File:  [LON-CAPA] / loncom / auth / migrateuser.pm
Revision 1.70: download - view: text, annotated - select for diffs
Sat Feb 10 14:53:30 2024 UTC (2 months, 3 weeks ago) by raeburn
Branches: MAIN
CVS tags: version_2_12_X, HEAD
- Bug 6907

    1: # The LearningOnline Network
    2: # Starts a user off based of an existing token.
    3: #
    4: # $Id: migrateuser.pm,v 1.70 2024/02/10 14:53:30 raeburn Exp $
    5: #
    6: # Copyright Michigan State University Board of Trustees
    7: #
    8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
    9: #
   10: # LON-CAPA is free software; you can redistribute it and/or modify
   11: # it under the terms of the GNU General Public License as published by
   12: # the Free Software Foundation; either version 2 of the License, or
   13: # (at your option) any later version.
   14: #
   15: # LON-CAPA is distributed in the hope that it will be useful,
   16: # but WITHOUT ANY WARRANTY; without even the implied warranty of
   17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   18: # GNU General Public License for more details.
   19: #
   20: # You should have received a copy of the GNU General Public License
   21: # along with LON-CAPA; if not, write to the Free Software
   22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
   23: #
   24: # /home/httpd/html/adm/gpl.txt
   25: #
   26: # http://www.lon-capa.org/
   27: #
   28: 
   29: package Apache::migrateuser;
   30: 
   31: use strict;
   32: use LONCAPA qw(:DEFAULT :match);
   33: use Apache::Constants qw(:common :http :methods :remotehost);
   34: use Apache::lonauth;
   35: use Apache::lonnet;
   36: use Apache::loncommon;
   37: use Apache::lonlocal;
   38: use Apache::lonlogin();
   39: use Apache::ltiauth;
   40: use Apache::switchserver;
   41: use CGI::Cookie;
   42: 
   43: sub goto_login {
   44:     my ($r,$domain,$data) = @_;
   45:     my $write_to_opener;
   46:     if (ref($data) eq 'HASH') {
   47:         $write_to_opener = $data->{'lcssowin'};
   48:     }
   49:     if ((ref($data) eq 'HASH') && ($data->{'lti.login'})) {
   50:         &Apache::ltiauth::invalid_request($r,'22');
   51:     } else {
   52:         &Apache::loncommon::content_type($r,'text/html');
   53:         $r->send_http_header;
   54:         my $url = '/adm/login';
   55:         if ($domain) {
   56:             $url .= '?domain='.$domain;
   57:         }
   58:         $r->print(&Apache::loncommon::start_page('Going to login',undef,
   59: 					         {'redirect' => [0,$url,'',$write_to_opener],}).
   60: 	          '<h1>'.&mt('One moment please...').'</h1>'.
   61: 	          '<p>'.&mt('Transferring to login page.').'</p>'.
