loncom/auth/lonauth.pm - view

File: [LON-CAPA] / loncom / auth / lonauth.pm
Revision 1.62: download - view: text, annotated - select for diffs
Tue Mar 16 20:42:50 2004 UTC (20 years, 1 month ago) by albertel
Branches: MAIN
CVS tags: version_1_2_X, version_1_2_1, version_1_2_0, version_1_1_99_5, version_1_1_99_4, version_1_1_99_3, version_1_1_99_2, version_1_1_99_1, version_1_1_99_0, HEAD

- We were emitting 2 <html> tags

1: # The LearningOnline Network 2: # User Authentication Module 3: # 4: # $Id: lonauth.pm,v 1.62 2004/03/16 20:42:50 albertel Exp $ 5: # 6: # Copyright Michigan State University Board of Trustees 7: # 8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA). 9: # 10: # LON-CAPA is free software; you can redistribute it and/or modify 11: # it under the terms of the GNU General Public License as published by 12: # the Free Software Foundation; either version 2 of the License, or 13: # (at your option) any later version. 14: # 15: # LON-CAPA is distributed in the hope that it will be useful, 16: # but WITHOUT ANY WARRANTY; without even the implied warranty of 17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18: # GNU General Public License for more details. 19: # 20: # You should have received a copy of the GNU General Public License 21: # along with LON-CAPA; if not, write to the Free Software 22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23: # 24: # /home/httpd/html/adm/gpl.txt 25: # 26: # http://www.lon-capa.org/ 27: # 28: # 5/21/99,5/22,5/25,5/26,5/27,5/29,6/2,6/11,6/14,6/15 29: # 16/11,12/16, 30: # 1/14,2/24,2/28,2/29,3/7,5/29,5/30,5/31,6/1,6/5,6/29, 31: # 7/1,7/10,10/2,10/5,10/9,10/26,10/30,11/10, 32: # 05/28,05/29 Gerd Kortemeyer 33: # 07/28,08/03 Gerd Kortemeyer 34: # 8/20 Gerd Kortemeyer 35: 36: package Apache::lonauth; 37: 38: use strict; 39: use Apache::Constants qw(:common); 40: use Apache::File; 41: use CGI qw(:standard); 42: use CGI::Cookie(); 43: use DynaLoader; # for Crypt::DES version 44: use Crypt::DES; 45: use Apache::loncommon(); 46: use Apache::lonnet(); 47: use Apache::lonmenu(); 48: use Fcntl qw(:flock); 49: use Apache::lonlocal; 50: 51: my %FORM; 52: 53: # ------------------------------------------------------------ Successful login 54: 55: sub success { 56: my ($r, $username, $domain, $authhost,$lowerurl) = @_; 57: my $lonids=$r->dir_config('lonIDsDir'); 58: 59: # See if old ID present, if so, remove 60: 61: my $filename; 62: opendir(DIR,$lonids); 63: while ($filename=readdir(DIR)) { 64: if ($filename=~/^$username\_\d+\_$domain\_$authhost\.id$/) { 65: unlink($lonids.'/'.$filename); 66: } 67: } 68: closedir(DIR); 69: 70: # Give them a new cookie 71: 72: my $cookie; 73: my $now=time; 74: $cookie="$username\_$now\_$domain\_$authhost"; 75: 76: # Initialize roles 77: 78: my $userroles=Apache::lonnet::rolesinit($domain,$username,$authhost); 79: 80: # ------------------------------------ Check browser type and MathML capability 81: 82: my ($httpbrowser,$clientbrowser,$clientversion,$clientmathml, 83: $clientunicode,$clientos) = &Apache::loncommon::decode_user_agent($r); 84: 85: # -------------------------------------- Any accessibility options to remember? 86: if (($FORM{'interface'}) && ($FORM{'remember'} eq 'true')) { 87: foreach ('imagesuppress','appletsuppress', 88: 'embedsuppress','fontenhance','blackwhite') { 89: if ($FORM{$_} eq 'true') { 90: &Apache::lonnet::put('environment',{$_ => 'on'}, 91: $domain,$username); 92: } else { 93: &Apache::lonnet::del('environment',[$_],$domain,$username); 94: } 95: } 96: } 97: # ------------------------------------------------------------- Get environment 98: 99: my $userenv; 100: my %userenv=Apache::lonnet::dump('environment',$domain,$username); 101: my ($tmp) = keys(%userenv); 102: if ($tmp !