log in again[_2].','','') .'

' .'

'.&mt('Login problems?').'

' .$end_page @@ -163,23 +207,33 @@ sub handler { # -------------------------------- Prevent users from attempting to login twice my $handle = &Apache::lonnet::check_for_valid_session($r); if ($handle ne '') { + my $lonidsdir=$r->dir_config('lonIDsDir'); + if ($handle=~/^publicuser\_/) { +# For "public user" - remove it, we apparently really want to login + unlink($r->dir_config('lonIDsDir')."/$handle.id"); + } else { # Indeed, a valid token is found - &Apache::loncommon::content_type($r,'text/html'); - $r->send_http_header; - my $start_page = - &Apache::loncommon::start_page('Already logged in'); - my $end_page = - &Apache::loncommon::end_page(); - $r->print( - $start_page - .'

'.&mt('You are already logged in!').'

' - .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]logout[_4].' - ,'','','','') - .'

' - .'

'.&mt('Login problems?').'

' - .$end_page - ); - return OK; + &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); + &Apache::loncommon::content_type($r,'text/html'); + $r->send_http_header; + my $start_page = + &Apache::loncommon::start_page('Already logged in'); + my $end_page = + &Apache::loncommon::end_page(); + my $dest = '/adm/roles'; + if ($env{'form.firsturl'} ne '') { + $dest = $env{'form.firsturl'}; + } + $r->print( + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4].' + ,'','','','') + .'