   62: 	          &Apache::loncommon::end_page());
   63:     }
   64:     return OK;
   65: }
   66: 
   67: sub sso_check {
   68:     my ($data) = @_;
   69:     my %extra_env;
   70:     if (ref($data) eq 'HASH') {
   71:         if ($data->{'sso.login'}) {
   72:             $extra_env{'request.sso.login'} = $data->{'sso.login'};
   73:         }
   74:         if ($data->{'sso.reloginserver'}) {
   75:             $extra_env{'request.sso.reloginserver'} = 
   76:                 $data->{'sso.reloginserver'};
   77:         }
   78:     }
   79:     return \%extra_env;
   80: }
   81: 
   82: sub lti_check {
   83:     my ($data) = @_;
   84:     my %lti_env;
   85:     if (ref($data) eq 'HASH') {
   86:         if ($data->{'lti.login'}) {
   87:             $lti_env{'request.lti.login'} = $data->{'lti.login'};
   88:             if ($data->{'lti.reqcrs'}) {
   89:                 $lti_env{'request.lti.reqcrs'} = $data->{'lti.reqcrs'};
   90:             }
   91:             if ($data->{'lti.reqrole'}) {
   92:                 $lti_env{'request.lti.reqrole'} = $data->{'lti.reqrole'};
   93:             }
   94:             if ($data->{'lti.selfenrollrole'}) {
   95:                 $lti_env{'request.lti.selfenrollrole'} = $data->{'lti.selfenrollrole'};
   96:             }
   97:             if ($data->{'lti.uri'}) {
   98:                 $lti_env{'request.lti.uri'} = $data->{'lti.uri'};
   99:             }
  100:             if ($data->{'lti.target'}) {
  101:                 $lti_env{'request.lti.target'} = $data->{'lti.target'};
  102:             }
  103:             if ($data->{'lti.sourcecrs'}) {
  104:                 $lti_env{'request.lti.sourcecrs'} = $data->{'lti.sourcecrs'};
  105:             }
  106:         }
  107:         if ($data->{'lti.passbackid'}) {
  108:             $lti_env{'request.lti.passbackid'} = $data->{'lti.passbackid'};
  109:         }
  110:         if ($data->{'lti.passbackurl'}) {
  111:             $lti_env{'request.lti.passbackurl'} = $data->{'lti.passbackurl'};
  112:         }
  113:         if ($data->{'lti.rosterid'}) {
  114:             $lti_env{'request.lti.rosterid'} = $data->{'lti.rosterid'};
  115:         }
  116:         if ($data->{'lti.rosterurl'}) {
  117:             $lti_env{'request.lti.rosterurl'} = $data->{'lti.rosterurl'};
  118:         }
  119:     }
  120:     return \%lti_env;
  121: }
  122: 
  123: sub canhost {
  124:     my ($uname,$udom,$lonhost,$loncaparev) = @_;
  125:     my $canhost;
  126:     if (&Apache::lonnet::is_library($lonhost)) {
  127:         my @possdoms = &Apache::lonnet::current_machine_domains();
  128:         my %roleshash = &Apache::lonnet::get_my_roles($uname,$udom,'userroles','',['ca','aa'],\@possdoms);
  129:         if (keys(%roleshash)) {
  130:             foreach my $key (keys(%roleshash)) {
  131:                 my $audom = (split(/:/,$key))[1];
  132:                 if ((&Apache::lonnet::will_trust('othcoau',$udom,$audom)) &&
  133:                     (&Apache::lonnet::will_trust('coaurem',$audom,$udom))) {
  134:                     $canhost = 1;
  135:                     last;
  136:                 }
  137:             }
  138:         }
  139:     }
  140:     unless ($canhost) {
  141:         my $uprimary_id = &Apache::lonnet::domain($udom,'primary');
  142:         my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id);
  143:         my @intdoms;
  144:         my $internet_names = &Apache::lonnet::get_internet_names($lonhost);
  145:         if (ref($internet_names) eq 'ARRAY') {
  146:             @intdoms = @{$internet_names};
  147:         }
  148:         if ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) {
  149:             $canhost = 1;
  150:         } else {
  151:             my $hostname = &Apache::lonnet::hostname($lonhost);
  152:             my $serverhomeID = &Apache::lonnet::get_server_homeID($hostname);
  153:             my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID);
  154:             my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom);
  155:             my %udomdefaults = &Apache::lonnet::get_domain_defaults($udom);
  156:             $canhost =
  157:                 &Apache::lonnet::can_host_session($udom,$lonhost,$loncaparev,
  158:                                                   $udomdefaults{'remotesessions'},
  159:                                                   $defdomdefaults{'hostedsessions'});
  160:         }
  161:     }
  162:     return $canhost;
  163: }
  164: 
  165: sub ip_changed {
  166:     my ($r,$udom,$camefrom,$idsref,$dataref) = @_;
  167:     &Apache::loncommon::content_type($r,'text/html');
  168:     $r->send_http_header;
  169:     if (ref($dataref) eq 'HASH') {
  170:         my $title = 'LON-CAPA Session redirected';
  171:         my $message = &mt('Your internet address has changed since you logged in.');  
  172:         my $rule_in_effect;
