Annotation of loncom/auth/lonwebdavauth.pm, revision 1.6

1.1       raeburn     1: # The LearningOnline Network
                      2: # Authentication Handler for webDAV access to Authoring Space.
                      3: #
1.6     ! raeburn     4: # $Id: lonwebdavauth.pm,v 1.5 2015/05/30 00:11:04 raeburn Exp $
1.1       raeburn     5: #
                      6: # Copyright Michigan State University Board of Trustees
                      7: #
                      8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
                      9: #
                     10: # LON-CAPA is free software; you can redistribute it and/or modify
                     11: # it under the terms of the GNU General Public License as published by
                     12: # the Free Software Foundation; either version 2 of the License, or
                     13: # (at your option) any later version.
                     14: #
                     15: # LON-CAPA is distributed in the hope that it will be useful,
                     16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
                     17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
                     18: # GNU General Public License for more details.
                     19: #
                     20: # You should have received a copy of the GNU General Public License
                     21: # along with LON-CAPA; if not, write to the Free Software
                     22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
                     23: #
                     24: # /home/httpd/html/adm/gpl.txt
                     25: #
                     26: # http://www.lon-capa.org/
                     27: #
                     28: 
                     29: =head1 NAME
                     30: 
                     31: Apache::lonwebdavauth - webDAV Authentication Handler
                     32: 
                     33: =head1 SYNOPSIS
                     34: 
1.3       raeburn    35: Invoked for ^/+webdav/[\w\-.]+/\w[\w.\-\@]+/ by 
1.1       raeburn    36: /etc/httpd/conf/loncapa_apache.conf:
                     37: 
                     38: PerlAuthenHandler	Apache::lonwebdavauth
                     39: 
                     40: =head1 INTRODUCTION
                     41: 
                     42: This module employs Apache Basic Auth authentication and is used
                     43: to provide authentication for webDAV client access to author
                     44: space(s). Note: because Apache Basic Auth is used, webDAV access
                     45: is only available for servers running Apache with SSL.
                     46: 
                     47: If the webDAV client supports cookies then whenever the client  
                     48: sends the cookie back, a check is made to see if a corresponding
                     49: valid session file exists in the server's webDAV session directory.
                     50: Support for cookies by webDAV clients is optional.
                     51: 
                     52: If a valid session file exists, a cookie is returned containing
                     53: the session ID,  otherwise a new session file is created and
                     54: returned in the cookie.
                     55: 
                     56: The perlvar "lonDAVsessDir" in /etc/httpd/conf/loncapa_apache.conf
                     57: provides the directory location: /home/httpd/webdav/sessionIDs.
                     58: 
                     59: If the session is stale, or the cookie is missing or invalid, 
1.4       raeburn    60: the user is re-challenged for login information, by sending
                     61: an Apache Basic Auth request to the client.
1.1       raeburn    62: 
1.4       raeburn    63: If Apache Basic Auth is successful authentication will
1.1       raeburn    64: result in creation of a webDAV session file containing a 
                     65: minimal set of information about the user which will also be 
                     66: loaded into the user's environment.  The environment persists
                     67: until the end of the Apache request, when it is cleaned up
                     68: by lonacc::cleanup, as is the case for requests for non-webdav URLs.
                     69: 
                     70: If a valid session file exists, a cookie is returned containing
                     71: the session ID, otherwise a new session file is created and
                     72: returned in the cookie.
                     73: 
                     74: This is part of the LearningOnline Network with CAPA project
                     75: described at http://www.lon-capa.org.
                     76: 
                     77: =head1 HANDLER SUBROUTINE
                     78: 
                     79: This routine is called by Apache and mod_perl.
                     80: 
                     81: =over 4
                     82: 
                     83: =item *
                     84: 
                     85: Check for valid webDAV session
                     86: 
                     87: =item *
                     88: 
1.4       raeburn    89: No session? return AUTH_REQUIRED which will prompt 
                     90: webDAV client to authenticate user (via Apache Basic Auth). 
1.1       raeburn    91: 
                     92: =item *
                     93: 
                     94: If authenticated, call &init_webdav_env() to create sessionID
                     95: and populate environment, and send header containing cookie.
                     96: 
                     97: =back
                     98: 
                     99: =head1 NOTABLE SUBROUTINES
                    100: 
                    101: =over
                    102: 
                    103: =item * init_webdav_env()
                    104: 
                    105: =over
                    106: 
                    107: =item *
                    108: 
                    109: Checks for valid session files in webDAV session directory.
                    110: 
                    111: =item * 
                    112: 
                    113: Calls Apache::lonnet::transfer_profile_to_env() to create
                    114: %env for user if session is valid. 