' + .$end_page + ); + return OK; + } } # ---------------------------------------------------- No valid token, continue @@ -232,11 +286,25 @@ sub handler { return OK; } } + if (!&Apache::lonnet::domain($form{'udom'})) { &failed($r,'The domain you provided is not a valid LON-CAPA domain.',\%form); return OK; } - my ($key,$firsturl)=split(/&/,$tmpinfo); + + my ($key,$firsturl,$rolestr,$symbstr)=split(/&/,$tmpinfo); + if ($rolestr) { + $rolestr = &unescape($rolestr); + } + if ($symbstr) { + $symbstr= &unescape($symbstr); + } + if ($rolestr =~ /^role=/) { + (undef,$form{'role'}) = split('=',$rolestr); + } + if ($symbstr =~ /^symb=/) { + (undef,$form{'symb'}) = split('=',$symbstr); + } my $keybin=pack("H16",$key); @@ -276,8 +344,10 @@ sub handler { if (grep(/^login$/,@cancreate)) { $defaultauth = 1; } + my $clientcancheckhost = 1; my $authhost=Apache::lonnet::authenticate($form{'uname'},$upass, - $form{'udom'},$defaultauth); + $form{'udom'},$defaultauth, + $clientcancheckhost); # --------------------------------------------------------------------- Failed? @@ -289,10 +359,12 @@ sub handler { my %domconfig = &Apache::lonnet::get_dom('configuration',['usercreation'],$form{'udom'}); if (grep(/^login$/,@cancreate)) { - my $start_page = - &Apache::loncommon::start_page('Create a user account in LON-CAPA', - '',{'no_inline_link' => 1,}); my $domdesc = &Apache::lonnet::domain($form{'udom'},'description'); + unless (&check_can_host($r,\%form,'no_account_on_host',$domdesc)) { + return OK; + } + my $start_page = + &Apache::loncommon::start_page('Create a user account in LON-CAPA'); my $lonhost = $r->dir_config('lonHostID'); my $origmail = $Apache::lonnet::perlvar{'lonSupportEMail'}; my $contacts = @@ -342,15 +414,106 @@ sub handler { } } + unless (&check_can_host($r,\%form,$authhost)) { + return OK; + } + if ($r->dir_config("lonBalancer") eq 'yes') { &success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect',undef, \%form); - $r->internal_redirect('/adm/switchserver'); + my ($otherserver) = &Apache::lonnet::choose_server($form{'udom'}); + $r->internal_redirect('/adm/switchserver?otherserver='.$otherserver.'&origurl='.$firsturl); + return OK; } else { - &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef, - \%form); +# ------------------------------------------------------- Do the load balancing + +# ---------------------------------------------------------- Determine own load + my $loadlim = $r->dir_config('lonLoadLim'); + my $loadavg; + { + my $loadfile=Apache::File->new('/proc/loadavg'); + $loadavg=<$loadfile>; + } + $loadavg =~ s/\s.*//g; + my $loadpercent=sprintf("%.1f",100*$loadavg/$loadlim); + my $userloadpercent=&Apache::lonnet::userload(); + +# ---------------------------------------------------------- Are we overloaded? + if ((($userloadpercent>100.0)||($loadpercent>100.0))) { + my $unloaded=Apache::lonnet::spareserver($loadpercent,$userloadpercent,1,$form{'udom'}); + if ($unloaded) { + &success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect', + undef,\%form); + $r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl); + return OK; + } + } + &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef, + \%form); + return OK; + } +} + +sub check_can_host { + my ($r,$form,$authhost,$domdesc) = @_; + return unless (ref($form) eq 'HASH'); + my $canhost = 1; + my $lonhost = $r->dir_config('lonHostID'); + my $udom = $form->{'udom'}; + my @intdoms; + my $internet_names = &Apache::lonnet::get_internet_names($lonhost); + if (ref($internet_names) eq 'ARRAY') { + @intdoms = @{$internet_names}; + } + my $uprimary_id = &Apache::lonnet::domain($udom,'primary'); + my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id); + unless ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) { + my $machine_dom = &Apache::lonnet::host_domain($lonhost); + my $hostname = &Apache::lonnet::hostname($lonhost); + my $serverhomeID = &Apache::lonnet::get_server_homeID($hostname); + my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID); + my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom); + my %udomdefaults = &Apache::lonnet::get_domain_defaults($udom); + my $loncaparev; + if ($authhost eq 'no_account_on_host') { + $loncaparev = &Apache::lonnet::get_server_loncaparev($machine_dom); + } else { + $loncaparev = &Apache::lonnet::get_server_loncaparev($machine_dom,$lonhost); + } + $canhost = &Apache::lonnet::can_host_session($udom,$lonhost,$loncaparev, + $udomdefaults{'remotesessions'}, + $defdomdefaults{'hostedsessions'}); + } + unless ($canhost) { + if ($authhost eq 'no_account_on_host') { + my ($login_host,$hostname) = &Apache::lonnet::choose_server($udom); + &Apache::loncommon::content_type($r,'text/html'); + $r->send_http_header; + if ($login_host ne '') { + my $protocol = $Apache::lonnet::protocol{$login_host}; + $protocol = 'http' if ($protocol ne 'https'); + my $newurl = $protocol.'://'.$hostname.'/adm/createaccount'; + $r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA'). + '

'.&mt('Account creation').'

'. + &mt('You do not currently have a LON-CAPA account at this institution.').'
'. + '

'.&mt('You will be able to create one by logging into a LON-CAPA server within the [_1] domain.',$domdesc).'

'. + '

'.&mt('[_1]Log in[_2]','',''). + &Apache::loncommon::end_page()); + } else { + $r->print(&Apache::loncommon::start_page('Access to LON-CAPA unavailable'). + '

'.&mt('Account creation unavailable').'

'. + &mt('You do not currently have a LON-CAPA account at this institution.').'
'. + '

'.&mt('Currently a LON-CAPA server is not available within the [_1] domain for you to log-in to, to create an account.',$domdesc).'

'. + &Apache::loncommon::end_page()); + } + } else { + &success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef, + $form); + my ($otherserver) = &Apache::lonnet::choose_server($udom); + $r->internal_redirect('/adm/switchserver?otherserver='.$otherserver); + } } - return OK; + return $canhost; } 1;