  173:         if ($dataref->{'balancer'}) {
  174:             my $baldom = &Apache::lonnet::host_domain($camefrom);
  175:             my $balprimaryid = &Apache::lonnet::domain($baldom,'primary');
  176:             my $balintdom = &Apache::lonnet::internet_dom($balprimaryid);
  177:             my $uprimaryid = &Apache::lonnet::domain($udom,'primary'); 
  178:             my $uintdom = &Apache::lonnet::internet_dom($uprimaryid);
  179:             my $dom_in_use;
  180:             if (($uintdom ne '') && ($uintdom eq $balintdom)) {
  181:                 $dom_in_use = $udom;
  182:             } else {
  183:                 $dom_in_use = $baldom;
  184:             }
  185:             my ($result,$cached)=&Apache::lonnet::is_cached_new('loadbalancing',$dom_in_use);
  186:             unless (defined($cached)) {
  187:                 my $cachetime = 60*60*24; 
  188:                 my %domconfig =
  189:                     &Apache::lonnet::get_dom('configuration',['loadbalancing'],$dom_in_use);
  190:                 if (ref($domconfig{'loadbalancing'}) eq 'HASH') {
  191:                     $result = &Apache::lonnet::do_cache_new('loadbalancing',$dom_in_use,
  192:                                                             $domconfig{'loadbalancing'},$cachetime);
  193:                 }
  194:             }
  195:             if (ref($result) eq 'HASH') {
  196:                 (undef,my $currtargets,my $currrules) =
  197:                     &Apache::lonnet::check_balancer_result($result,$dataref->{'server'});
  198:                 if (ref($currrules) eq 'HASH') {
  199:                     if ($dataref->{'sso.login'}) {
  200:                         if ($currrules->{'_LC_ipchangesso'} ne '') {
  201:                             $rule_in_effect = $currrules->{'_LC_ipchangesso'};
  202:                         }
  203:                     } else {
  204:                         if ($currrules->{'_LC_ipchange'} ne '') {
  205:                             $rule_in_effect = $currrules->{'_LC_ipchange'};
  206:                         }
  207:                     }
  208:                 }
  209:             }
  210:         }
  211:         my $url;
  212:         my $lonhost= $r->dir_config('lonHostID');
  213:         my $switchto = $lonhost;
  214:         if ($rule_in_effect ne 'offloadedto') {
  215:             my ($hosthere,@ids);
  216:             if (ref($idsref) eq 'ARRAY') {
  217:                 @ids=@{$idsref};
  218:             }
  219:             unless ($rule_in_effect eq 'balancer') {
  220:                 if (grep(/^\Q$rule_in_effect\E$/,@ids)) {
  221:                     $hosthere = 1;
  222:                 }
  223:             }
  224:             unless ($hosthere) {
  225:                 if ($dataref->{'role'}) {
  226:                     my ($adom,$aname);
  227:                     if ($dataref->{'role'} =~ m{^au\./($match_domain)/$}) {
  228:                         $adom = $1;
  229:                         $aname = $dataref->{'username'};
  230:                     } elsif ($dataref->{'role'} =~ m{^(?:ca|aa)\./($match_domain)/($match_username)$}) {
  231:                         $adom = $1;
  232:                         $aname = $2;
  233:                     }
  234:                     if ($adom ne '' && $aname ne '') {
  235:                         my $ahome = &Apache::lonnet::homeserver($aname,$adom);
  236:                         unless ($ahome eq 'no_host') {
  237:                             if ($ahome && grep(/^\Q$ahome\E$/,@ids)) {
  238:                                 $hosthere = 1;
  239:                             }
  240:                         }
  241:                     }
  242:                 }
  243:             }
  244:             unless ($hosthere) {
  245:                 my $hostname;
  246:                 if ($rule_in_effect eq 'balancer') {
  247:                     $hostname = &Apache::lonnet::hostname($dataref->{'server'});
  248:                     if ($hostname) {
  249:                         $switchto = $dataref->{'server'};
  250:                     }
  251:                 } else {
  252:                     $hostname = &Apache::lonnet::hostname($rule_in_effect);
  253:                     if ($hostname) {
  254:                         $switchto = $rule_in_effect;
  255:                     }
  256:                 }
  257:                 if ($hostname) {
  258:                     my $protocol = $Apache::lonnet::protocol{$switchto};
  259:                     $protocol = 'http' if ($protocol ne 'https');
  260:                     my $alias = &Apache::lonnet::use_proxy_alias($r,$switchto);
  261:                     $hostname = $alias if ($alias ne '');
  262:                     $url = $protocol.'://'.$hostname;
  263:                     if ($rule_in_effect eq 'balancer') {
  264:                         $message .= '<br />'.