~ /^(con_lost|error|no_such_host)/i) { 103: foreach my $key (keys(%userenv)) { 104: $userenv.="environment.$key=$userenv{$key}\n"; 105: } 106: } 107: if (($userenv{'interface'}) && (!$FORM{'interface'})) { 108: $FORM{'interface'}=$userenv{'interface'}; 109: } 110: $ENV{'environment.remote'}=$userenv{'remote'}; 111: # --------------- Do not trust query string to be put directly into environment 112: foreach ('imagesuppress','appletsuppress', 113: 'embedsuppress','fontenhance','blackwhite', 114: 'interface','localpath','localres') { 115: $FORM{$_}=~s/[\n\r\=]//gs; 116: } 117: # --------------------------------------------------------- Write first profile 118: 119: { 120: my $idf=Apache::File->new(">$lonids/$cookie.id"); 121: unless (flock($idf,LOCK_EX)) { 122: &Apache::lonnet::logthis("<font color=blue>WARNING: ". 123: 'Could not obtain exclusive lock in lonauth: '.$!); 124: $idf->close(); 125: return 'error: '.$!; 126: } 127: if ($userenv ne '') { print $idf "$userenv\n"; } 128: print $idf "user.name=$username\n"; 129: print $idf "user.domain=$domain\n"; 130: print $idf "user.home=$authhost\n"; 131: print $idf "browser.type=$clientbrowser\n"; 132: print $idf "browser.version=$clientversion\n"; 133: print $idf "browser.mathml=$clientmathml\n"; 134: print $idf "browser.unicode=$clientunicode\n"; 135: print $idf "browser.os=$clientos\n"; 136: if ($FORM{'localpath'}) { 137: print $idf "browser.localpath=$FORM{'localpath'}\n"; 138: print $idf "browser.localres=$FORM{'localres'}\n"; 139: } 140: print $idf "request.course.fn=\n"; 141: print $idf "request.course.uri=\n"; 142: print $idf "request.course.sec=\n"; 143: print $idf "request.role=cm\n"; 144: print $idf "request.role.adv=$ENV{'user.adv'}\n"; 145: print $idf "request.host=$ENV{'REMOTE_ADDR'}\n"; 146: if ($FORM{'interface'}) { 147: $FORM{'interface'}=~s/\W//gs; 148: print $idf "browser.interface=$FORM{'interface'}\n"; 149: $ENV{'browser.interface'}=$FORM{'interface'}; 150: foreach ('imagesuppress','appletsuppress', 151: 'embedsuppress','fontenhance','blackwhite') { 152: if (($FORM{$_} eq 'true') || 153: ($userenv{$_} eq 'on')) { 154: print $idf "browser.$_=on\n"; 155: } 156: } 157: } 158: if ($userroles ne '') { print $idf "$userroles"; } 159: $idf->close(); 160: } 161: $ENV{'request.role'}='cm'; 162: $ENV{'request.role.adv'}=$ENV{'user.adv'}; 163: $ENV{'browser.type'}=$clientbrowser; 164: # -------------------------------------------------------------------- Log this 165: 166: &Apache::lonnet::log($domain,$username,$authhost, 167: "Login $ENV{'REMOTE_ADDR'}"); 168: 169: # ------------------------------------------------- Check for critical messages 170: 171: my @what=&Apache::lonnet::dump('critical',$domain,$username); 172: if ($what[0]) { 173: if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) { 174: $lowerurl='/adm/email?critical=display'; 175: } 176: } 177: 178: # ------------------------------------------------------------ Get cookie ready 179: 180: $cookie="lonID=$cookie; path=/"; 181: # -------------------------------------------------------- Menu script and info 182: my $windowinfo=&Apache::lonmenu::open($clientos); 183: my $startupremote=&Apache::lonmenu::startupremote($lowerurl); 184: my $setflags=&Apache::lonmenu::setflags(); 185: my $maincall=&Apache::lonmenu::maincall(); 186: my $bodytag=&Apache::loncommon::bodytag('Successful Login'); 187: my $add=&addcontent(); 188: # ------------------------------------------------- Output for successful login 189: 190: $r->send_cgi_header(<<ENDHEADER); 191: Content-type: text/html$add 192: Set-cookie: $cookie 193: 194: ENDHEADER 195: my %lt=&Apache::lonlocal::texthash( 196: 'wel' => 'Welcome', 197: 'mes' => 'Welcome to the Learning<i>Online</i> Network with CAPA. Please wait while your session is being set up', 198: 'pro' => 'Problems', 199: 'log' => 'loginproblems.html', 200: ); 201: $r->print(<<ENDSUCCESS); 202: <html> 203: <head> 204: <title>Successful Login to the LearningOnline Network with CAPA</title> 205: $startupremote 206: </head> 207: $bodytag 208: $setflags 209: $windowinfo 210: <h1>$lt{'wel'}</h1> 211: $lt{'mes'}.