                    115: 
                    116: =item * 
                    117: 
                    118: Otherwise creates new session file and populates %env. 
                    119: 
                    120: =item *
                    121: 
                    122: Session ID file is a GDBM file containing:
                    123: 
                    124: =over
                    125: 
                    126: =item * user.name, user.domain, user.home, user.environment
                    127: 
                    128: =item * user.role entries for:
                    129: 
                    130: active author, co-author, and assistant co-author roles
                    131: in domains hosted on this machine.
                    132: 
                    133: =back
                    134: 
                    135: =back
                    136: 
                    137: =back
                    138: 
                    139: =cut 
                    140: 
                    141: package Apache::lonwebdavauth;
                    142: 
                    143: use strict;
                    144: use GDBM_File;
                    145: use Apache::Constants qw(:common :http :methods);
                    146: use Apache::lonnet;
                    147: use LONCAPA qw(:DEFAULT :match);
                    148: 
                    149: sub handler {
                    150:     my $r = shift;
                    151:     my $now = time;
                    152:     my $timetolive = 600;
                    153:     my $sessiondir=$r->dir_config('lonDAVsessDir');
                    154:     my ($uname,$udom,$uhome);
                    155: 
                    156: # Check for cookie
                    157:     my $handle = &Apache::lonnet::check_for_valid_session($r,'lonDAV');
                    158:     if ($handle ne '') {
                    159:         my $sesstime;
                    160:         ($uname,$udom,$sesstime,$uhome) =  
                    161:             ($handle =~ /^($match_username)_($match_domain)_(\d+)_\d+_(.+)$/);
                    162:         if ($sesstime) {
                    163:             if ($now-$sesstime < $timetolive) {
                    164:                 if (&Apache::lonnet::homeserver($uname,$udom) eq $uhome) {
                    165:                     &Apache::lonnet::transfer_profile_to_env($sessiondir,$handle);
1.2       raeburn   166:                     if (&Apache::lonnet::usertools_access($uname,$udom,'webdav')) {
                    167:                         return OK;
                    168:                     } else {
                    169:                         return FORBIDDEN;
                    170:                     }
1.1       raeburn   171:                 }
                    172:             }
                    173:         }
                    174:     }
                    175: 
                    176:     my ($status,$upass) = $r->get_basic_auth_pw;
                    177:     return $status unless ($status == 0 || $status == OK);
                    178: 
                    179:     if ($r->user =~ /,/) {
                    180:         ($uname,$udom) = split(/,/,$r->user);
1.5       raeburn   181:         $uname =~ s/^\s+//;
                    182:         $uname =~ s/\s+$//;
                    183:         $udom =~ s/^\s+//;
                    184:         $udom =~ s/\s+$//;
1.1       raeburn   185:         unless (($uname =~ /^$match_username$/) && ($udom =~ /^$match_domain$/)) {
                    186:             $r->note_basic_auth_failure;
                    187:             return AUTH_REQUIRED;
                    188:         }
                    189:     } else {
                    190:         $uname = $r->user;
1.5       raeburn   191:         $uname =~ s/^\s+//;
                    192:         $uname =~ s/\s+$//;
1.1       raeburn   193:         ($udom) = ($r->uri =~ m{^/webdav/($match_domain)/});
1.4       raeburn   194:         unless (($udom ne '' ) && ($uname =~ /^$match_username$/) && ($upass ne '')) {
1.1       raeburn   195:             $r->note_basic_auth_failure;
                    196:             return AUTH_REQUIRED;
                    197:         }
                    198:     }
                    199:     if (&Apache::lonnet::domain($udom) ne '') {
                    200:         if (&Apache::lonnet::homeserver($uname,$udom) ne 'no_host') {
                    201:             my $uhome = &Apache::lonnet::authenticate($uname,$upass,$udom);
                    202:             if (($uhome ne 'no_host') && 
                    203:                 (&Apache::lonnet::hostname($uhome) ne '')) {
1.3       raeburn   204:                 my ($author) = ($r->uri =~ m{^/webdav/($match_domain/$match_username)/});
                    205:                 $handle = &init_webdav_env($r,$sessiondir,$uname,$udom,
                    206:                                            $uhome,$now,$timetolive,$author);
1.1       raeburn   207:                 if ($handle ne '') {
1.2       raeburn   208:                     if (&Apache::lonnet::usertools_access($uname,$udom,'webdav')) {
                    209:                         my $cookie = "lonDAV=$handle; path=/webdav/; secure; HttpOnly;";
                    210:                         $r->header_out('Set-cookie' => $cookie);
                    211:                         $r->send_http_header;
                    212:                         return OK;
                    213:                     } else {
                    214:                         return FORBIDDEN;
                    215:                     }
1.1       raeburn   216:                 }
                    217:             }