  265:                                     &mt('As a result, your LON-CAPA session is being redirected to the server where you originally logged in.');
  266:                     } else {
  267:                         $message .= '<br />'.
  268:                                     &mt('As a result, your LON-CAPA session is being redirected.');
  269:                     }
  270:                 }
  271:             }
  272:             unless ($hosthere) {
  273:                 if (($dataref->{'balancer'}) && ($dataref->{'balcookie'})) {
  274:                     &Apache::lonnet::delbalcookie($dataref->{'balcookie'},$dataref->{'balancer'});
  275:                 }
  276:             }
  277:         }
  278:         if ($dataref->{'sso.login'}) {
  279:             $url .= '/adm/roles';
  280:         } else {
  281:             $url .= '/adm/login';
  282:             if ($udom) {
  283:                 $url .= '?domain='.$udom;
  284:             }
  285:             $message .= '<br />'.&mt('You will need to provide your password one more time.');
  286:         }
  287:         my %info= (
  288:                     'domain'          => $udom,
  289:                     'username'        => $dataref->{'username'},
  290:                     'sessionserver'   => $lonhost,
  291:                   );
  292:         my @names = ('origurl','symb','role','linkprotuser','linkprotexit','linkprot','linkkey','linkprotpbid','linkprotpburl');
  293:         foreach my $name (@names) {
  294:             if ($dataref->{$name} ne '') {
  295:                 $info{$name} = $dataref->{$name};
  296:             }
  297:         }
  298:         if ($info{'origurl'} eq '/adm/email') {
  299:             if (($dataref->{'display'}) && ($dataref->{'mailrecip'})) {
  300:                 if (&unescape($dataref->{'mailrecip'}) eq $dataref->{'username'}.':'.$dataref->{'domain'}) {
  301:                     $info{'display'} = $dataref->{'display'};
  302:                     $info{'mailrecip'} = $dataref->{'mailrecip'};
  303:                 }
  304:             }
  305:         }
  306:         my $iptoken = &Apache::lonnet::tmpput(\%info,$switchto,'link');
  307:         unless ($iptoken eq 'conlost') {
  308:             $url .= (($url =~ /\?/) ? '&' : '?') . 'iptoken='.$iptoken;
  309:         }
  310:         $r->print(&Apache::loncommon::start_page($title,undef,
  311:                                                  {'redirect' =>
  312:                                                   [2,$url,'',$dataref->{'lcssowin'}],}).
  313:                   '<h1>'.&mt('One moment please...').'</h1>'.
  314:                   '<p class="LC_warning">'.$message.'</p>'.
  315:                   &Apache::loncommon::end_page());
  316:     } else {
  317:         return &goto_login($r);
  318:     }
  319:     return OK;
  320: }
  321: 
  322: sub logout {
  323:     my ($r,$ip,$handle,$data,$lti_env,$linkprot_info) = @_;
  324:     my $lonidsdir=$r->dir_config('lonIDsDir');
  325:     if (unlink("$lonidsdir/$handle.id")) {
  326:         if (($env{'user.linkedenv'} =~ /^[a-f0-9]+_linked$/) &&
  327:             (-l "$lonidsdir/$env{'user.linkedenv'}.id") &&
  328:             (readlink("$lonidsdir/$env{'user.linkedenv'}.id") eq "$lonidsdir/$handle.id")) {
  329:             unlink("$lonidsdir/$env{'user.linkedenv'}.id");
  330:         }
  331:     }
  332:     my %temp=('logout' => time);
  333:     &Apache::lonnet::put('email_status',\%temp);
  334:     &Apache::lonnet::log($env{'user.domain'},
  335:                          $env{'user.name'},
  336:                          $env{'user.home'},
  337:                          "Logout $ip");
  338: 
  339:     &Apache::loncommon::content_type($r,'text/html');
  340: 
  341:     #expire the cookies
  342:     my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
  343:     foreach my $name (keys(%cookies)) {
  344:         next unless ($name =~ /^lon(|S|Link|Pub)ID$/);
  345:         my $c = new CGI::Cookie(-name    => $name,
  346:                                 -value   => '',
  347:                                 -expires => '-10y',);
  348:         $r->headers_out->add('Set-cookie' => $c);
  349:     }
  350:     my $lonhost = $r->dir_config('lonHostID');
  351:     my ($url,$token,$delay,$write_to_opener,%info,%user_info);
  352:     if (ref($data) eq 'HASH') {
  353:         %user_info=('ip'       => $ip,
  354:                     'domain'   => $data->{'domain'},
  355:                     'username' => $data->{'username'},
  356:                     'home'     => $data->{'home'},
  357:                     'role'     => $data->{'role'},
  358:                     'origurl'  => $data->{'origurl'},
  359:                     'symb'     => $data->{'symb'},
  360:                     'server'   => $lonhost);
  361:         $write_to_opener = $data->{'lcssowin'};
  362:     }
  363:     $delay = 0.1;
  364:     if (ref($linkprot_info) eq 'HASH') {
  365:         if ($linkprot_info->{'linkprotuser'} ne '') {
  366:             $token = &Apache::lonnet::tmpput($linkprot_info,$lonhost);
  367:             $url = '/adm/login?ltoken='.$token;
  368:         } else {
  369:             foreach my $key (keys(%user_info)) {
  370:                 if ($user_info{$key} eq '') {
  371:                     delete($user_info{$key});
  372:                 }
  373:             }
  374:             %info = (%user_info,%{$linkprot_info});
  375:             $token = &Apache::lonnet::tmpput(\%info,$lonhost);
  376:             $url = '/adm/migrateuser?token='.$token;
  377:         }
  378:         $delay = 0;
  379:     } else {
  380:         my %lti_info;
  381:         if (ref($lti_env) eq 'HASH') {
  382:             foreach my $key (sort(keys(%{$lti_env}))) {
  383:                 if ($key =~ /^request\.(.+)$/) {
  384:                     $lti_info{$1} = $lti_env->{$key};
  385:                 }
  386:             }
  387:         }
  388:         %info = (%user_info,%lti_info);
  389:         $token = &Apache::lonnet::tmpput(\%info,$lonhost);
  390:         $url = '/adm/migrateuser?token='.$token;
  391:     }
  392:     $r->send_http_header;
  393:     $r->print(
  394:         &Apache::loncommon::start_page('Updating Session ...',undef,
  395:                                        {'redirect'       => [$delay,$url,'',$write_to_opener],
  396:                                         'only_body'      => 1,}).
  397:         &Apache::loncommon::end_page());
  398:     if ($env{'request.balancercookie'}) {
  399:         my ($balancer,$cookie) = split(/:/,$env{'request.balancercookie'});
  400:         if ((&Apache::lonnet::hostname($balancer)) && ($cookie =~ /^[a-f0-9]{32}$/)) {
  401:             $cookie = $env{'user.domain'}.'_'.$env{'user.name'}.'_'.$cookie;
  402:             &Apache::lonnet::delbalcookie($cookie,$balancer);
  403:         }
  404:     }
  405:     $r->register_cleanup(\&flush_course_logs);
  406:     return;
  407: }
  408: 
  409: sub conlost_userhome {
  410:     my ($r,$idsref,$dataref) = @_;
  411:     return unless ((ref($idsref) eq 'ARRAY') && (ref($dataref) eq 'HASH'));
  412:     my @ids = @{$idsref};
  413:     my %data = %{$dataref};
  414:     my ($lonhost,$lowest_load,$otherserver,$is_balancer,%conlost,%posstargets);
  415:     $lonhost = $r->dir_config('lonHostID');
  416:     if (grep(/^\Q$lonhost\E$/,split(/,/,$data{'dom_balancers'}))) {
  417:         $is_balancer = 1;
  418:     }
  419:     $lowest_load = 30000;
  420:     if ($data{'conlost'} ne '') {
  421:         map { $conlost{$_} = 1; } split(/,/,$data{'conlost'});
  422:     }
  423:     if ($data{'loncfail'}) {
  424:         if ($lonhost ne $data{'from_balancer'}) {
  425:             my ($is_balancer,$posshost,$setcookie,$offloadto,$dom_balancers) =
  426:                 &Apache::lonnet::check_loadbalancing($data{'username'},$data{'domain'});
  427:             if ($is_balancer) {
  428:                 if (ref($offloadto) eq 'HASH') {
  429:                     $data{'offloadto'} = '';
  430:                     foreach my $key (keys(%{$offloadto})) {
  431:                         if (ref($offloadto->{$key}) eq 'ARRAY') {
  432:                             $data{'offloadto'} .= $key.'='.join(',',@{$offloadto->{$key}}).'&';
  433:                         }
  434:                     }
  435:                     $data{'offloadto'} =~ s/\&$//;
  436:                 } elsif (ref($offloadto) eq 'ARRAY') {
  437:                     $data{'offloadto'} = join(',',@{$offloadto});
  438:                 }
  439:             }
  440:         }
  441:     } else {
  442:         $conlost{$lonhost} = 1;
  443:         $data{'conlost'} = join(',',sort(keys(%conlost)));
  444:     }
  445:     if ($data{'offloadto'} =~ /\&/) {
  446:         foreach my $item (split(/\&/,$data{'offloadto'})) {
  447:             my ($type,$targets) = split(/\=/,$item);
  448:             @{$posstargets{$type}} = split(/,/,$targets);
  449:         }
  450:     } elsif ($data{'offloadto'} =~ /=/) {
  451:         my ($type,$targets) = split(/\=/,$data{'offloadto'});
  452:         @{$posstargets{$type}} = split(/,/,$targets);
  453:     } else {
  454:         @{$posstargets{'default'}} = split(/,/,$data{'offloadto'});
  455:     }
  456:     if (ref($posstargets{'primary'}) eq 'ARRAY') {
  457:         foreach my $try_server (@{$posstargets{'primary'}}) {
  458:             next if ($conlost{$try_server});
  459:             next if ((grep(/^\Q$try_server\E$/,@ids)) && !$data{'loncfail'});
  460:             ($otherserver,$lowest_load) =
  461:                 &Apache::lonnet::compare_server_load($try_server,
  462:                                                      $otherserver,
  463:                                                      $lowest_load);
  464:         }
  465:     }
  466:     my $found_server = ($otherserver ne '' && $lowest_load < 100);
  467:     if (!$found_server) {
  468:         if (ref($posstargets{'default'}) eq 'ARRAY') {
  469:             foreach my $try_server (@{$posstargets{'default'}}) {
  470:                 next if ($conlost{$try_server});
  471:                 next if ((grep(/^\Q$try_server\E$/,@ids)) && !$data{'loncfail'});
  472:                 ($otherserver,$lowest_load) =
  473:                     &Apache::lonnet::compare_server_load($try_server,
  474:                                                          $otherserver,
  475:                                                          $lowest_load);
  476:             }
  477:         }
  478:     }
  479:     if ($otherserver ne '') {
  480:         my $switchto = &Apache::lonnet::hostname($otherserver);
  481:         if ($switchto ne '') {
  482:             $data{'server'} = $lonhost;
  483:             if ($data{'loncfail'}) {
  484:                 delete($data{'loncfail'});
  485:             }
  486:             if (grep(/^\Q$otherserver\E$/,split(/,/,$data{'dom_balancers'}))) {
  487:                 $data{'noloadbalance'} = $otherserver;
  488:             }
  489:             &do_server_switch($r,$otherserver,$switchto,$is_balancer,\%data);
  490:             return $otherserver;
  491:         } else {
  492:             #FIXME Contents of $data{offloadto} contains invalid hostID.
  493:         }
  494:     } else {
  495:         my (%poss_balancers,%tried_balancers);
  496:         map { $poss_balancers{$_} = 1; } split(/,/,$data{'dom_balancers'});
  497:         map { $tried_balancers{$_} = 1; } split(/,/,$data{'tried_balancers'});
  498:         if (keys(%poss_balancers)) {
  499:             foreach my $try_server (sort(keys(%poss_balancers))) {
  500:                 next if (grep(/^\Q$try_server\E$/,@ids));
  501:                 next if (($data{'loncfail'}) && ($tried_balancers{$try_server}));
  502:                 my $alreadytried;
  503:                 foreach my $key (keys(%posstargets)) {
  504:                     if ((ref($posstargets{$key}) eq 'ARRAY') &&
  505:                         (grep(/^\Q$try_server\E$/,@{$posstargets{$key}}))) {
  506:                         $alreadytried = 1;
  507:                         last;
  508:                     }
  509:                 }
  510:                 unless ($alreadytried) {
  511:                     if (&Apache::lonnet::reply('ping',$try_server) eq $try_server) {
  512:                         $otherserver = $try_server;
  513:                         last;
  514:                     }
  515:                 }
  516:             }
  517:         }
  518:         if ($otherserver ne '') {
  519:             my $switchto = &Apache::lonnet::hostname($otherserver);
  520:             if ($switchto ne '') {
  521:                 $data{'server'} = $lonhost;
  522:                 $data{'loncfail'} = $lonhost;
  523:                 $tried_balancers{$otherserver} = 1;
  524:                 $data{'tried_balancers'} = join(',',sort(keys(%tried_balancers)));
  525:                 &do_server_switch($r,$otherserver,$switchto,$is_balancer,\%data);
  526:                 return $otherserver;
  527:             } else {
  528:                 #FIXME Contents of $data{'dom_balancers'} contains invalid hostID.
  529:             }
  530:         } else {
  531:             if ($data{'loncfail'}) {
  532:                 #FIXME Nowhere to go. 
  533:             } else {
  534:                 # FIXME Send back to a balancer (no token); different balancer if this is a balancer.
  535:                 # Send command to balancer to exclude this host using http instead on lonc/lond
  536:             }
  537:         }
  538:     }
  539:     return;
  540: }
  541: 
  542: sub do_server_switch {
  543:     my ($r,$otherserver,$switchto,$is_balancer,$dataref) = @_;
  544:     if (ref($dataref) eq 'HASH') {
  545:         my $domain = $dataref->{'domain'};
  546:         my $username = $dataref->{'username'};
  547:         # If this is a balancer set a balancer cookie unless browser already sent
  548:         # LON-CAPA load balancer cookie which points at the target server.
  549:         if ($is_balancer) {
  550:             my $newcookieid;
  551:             my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r,1);
  552:             unless (($found_server eq $otherserver) &&
  553:                     ($balancer_cookie =~ /^\Q$domain\E_\Q$username\E_/)) {
  554:                 $newcookieid =
  555:                     &Apache::switchserver::balancer_cookieid($r,$otherserver,$username,$domain);
  556:                 if ($newcookieid) {
  557:                     $dataref->{'balcookie'} = $newcookieid;
  558:                 }
  559:             }
  560:         }
  561:         my $token = &Apache::lonnet::tmpput($dataref,$otherserver);
  562:         my $protocol = $Apache::lonnet::protocol{$otherserver};
  563:         $protocol = 'http' if ($protocol ne 'https');
  564:         my $url = $protocol.'://'.$switchto.'/adm/login?domain='.$domain.