<p> 212: <a href="/adm/$lt{'log'}">$lt{'pro'}?</a></p> 213: $maincall 214: </body> 215: </html> 216: ENDSUCCESS 217: } 218: 219: # --------------------------------------------------------------- Failed login! 220: 221: sub failed { 222: my ($r,$message) = @_; 223: my $bodytag=&Apache::loncommon::bodytag('Unsuccessful Login'); 224: my $add=&addcontent(); 225: $r->send_cgi_header(<<ENDFHEADER); 226: Content-type: text/html$add 227: 228: ENDFHEADER 229: $r->print(<<ENDFAILED); 230: <html> 231: <head> 232: <title>Unsuccessful Login to the LearningOnline Network with CAPA</title> 233: </head> 234: $bodytag 235: <h1>Sorry ...</h1> 236: <p><b>$message</b></p> 237: <p>Please <a href="/adm/login?username=$FORM{'uname'}&domain=$FORM{'udom'}">log in again</a>.</p> 238: <p> 239: <a href="/adm/loginproblems.html">Problems?</a></p> 240: </body> 241: </html> 242: ENDFAILED 243: } 244: 245: # --------------------------------------------------------------------- Charset 246: 247: sub addcontent { 248: my $encoding=&Apache::lonlocal::current_encoding; 249: if ($encoding) { 250: return '; charset='.$encoding; 251: } else { 252: return ''; 253: } 254: } 255: 256: # ------------------------------------------------------------------ Rerouting! 257: 258: sub reroute { 259: my $r=shift; 260: my $bodytag=&Apache::loncommon::bodytag('Rerouting'); 261: $r->send_cgi_header(<<ENDRFHEADER); 262: Content-type: text/html 263: 264: ENDRFHEADER 265: $r->print(<<ENDRFAILED); 266: <html> 267: <head> 268: <title>Rerouting Login to the LearningOnline Network with CAPA</title> 269: </head> 270: $bodytag 271: <h1>Sorry ...</h1> 272: Please <a href="/">log in again</a>. 273: </body> 274: </html> 275: ENDRFAILED 276: } 277: 278: # ---------------------------------------------------------------- Main handler 279: 280: sub handler { 281: my $r = shift; 282: 283: # Are we re-routing? 284: if (-e '/home/httpd/html/lon-status/reroute.txt') { 285: &reroute($r); 286: return OK; 287: } 288: 289: &Apache::lonlocal::get_language_handle($r); 290: 291: # -------------------------------- Prevent users from attempting to login twice 292: my %cookies=CGI::Cookie->parse($r->header_in('Cookie')); 293: my $lonid=$cookies{'lonID'}; 294: my $cookie; 295: if ($lonid) { 296: my $handle=$lonid->value; 297: $handle=~s/\W//g; 298: my $lonidsdir=$r->dir_config('lonIDsDir'); 299: if ((-e "$lonidsdir/$handle.id") && ($handle ne '')) { 300: # Indeed, a valid token is found 301: $r->send_cgi_header(<<ENDFHEADER); 302: Content-type: text/html 303: 304: ENDFHEADER 305: my $bodytag=&Apache::loncommon::bodytag('Already logged in'); 306: $r->print(<<ENDFAILED); 307: <html> 308: <head> 309: <title>Already logged in</title> 310: </head> 311: $bodytag 312: <h1>You are already logged in</h1> 313: <p>Please either <a href="/adm/roles">continue the current session</a> or 314: <a href="/adm/logout">logout</a>.</p> 315: <p> 316: <a href="/adm/loginproblems.html">Problems?