                    218:         }
                    219:     }
                    220:     $r->note_basic_auth_failure;
                    221:     return AUTH_REQUIRED;
                    222: }
                    223: 
                    224: sub init_webdav_env {
1.3       raeburn   225:     my ($r,$sessiondir,$uname,$udom,$uhome,$now,$timetolive,$author) = @_;
1.1       raeburn   226:     my $handle;
                    227:     my $currnewest = 0;
                    228:     if ($sessiondir ne '') {
                    229:         if (opendir(DIR,$sessiondir)) {
                    230:             while (my $filename=readdir(DIR)) {
                    231:                 if ($filename=~/^($uname\_$udom\_(\d+)\_\d+\_$uhome)\.id$/) {
                    232:                     my $oldhandle = $1;
                    233:                     my $sesstime = $2;
                    234:                     if ($now-$sesstime < $timetolive) {
                    235:                         if ($sesstime > $currnewest) {
                    236:                             $currnewest = $sesstime;
                    237:                             if ($handle ne '') {
                    238:                                 unlink("$sessiondir/$handle.id");
                    239:                             }
                    240:                             $handle = $oldhandle;
                    241:                             next;
                    242:                         }
                    243:                     }
                    244:                     unlink($sessiondir.'/'.$filename);
                    245:                 }
                    246:             }
                    247:             closedir(DIR);
                    248:         }
                    249:     }
                    250:     if ($handle ne '') {
                    251:         &Apache::lonnet::transfer_profile_to_env($sessiondir,$handle);
                    252:         return $handle;
                    253:     } else {
                    254:         my $id = $$.int(rand(10000000));
                    255:         $handle = "$uname\_$udom\_$now\_$id\_$uhome";
                    256:         my $sessionfile = "$sessiondir/$handle.id";
                    257:         if (tie(my %disk_env,'GDBM_File',"$sessionfile",
                    258:                 &GDBM_WRCREAT(),0640)) {
                    259:             $disk_env{'user.name'} = $uname;
                    260:             $disk_env{'user.domain'} = $udom;
                    261:             $disk_env{'user.home'} = $uhome;
1.2       raeburn   262:             my %userenv = &Apache::lonnet::get('environment',['inststatus','tools.webdav'],
                    263:                                                $udom,$uname);
                    264:             my ($tmp) = keys(%userenv);
                    265:             if ($tmp =~ /^(con_lost|error|no_such_host)/i) {
                    266:                 $disk_env{'environment.inststatus'} = $userenv{'inststatus'};
                    267:                 $disk_env{'environment.tools.webdav'} = $userenv{'tools.webdav'};
                    268:             }
1.1       raeburn   269:             $disk_env{'user.environment'} = $sessionfile;
                    270:             my $possroles = ['au','ca','aa'];
                    271:             my @possdoms = &Apache::lonnet::current_machine_domains();
                    272:             my %cstr_roles =
                    273:                 &Apache::lonnet::get_my_roles($uname,$udom,'userroles',
                    274:                                               undef,$possroles,\@possdoms);
1.2       raeburn   275:             if (keys(%cstr_roles) > 0) {
                    276:                 $disk_env{'user.adv'} = 1;
                    277:                 $disk_env{'user.author'} = 1;
                    278:                 foreach my $item (keys(%cstr_roles)) {
                    279:                     my ($aname,$adom,$role) = split(/:/,$item);
                    280:                     if ($role eq 'au') {
                    281:                         $disk_env{"user.role.$role./$adom/"} = $cstr_roles{$item};
                    282:                     } else {
                    283:                         $disk_env{"user.role.$role./$adom/$aname"} = $cstr_roles{$item};
                    284:                     }
1.1       raeburn   285:                 }
                    286:             }
1.2       raeburn   287:             my %is_adv = ( is_adv => $disk_env{'user.adv'} );
                    288:             my %domdef = &Apache::lonnet::get_domain_defaults($udom);
                    289:             $disk_env{'environment.availabletools.webdav'} =
                    290:                 &Apache::lonnet::usertools_access($uname,$udom,'webdav','reload',undef,
                    291:                                                   \%userenv,\%domdef,\%is_adv);
1.1       raeburn   292:             @env{keys(%disk_env)} = @disk_env{keys(%disk_env)};
                    293:             untie(%disk_env);
1.6     ! raeburn   294:             my $ip = $r->get_remote_host();
1.3       raeburn   295:             &Apache::lonnet::log($udom,$uname,$uhome,
                    296:                                  "Login webdav/$author $ip");
1.1       raeburn   297:         }
                    298:         return $handle;
                    299:     }
                    300:     return;
                    301: }
                    302: 
                    303: 1;

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>