--- loncom/auth/migrateuser.pm	2018/03/23 01:01:29	1.27
+++ loncom/auth/migrateuser.pm	2018/11/28 05:05:30	1.36
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Starts a user off based of an existing token.
 #
-# $Id: migrateuser.pm,v 1.27 2018/03/23 01:01:29 raeburn Exp $
+# $Id: migrateuser.pm,v 1.36 2018/11/28 05:05:30 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -36,6 +36,7 @@ use Apache::lonnet;
 use Apache::lonlocal;
 use Apache::lonlogin();
 use Apache::ltiauth;
+use CGI::Cookie;
 
 sub goto_login {
     my ($r,$domain,$data) = @_;
@@ -68,6 +69,9 @@ sub sso_check {
             $extra_env{'request.sso.reloginserver'} = 
                 $data->{'sso.reloginserver'};
         }
+        if (($data->{'balancer'}) && ($data->{'server'}) && ($data->{'balcookie'})) {
+            $extra_env{'request.balancercookie'} = $data->{'server'}.':'.$data->{'balcookie'};
+        }
     }
     return \%extra_env;
 }
@@ -87,6 +91,15 @@ sub lti_check {
             if ($data->{'lti.selfenrollrole'}) {
                 $lti_env{'request.lti.selfenrollrole'} = $data->{'lti.selfenrollrole'};
             }
+            if ($data->{'lti.uri'}) {
+                $lti_env{'request.lti.uri'} = $data->{'lti.uri'};
+            }
+            if ($data->{'lti.target'}) {
+                $lti_env{'request.lti.target'} = $data->{'lti.target'};
+            }
+            if ($data->{'lti.sourcecrs'}) {
+                $lti_env{'request.lti.sourcecrs'} = $data->{'lti.sourcecrs'};
+            }
         }
         if ($data->{'lti.passbackid'}) {
             $lti_env{'request.lti.passbackid'} = $data->{'lti.passbackid'};
@@ -207,6 +220,11 @@ sub ip_changed {
                     }
                 }
             }
+            unless ($hosthere) {
+                if (($dataref->{'balancer'}) && ($dataref->{'balcookie'})) {
+                    &Apache::lonnet::delbalcookie($dataref->{'balcookie'},$dataref->{'balancer'});
+                }
+            }
         }
         if ($dataref->{'sso.login'}) {
             $url .= '/adm/roles';
@@ -246,6 +264,159 @@ sub ip_changed {
     return OK;
 }
 
+sub logout {
+    my ($r,$handle,$data,$lti_env) = @_;
+    my $lonidsdir=$r->dir_config('lonIDsDir');
+    if (unlink("$lonidsdir/$handle.id")) {
+        if (($env{'user.linkedenv'} =~ /^[a-f0-9]+_linked$/) &&
+            (-l "$lonidsdir/$env{'user.linkedenv'}.id") &&
+            (readlink("$lonidsdir/$env{'user.linkedenv'}.id") eq "$lonidsdir/$handle.id")) {
+            unlink("$lonidsdir/$env{'user.linkedenv'}.id");
+        }
+    }
+    my %temp=('logout' => time);
+    &Apache::lonnet::put('email_status',\%temp);
+    &Apache::lonnet::log($env{'user.domain'},
+                         $env{'user.name'},
+                         $env{'user.home'},
+                         "Logout $ENV{'REMOTE_ADDR'}");
+
+    &Apache::loncommon::content_type($r,'text/html');
+
+    #expire the cookies
+    my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
+    foreach my $name (keys(%cookies)) {
+        next unless ($name =~ /^lon(|S|Link|Pub)ID$/);
+        my $c = new CGI::Cookie(-name    => $name,
+                                -value   => '',
+                                -expires => '-10y',);
+        $r->headers_out->add('Set-cookie' => $c);
+    }
+    my (%info,%user_info,%lti_info);
+    if (ref($lti_env) eq 'HASH') {
+        %lti_info = %{$lti_env};
+    }
+    my $lonhost = $r->dir_config('lonHostID');
+    if (ref($data) eq 'HASH') {
+        %user_info=('ip'       => $ENV{'REMOTE_ADDR'},
+                    'domain'   => $data->{'domain'},
+                    'username' => $data->{'username'},
+                    'home'     => $data->{'home'},
+                    'role'     => $data->{'role'},
+                    'origurl'  => $data->{'origurl'},
+                    'symb'     => $data->{'symb'},
+                    'server'   => $lonhost);
+    }
+    %info = (%user_info,%lti_info);
+    my $token = &Apache::lonnet::tmpput(\%info,$lonhost);
+    my $url = '/adm/migrateuser?token='.$token;
+    $r->send_http_header;
+    $r->print(
+        &Apache::loncommon::start_page('Updating Session ...',undef,
+                                       {'redirect'       => [0.1,$url],
+                                        'only_body'      => 1,}).
+        &Apache::loncommon::end_page());
+    $r->register_cleanup(\&flush_course_logs);
+    return;
+}
+
+sub conlost_userhome {
+    my ($r,$idsref,$dataref) = @_;
+    return unless ((ref($idsref) eq 'ARRAY') && (ref($dataref) eq 'HASH'));
+    my @ids = @{$idsref};
+    my %data = %{$dataref};
+    my (%conlost,%posstargets);
+    my $lonhost = $r->dir_config('lonHostID');
+    $conlost{$lonhost} = 1;
+    if ($data{'conlost'} ne '') {
+        map { $conlost{$_} = 1; } split(/,/,$data{'conlost'});
+    }
+    my ($lowest_load,$otherserver);
+    $lowest_load = 30000;
+    if ($data{'offloadto'} =~ /\&/) {
+        my @items = split(/\&/,$data{'offloadto'});
+        foreach my $item (@items) {
+            my ($type,$targets) = split(/\=/,$item);
+            @{$posstargets{$type}} = split(/,/,$targets);
+        }
+    } elsif ($data{'offloadto'} =~ /=/) {
+        my ($type,$targets) = split(/\=/,$data{'offloadto'});
+        @{$posstargets{$type}} = split(/,/,$targets);
+    } else {
+        @{$posstargets{'default'}} = split(/,/,$data{'offloadto'});
+    }
+    if (ref($posstargets{'primary'}) eq 'ARRAY') {
+        foreach my $try_server (@{$posstargets{'primary'}}) {
+            next if (grep(/^\Q$try_server\E$/,@ids));
+            next if ($conlost{$try_server});
+            ($otherserver,$lowest_load) =
+                &Apache::lonnet::compare_server_load($try_server,
+                                                     $otherserver,
+                                                     $lowest_load);
+        }
+    }
+    my $found_server = ($otherserver ne '' && $lowest_load < 100);
+    if (!$found_server) {
+        if (ref($posstargets{'default'}) eq 'ARRAY') {
+            foreach my $try_server (@{$posstargets{'default'}}) {
+                ($otherserver,$lowest_load) =
+                &Apache::lonnet::compare_server_load($try_server,
+                                                     $otherserver,
+                                                     $lowest_load);
+            }
+        }
+    }
+    if ($otherserver ne '') {
+        my $switchto = &Apache::lonnet::hostname($otherserver);
+        if ($switchto ne '') {
+            my $protocol = $Apache::lonnet::protocol{$switchto};
+            $protocol = 'http' if ($protocol ne 'https');
+            my $url = $protocol.'://'.$switchto.'/adm/login?'.
+                                    'domain='.$env{'user.domain'}.
+                                    '&amp;username='.$env{'user.name'};
+            $data{'conlost'} = join(',',sort(keys(%conlost)));
+            $data{'server'} = $lonhost;
+            if (grep(/^\Q$otherserver\E$/,split(/,/,$data{'dom_balancers'}))) {
+                $data{'noloadbalance'} = $otherserver; 
+            }
+            my $token = &Apache::lonnet::tmpput(\%data,$otherserver);
+            $url .= '&amp;token='.$token;
+            $r->send_http_header;
+            $r->print(
+                &Apache::loncommon::start_page('Switching Server ...',undef,
+                                               {'redirect'       => [0.1,$url]}).
+                                                &Apache::loncommon::end_page());
+            return $otherserver;
+        }
+    }
+}
+
+sub log_switch {
+    my ($r,$data,$lti_env) = @_;
+    my $lonhost = $r->dir_config('lonHostID');
+    return unless ((ref($data) eq 'HASH') && (ref($lti_env) eq 'HASH'));
+    my $now = time;
+    my %temp=('switchserver' => $now.':'.$lonhost,$data->{'role'});
+    &Apache::lonnet::put('email_status',\%temp);
+    my $logmsg = "Switch Server to $lonhost";
+    if ($data->{'role'}) {
+        $logmsg .= " with role: ".$data->{'role'};
+    } elsif (($lti_env->{'reqcrs'}) && ($lti_env->{'reqrole'} eq 'cc')) {
+        $logmsg .= " to create new LTI course";
+    } elsif ($lti_env->{'selfenrollrole'}) {
+        $logmsg .= " to selfenroll with role: ".$lti_env->{'selfenrollrole'};
+    } else {
+        $logmsg .= " (no role)";
+    }
+    $logmsg .= ' '.$ENV{'REMOTE_ADDR'};
+    &Apache::lonnet::log($data->{'domain'},$data->{'username'},$data->{'home'},$logmsg);
+}
+
+sub flush_course_logs {
+    &Apache::lonnet::flushcourselogs();
+    return OK;
+}
+
 sub handler {
     my ($r) = @_;
     
@@ -271,13 +442,41 @@ sub handler {
 	return &ip_changed($r,$data{'domain'},$data{'server'},\%data);
     }
 
-    &Apache::lonnet::logthis("Allowing access for $data{'username'}:$data{'domain'} to $data{'role'}");
     my $home=&Apache::lonnet::homeserver($data{'username'},$data{'domain'});
+    if ($home eq 'no_host') {
+        if (($data{'home'} ne '') && (&Apache::lonnet::hostname($data{'home'}))) {
+            &Apache::lonnet::reconlonc($data{'home'});
+            $home=&Apache::lonnet::homeserver($data{'username'},$data{'domain'});
+            if ($home eq 'no_host') {
+                my @ids=&Apache::lonnet::current_machine_ids();
+                unless (grep(/^\Q$data{'home'}\E$/,@ids)) {
+                    if (&Apache::lonnet::reply('ping',$data{'home'}) eq 'con_lost') {
+                        my $otherserver = &conlost_userhome($r,\@ids,\%data);
+                        if ($otherserver ne '') {
+                            &Apache::lonnet::logthis("No connection to home server ($data{'home'}) for $data{'username'}:$data{'domain'}. Switching to $otherserver");
+                            return OK;
+                        }
+                    }
+                }
+            }
+        }
+    }
+
     my $udom;
     if (&Apache::lonnet::domain($data{'domain'})) {
         $udom=$data{'domain'};
     }
-    if ($home =~ /(con_lost|no_such_host)/) { return &goto_login($r,$udom,\%data); }
+    if ($home eq 'no_host') { return &goto_login($r,$udom,\%data); }
+    if (&Apache::lonnet::hostname($home) eq '') { return &goto_login($r,$udom,\%data); } 
+
+    my $rolemsg;
+    if ($data{'role'}) {
+        $rolemsg = "role: $data{'role'}"; 
+    } else {
+        $rolemsg = '(no role)';
+    }
+
+    &Apache::lonnet::logthis("Allowing access for $data{'username'}:$data{'domain'} $rolemsg");
 
     my $sso_env = &sso_check(\%data);
     my $lti_env = &lti_check(\%data);
@@ -300,40 +499,96 @@ sub handler {
         $form{'noloadbalance'} = $data{'noloadbalance'};
     }
 
+    if (($data{'conlost'}) && ($data{'server'})) {
+        my @conlosts = split(/,/,$data{'conlost'});
+        my $switchfrom = $data{'server'};
+        if (@conlosts) {
+            if (grep(/^\Q$switchfrom\E$/,@conlosts)) {
+                &log_switch($r,\%data,$extra_env);
+            }
+        }
+    }
+
     if (!$data{'role'}) {
 	my $handle = &Apache::lonnet::check_for_valid_session($r);
 	if ($handle) {
 	    &Apache::lonnet::transfer_profile_to_env($r->dir_config('lonIDsDir'),
 						     $handle);
-#FIXME if user is not currently logged in as an LTI log-in log them out.
             if ($data{'lti.login'}) {
-                if (($data{'lti.reqcrs'}) && ($data{'lti.reqrole'} eq 'cc')) {
+                my $needslogout;
+                if ($env{'request.lti.login'}) {
+                    if (($env{'user.name'} ne $data{'username'}) ||
+                        ($env{'user.domain'} ne $data{'domain'})) {
+                        $needslogout = 1;
+                    }
+                } else {
+                    $needslogout = 1;
+                }
+# If access is via LTI, and user already has a non-LTI session cookie 
+# (and session) or has an LTI session cookie for a different username,
+# logout the existing session, and start a new one
+                if ($needslogout) {
+                    &logout($r,$handle,\%data,$lti_env);
+                } elsif (($data{'lti.reqcrs'}) && ($data{'lti.reqrole'} eq 'cc')) {
                     $form{'lti.reqcrs'} = $data{'lti.reqcrs'};
                     $form{'lti.reqrole'} = $data{'lti.reqrole'};
                     $form{'lti.sourcecrs'} = $data{'lti.sourcecrs'};
+                    $form{'lti.uri'} = $data{'lti.uri'};
+                    if ($data{'lti.passbackid'}) {
+                        $form{'lti.passbackid'} = $data{'lti.passbackid'};
+                    }
+                    if ($data{'lti.passbackurl'}) {
+                        $form{'lti.passbackurl'} = $data{'lti.passbackurl'};
+                    }
+                    if ($data{'lti.rosterid'}) {
+                        $form{'lti.rosterid'} = $data{'lti.rosterid'};
+                    }
+                    if ($data{'lti.rosterurl'}) {
+                        $form{'lti.rosterurl'} = $data{'lti.rosterurl'};
+                    }
+                    if ($data{'lti.target'}) {
+                        $form{'lti.target'} = $data{'lti.target'};
+                    }
                     &Apache::loncommon::content_type($r,'text/html');
                     $r->send_http_header;
                     &Apache::ltiauth::lti_reqcrs($r,$data{'domain'},\%form,$data{'username'},$data{'domain'});
-                } elsif ($data{'lti.selfenrollrole'}) {
-                    if (&Apache::ltiauth::lti_enroll($data{'username'},data{'domain'},
-                                                 $data{'lti.selfenrollrole'}) eq 'ok') {
-                        my $url = '/adm/roles?selectrole=1&'.
-                                  &escape($data{'lti.selfenrollrole'}).'=1';
-                        if ($data{'origurl'} =~ m{/default_\d+\.sequence$}) {
-                            $url .= '&orgurl='.$data{'origurl'}.'&navmap=1';
-                        } elsif ($data{'origurl'} ne '') {
-                            $url .= '&orgurl='.$data{'origurl'};
+                } else {
+                    if (ref($lti_env) eq 'HASH') {
+                        delete($lti_env->{'reqcrs'});
+                        delete($lti_env->{'reqrole'});
+                        delete($lti_env->{'selfenrollrole'});
+                    }
+                    if ($data{'lti.selfenrollrole'}) {
+                        if (&Apache::ltiauth::lti_enroll($data{'username'},$data{'domain'},
+                                                         $data{'lti.selfenrollrole'}) eq 'ok') {
+                            my $url = '/adm/roles?selectrole=1&'.
+                                      &escape($data{'lti.selfenrollrole'}).'=1';
+                            if ($data{'origurl'} =~ m{/default_\d+\.sequence$}) {
+                                $url .= '&orgurl='.$data{'origurl'}.'&navmap=1';
+                            } elsif ($data{'origurl'} ne '') {
+                                $url .= '&orgurl='.$data{'origurl'};
+                            }
+                            if (ref($lti_env) eq 'HASH') {
+                                &Apache::lonnet::appenv($lti_env);
+                            }
+                            $r->internal_redirect($url);
+                        } else {
+                            &Apache::ltiauth::invalid_request($r,23);
+                        }
+                    } elsif ($data{'origurl'} ne '') {
+                        my $url = $data{'origurl'};
+                        if ($url =~ m{/default_\d+\.sequence$}) {
+                            $url .= (($url =~/\?/)?'&':'?').'navmap=1';
+                        }
+                        if (ref($lti_env) eq 'HASH') {
+                            &Apache::lonnet::appenv($lti_env);
                         }
                         $r->internal_redirect($url);
                     } else {
-                        &Apache::ltiauth::invalid_request($r,23);
-                    }
-                } elsif ($data{'origurl'} ne '') {
-                    my $url = $data{'origurl'};
-                    if ($url =~ m{/default_\d+\.sequence$}) {
-                        $url .= (($url =~/\?/)?'&':'?').'navmap=1';
+                        if (ref($lti_env) eq 'HASH') {
+                            &Apache::lonnet::appenv($lti_env);
+                        }
                     }
-                    $r->internal_redirect($url);
                 }
             } elsif ($data{'origurl'} ne '') {
                 $r->internal_redirect($data{'origurl'});
@@ -364,9 +619,15 @@ sub handler {
 	return OK;
     }
 
-    my $next_url='/adm/roles?selectrole=1&amp;'.&escape($data{'role'}).'=1';
+    my $next_url='/adm/roles?selectrole=1&'.&escape($data{'role'}).'=1';
     if ($data{'origurl'} ne '') {
-        $next_url .= '&amp;orgurl='.&escape($data{'origurl'});
+        $next_url .= '&orgurl='.&escape($data{'origurl'});
+        if ($data{'lti.login'}) {
+            if (($data{'origurl'} =~ m{/default_\d+\.sequence$}) ||
+                ($data{'origurl'} =~ m{^/res/.+\.sequence$})) {
+                $next_url .= '&navmap=1';
+            }
+        }
     }
     &Apache::lonauth::success($r,$data{'username'},$data{'domain'},$home,
 			      $next_url,$extra_env,\%form);