</a></p> 317: </body> 318: </html> 319: ENDFAILED 320: return OK; 321: } 322: } 323: 324: # ---------------------------------------------------- No valid token, continue 325: 326: 327: my $buffer; 328: $r->read($buffer,$r->header_in('Content-length'),0); 329: my @pairs=split(/&/,$buffer); 330: my $pair; my $name; my $value; 331: undef %FORM; 332: %FORM=(); 333: foreach $pair (@pairs) { 334: ($name,$value) = split(/=/,$pair); 335: $value =~ tr/+/ /; 336: $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg; 337: $FORM{$name}=$value; 338: } 339: 340: if ((!$FORM{'uname'}) || (!$FORM{'upass'}) || (!$FORM{'udom'})) { 341: failed($r,'Username, password and domain need to be specified.'); 342: return OK; 343: } 344: 345: # split user logging in and "su"-user 346: 347: ($FORM{'uname'},$FORM{'suname'})=split(/\:/,$FORM{'uname'}); 348: $FORM{'uname'} =~ s/\W//g; 349: $FORM{'suname'} =~ s/\W//g; 350: $FORM{'udom'} =~ s/\W//g; 351: 352: my $role = $r->dir_config('lonRole'); 353: my $domain = $r->dir_config('lonDefDomain'); 354: my $prodir = $r->dir_config('lonUsersDir'); 355: 356: # ---------------------------------------- Get the information from login token 357: 358: my $tmpinfo=Apache::lonnet::reply('tmpget:'.$FORM{'logtoken'}, 359: $FORM{'serverid'}); 360: 361: if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) { 362: failed($r,'Information needed to verify your login information is missing, inaccessible or expired.'); 363: return OK; 364: } else { 365: unless (&Apache::lonnet::reply('tmpdel:'.$FORM{'logtoken'}, 366: $FORM{'serverid'}) eq 'ok') { 367: &failed($r,'Session could not be opened.'); 368: } 369: } 370: my ($key,$firsturl)=split(/&/,$tmpinfo); 371: 372: my $keybin=pack("H16",$key); 373: 374: my $cipher; 375: if ($Crypt::DES::VERSION>=2.03) { 376: $cipher=new Crypt::DES $keybin; 377: } 378: else { 379: $cipher=new DES $keybin; 380: } 381: 382: my $upass=$cipher->decrypt( 383: unpack("a8",pack("H16",substr($FORM{'upass'},0,16)))); 384: 385: $upass.=$cipher->decrypt( 386: unpack("a8",pack("H16",substr($FORM{'upass'},16,16)))); 387: 388: $upass=substr($upass,1,ord(substr($upass,0,1))); 389: 390: # ---------------------------------------------------------------- Authenticate 391: my $authhost=Apache::lonnet::authenticate($FORM{'uname'}, 392: $upass, 393: $FORM{'udom'}); 394: 395: # --------------------------------------------------------------------- Failed? 396: 397: if ($authhost eq 'no_host') { 398: failed($r,'Username and/or password could not be authenticated.'); 399: return OK; 400: } 401: 402: if (($firsturl eq '') || 403: ($firsturl=~/^\/adm\/(logout|remote)/)) { 404: $firsturl='/adm/roles'; 405: } 406: # --------------------------------- Are we attempting to login as somebody else? 407: if ($FORM{'suname'}) { 408: # ------------ see if the original user has enough privileges to pull this stunt 409: if (&Apache::lonnet::privileged($FORM{'uname'},$FORM{'udom'})) { 410: # ---------------------------------------------------- see if the su-user exists 411: unless (&Apache::lonnet::homeserver($FORM{'suname'},$FORM{'udom'}) 412: eq 'no_host') { 413: &Apache::lonnet::logthis(&Apache::lonnet::homeserver($FORM{'suname'},$FORM{'udom'})); 414: # ------------------------------ see if the su-user is not too highly privileged 415: unless (&Apache::lonnet::privileged($FORM{'suname'},$FORM{'udom'})) { 416: # -------------------------------------------------------- actually switch users 417: &Apache::lonnet::logperm('User '.$FORM{'uname'}.' at '.$FORM{'udom'}. 418: ' logging in as '.$FORM{'suname'}); 419: $FORM{'uname'}=$FORM{'suname'}; 420: } else { 421: &Apache::lonnet::logthis('Attempted switch user to privileged user'); 422: } 423: } 424: } else { 425: &Apache::lonnet::logthis('Non-privileged user attempting switch user'); 426: } 427: } 428: &success($r,$FORM{'uname'},$FORM{'udom'},$authhost,$firsturl); 429: return OK; 430: } 431: 432: 1; 433: __END__ 434: 435: