CVS log for loncom/auth/migrateuser.pm

Up to [LON-CAPA] / loncom / auth

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- For 2.11.4 (modified)
  Include changes in 1.68, 1.69, 1.70

- Bug 6907

- Bug 6907.
  Update values for request.linkprotexit, request.linkprotpbid, and
  request.linkprotpburl in %env if deep-link is followed and launch URL
  unchanged but their values changed (e.g., different Consumer deep-link).

- Bug 6907.
  Update values for request.linkprot, request.linkprotexit, request.linkprotpbid
  and request.linkprotpburl if deep-link is followed from same Consumer as
  already in use for current session, but launch URL is different.

- For 2.11.4 (modified)
  Include changes in 1.26, 1.27, 1.28 (part), 1.29, 1.30, 1.31, 1.32, 1.33,
  1.44, 1.47, 1.67

- Bugs 6754 and 6907
  - Return of grades to launcher CMS supported for resources or folders
    accessed via LTI-mediated deep link.
  - Support option: "Encrypt stored consumer secrets defined in domain"
  - Signing of LTI payloads for roster retrieval, passback of grades,
    and callback to logput launcher CMS session all now occur on
    primary library server for course's domain.

- For 2.11.4 (modified)
  Include changes in 1.66

- Support access to specific LON-CAPA message after login in cases where a
  LON-CAPA loadbalancer node is used as the portal for a domain.

- For 2.11.4 (modified)
  Include changes in q.27 (part) and 1.65

- Dual SSO and non-SSO login from /adm/login
  - Display of domain configuration for each server split into two tables
    so input textboxes can be longer.
  - "Pop-up if iframe" (Y/N) item added.  If Y, when login page is in an
    iframe, SSO log-in dialog will be displayed in a new window, i.e.,
    not within the iframe, e.g., to satisfy sameorigin requirement in
    x-frame-options in header sent by SSO server.

- For 2.11.4 (modified)
  Include changes in 1.61, 1.62, 1.63, 1.64

- Bug 6907
  "Exit Tool" button available to logout a session launched via deep link
  and escape iframe and redirect (for LTI-protected link).

- Bug 6907
  "Exit Tool" button available to logout a session launched via deep link
  and escape iframe and redirect (for LTI-protected link).

- Bug 6907
  - Set request.linkprotuser in %env for students accessing deep-linked items
    with LTI link protection which includes username from other LMS.
  - Set "only_body" for intermediate pages shown while session is being set up
    for LTI link-protected access.
  - Provide appropriate feedback when a deep link is followed but the user
    only has a future and/or expired role in the target course.

- Bug 6907
  For LTI-protected deep links in which username is included in launch payload
  compare username in payload with username for any existing LON-CAPA session
  in current web browser and expire old session, if different user.

- For 2.11.4 (modified)
  Include part of 1.28 omitted from changes in 1.25.2.5.2.2

- Bug 6754 LON-CAPA as LTI Provider
  When session was launched via LTI (i.e., lti.login is 1), use & instead
  of & in query string part of URL so window.location.href will work.

- Modify rev. 1.52 changes so session migration can continue to be supported
  in non-deeplink cases.

- For 2.11.4 (modified)
  Disallow launch of Remote Control for access via deep-link

- For 2.11.4 (modified)
  Include changes in 1.58

- Bug 6907
  - When access is launched for a user from a deeplink, and user already has
    a session active, update required session information if the existing
    session was from a different launch, or was from normal login access.

- For 2.11.4 (modified)
  Include changes in 1.28 (part), 1.34, 1.36 (part), 1.44 (part),
  1.49 (part), 1.50 (part), 1.57

- Bug 6907
  - Domain default to determine whether LTI launch of deep-linked URL requires
    student to authenticate; can be overridden for specific course(s).
  - If domain config permits it, link protection setting in a course can
    specify whether to accept username included in LTI payload, and action
    to take if username is not for an enrolled student.
  - Second arg passed to ltiauth::invalid_request() is text string stating why
    LTI launch was invalid.

- For 2.11.4 (modified)
  Include changes in 1.42, 1.43, 1.51, 1.52, 1.53, 1.54

- For 2.11
  Backport 1.50 (part), 1.54 (part), 1.55

- Fix typos in comment

- Expire any existing public cookie (and session) when establishing a session
  for a migrated user.

- Bug 6907
  - Use of token to store linkprot or linkkey compatible with use of
    btoken and iptoken (for load balancing and IP change respectively).
  - Launching access from a deeplink, with its own ltoken and/or linkkey,
    for a user session originally launched from a different deeplink will
    update required session information.

- 0 is a valid linkkey.

- Bug 6907 Content in a course can be set to be deep-link only.
  - Support lti-based or key-based access control with SSO authentication.

- Bug 6907 Content in a course can be set to be deep-link only.
  Enforce link protection for lti-based or key-based access control.

- Bug 6914.
  Replace hostname with alias when creating absolute URLs, if alias in use.

- For 2.11
  Backport 1.49 (part)

- Retrieval of requestor's IP address centralized in lonnet::get_requestor_ip()
- Domain configuration to allow domain's LON-CAPA nodes to operate behind a
  WAF/Reverse Proxy using aliased hostname (CNAME).
- Web requests from other nodes bypass the WAF as their requests are made
  directly to the server hostname (A record); same for internal LON-CAPA
  connections for lonc -> lond.

- For 2.11
  Backport 1.48

- If $env{'request.balancercookie'} set for user's session, and switch made
  to a different node, update hostID in cookie on balancer node once migrated.

- Bug 6754 LON-CAPA as LTI provider.
  Load role for user with new role added following launch from LTI Consumer.

- For 2.11
  Backport 1.46

- Add domain configuration to offload users from other institutions, on next
  access (after recording any submission to a problem).
- Switching user session to a different server can jump to the same resource
  currently being viewed when encrypturl is in effect.

- For 2.11
  Backport 1.35, 1.45

- Domain config for load balancer to use cookie to record offload target.

- Bug 6754
  - Domain config for load balancer to use cookie to record offload target
    will apply when LON-CAPA is an LTI Provider, and launch URL is a load
    balancer.

- Bug 6400
  - Enforce access restrictions for content which is deeplink-only (users
    with "advanced priv for current role are exempt).
  - Support "key" link type in deeplink parameter (requested link must either
    be sent with linkkey as element in POSTed data, or with linkkey in query
    string).  Corresponding value must match key set in deeplink parameter.

- Bug 6400 Deep-linking
  - URLs like /adm/lti/tiny/domain/uniqueID can be used to restrict use of
    deep links to access from another LTI-enabled application (no user data
    passed in this context).

- Remove trailing whitespace

- Remove trailing whitespace

- Verify user can be hosted here.

- Remove trailing whitespace
- Support for multiple load balancers in a single domain
  - Repopulate $data{'offloadto'} list for different load balancer.

- Bug 6876 In case of connection failures between lonc on offload node(s)
  and other node(s) try switching to other offload nodes and balancer(s).

- Bug 6876
  If node switched to from balancer can't connect to lond on user's
  homeserver, then session is switched to another node in the original list
  of usable nodes sent by the balancer.

- Domain config for load balancer to use cookie to record offload target.
  Subsequent requests by same user/browser will send requests to same target
  if remote session still active, and remote node not overloaded.

- Use 'secure' attribute for session cookie on servers using Apache/SSL.

- Bug 6754 LON-CAPA as LTI Provider
  - If LTI Consumer does not provide 'launch_presentation_document_target'
    set $env{'request.lti.target'} to iframe, if LON-CAPA display in iframe.

- Bug 6754 LON-CAPA as LTI Provider
  - Creation of new LON-CAPA course available from an LTI Consumer.

- Bug 6754 LON-CAPA as LTI Provider
  - LTI launch can be for a published .sequence

- Bug 6754 LON-CAPA as LTI Provider
  - Display folder contents listing if LTI launch is for a sequence file.

- Bug 6754 LON-CAPA as LTI Provider
  - Original LTI launch of LON-CAPA is for a resource, a map, or an entire
    course, and display is for iframe, tab or window; retain this in %env.

- Bug 6754 LON-CAPA as LTI Provider
  If user is currently logged in, but not as an LTI log-in, log them out.

- Bug 6754 LON-CAPA as LTI Provider
  - Creation of new LON-CAPA user account available from an LTI Consumer.
  - Creation of new LON-CAPA course available from an LTI Consumer.
  - Self-enrollment in a LON-CAPA course available from an LTI Consumer.

- Bug 6754 LTI Integration: LON-CAPA as LTI Provider
  - Work in progress

- Domain Configuration for dedicated load balancer includes option to
  permit "Hosting on balancer itself".
- If balancer has lowest load, it will host the user session for a user
  logging in.

Bug 6675 (IP change detected in session migration).
- log when IP change detected.
- Include user's domain in query string if re-authentication uses /adm/login.

Bug 6675 (IP change detected in session migration).
- Additional option for both SSO user and non-SSO users
  - Session hosted (after re-authentication) on a specified server selected
    from servers belonging to domain's "internet domain".

Bug 6675 (IP change detected in session migration).
LON-CAPA domain configuration for multi-domain server set-ups.
 - Support configuration of loadbalancer server for both non-SSO users and
   SSO users for all LON-CAPA domains which are hosted on servers belonging
   to the balancer's "internet domain".

Bug 6675
- Changed client IP address when load balancing:
  Support option to host on Load Balancer itself, after re-authentication.

- Punctuation.

- $match_domain and $match_username in use.

- Bug 6675
- Case where $env{'REMOTE_ADDR'} as reported to server selected to host
  user session, is different from $env{'REMOTE_ADDR'} as reported to
  server which handled original authentication request.
  - Domain configuration for a load balancing server can be set to one of
    the following, if an IP mismatch is detected by /adm/migrateuser
    during credentials checking after redirect via /adm/switchserver
    (i) Session will be hosted on Load Balancer
    (ii) Session will be hosted on offload server
    for each of (a) SSO users from load balancer's domain, (b) non-SSO users
  - Setting to host on load balancer will be ignored if switch server was called
    by an author or co-author switching to server housing the authoring space.

- Use standard LON-CAPA separator for <username>:<domain>

- Bug 3987. Deep-linking.
- Preserve role and symb from query string in call to SSO authenticator.
  - Propagate to migrateuser when starting session.

- HTML documents uploaded directly to a course can be edited by a Course Coordinator (mdc priv).
- "Edit this resource" link displayed in inline menu.
- Link will switch server to course's home server if session is currently hoosted elsewehere (unless a lock is in place).

- Deep linking:
  - origurl and symb args can be included in query string for switchserver call, so switched session will go to the same resource on the new server.

Work in progress.
Logging needed: changes, and by whom.

- Incoming users authenticated by SSO may not always need to go to the roles screen.
- Add the following to a <Location $url> directive in loncapa_apache_conf:
PerlSetVar      ssodirecturl 1
for authenticated SSO users to go to $url after session initialization.

- exclude errors from hash returned by  &lonnet::tmpget().
- detect case where hash is empty where lonnet::tmpget() is called by migrateuser.pm and
  lonpreferences.pm

- common thorough validation of an existing user session

- if a user already has a cookie and its associated session file
  and they aren't asking for a specific role, then
        reuse the existing session info
        (redirecting them to either the roles screen or the navmaps screen
         (if they are already in a course))

Look for lonSSOReloginServer set in an apache conf file (e.g., sentinel.conf at MSU), so the "login again" link displayed on logout points to a SSO-enabled server if the user's login was originally SSO-authenticated.

- $extra_env is a has ref

- request.sso.login really really really gets set now on ssoed login

- preserve the fact that we ssoed in

- BUG#3254 - remote wasn't getting start when doing 'Switch Server'

- start_page

- del the tmp file after migrating the user

- switch server can now pick a destination server if one isn't specified
- migrate user can redirect to roles screen if no role specified

- migrateuser checks the input data more carefully
- tmpput and tmpget now have lonnet implementations

- 'switch server' now really does