  565:                                  '&amp;username='.$username.'&amp;token='.$token;
  566:         $r->send_http_header;
  567:         $r->print(
  568:         &Apache::loncommon::start_page('Switching Server ...',undef,
  569:                                        {'redirect'       => [0.1,$url]}).
  570:         &Apache::loncommon::end_page());
  571:     }
  572:     return;
  573: }
  574: 
  575: sub log_switch {
  576:     my ($r,$data,$lti_env,$ip) = @_;
  577:     my $lonhost = $r->dir_config('lonHostID');
  578:     return unless ((ref($data) eq 'HASH') && (ref($lti_env) eq 'HASH'));
  579:     my $now = time;
  580:     my %temp=('switchserver' => $now.':'.$lonhost,$data->{'role'});
  581:     &Apache::lonnet::put('email_status',\%temp);
  582:     my $logmsg = "Switch Server to $lonhost";
  583:     if ($data->{'role'}) {
  584:         $logmsg .= " with role: ".$data->{'role'};
  585:     } elsif (($lti_env->{'reqcrs'}) && ($lti_env->{'reqrole'} eq 'cc')) {
  586:         $logmsg .= " to create new LTI course";
  587:     } elsif ($lti_env->{'selfenrollrole'}) {
  588:         $logmsg .= " to selfenroll with role: ".$lti_env->{'selfenrollrole'};
  589:     } else {
  590:         $logmsg .= " (no role)";
  591:     }
  592:     $logmsg .= ' '.$ip;
  593:     &Apache::lonnet::log($data->{'domain'},$data->{'username'},$data->{'home'},$logmsg);
  594: }
  595: 
  596: sub flush_course_logs {
  597:     &Apache::lonnet::flushcourselogs();
  598:     return OK;
  599: }
  600: 
  601: sub handler {
  602:     my ($r) = @_;
  603:     
  604:     &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'},['token']);
  605:     my %data =   &Apache::lonnet::tmpget($env{'form.token'});
  606:     if (keys(%data) == 0) {
  607:         return &goto_login($r);
  608:     }
  609:     my $delete = &Apache::lonnet::tmpdel($env{'form.token'});
  610: 
  611:     &Apache::lonlocal::get_language_handle($r);
  612: 
  613:     if ($delete ne 'ok') {
  614: 	return &goto_login($r,undef,\%data);
  615:     }
  616: 
  617:     if (!defined($data{'username'}) || !defined($data{'domain'})) {
  618:         return &goto_login($r,undef,\%data);
  619:     }
  620:     my ($home,@ids);
  621:     @ids=&Apache::lonnet::current_machine_ids();
  622:     my $ip = &Apache::lonnet::get_requestor_ip($r,REMOTE_NOLOOKUP); 
  623:     if ($data{'ip'} ne $ip) {
  624:         &Apache::lonnet::logthis('IP change when session migration requested -- was: '.
  625:                  $data{'ip'}.'; now: '.$ip.' for '.$data{'username'}.':'.$data{'domain'});
  626: 	return &ip_changed($r,$data{'domain'},$data{'server'},\@ids,\%data);
  627:     }
  628:     if ($data{'loncfail'}) {
  629:         &Apache::lonnet::logthis('Returned from '.$data{'server'}.' -- no connection to library node or other access node(s)');
  630:         my $otherserver = &conlost_userhome($r,\@ids,\%data);
  631:         if ($otherserver ne '') {
  632:             &Apache::lonnet::logthis("Switching to $otherserver");
  633:         }
  634:         return OK;
  635:     } else {
  636:         $home=&Apache::lonnet::homeserver($data{'username'},$data{'domain'});
  637:         if ($home eq 'no_host') {
  638:             if (($data{'home'} ne '') && (&Apache::lonnet::hostname($data{'home'}))) {
  639:                 &Apache::lonnet::reconlonc($data{'home'});
  640:                 $home=&Apache::lonnet::homeserver($data{'username'},$data{'domain'});
  641:                 if ($home eq 'no_host') {
  642:                     unless (grep(/^\Q$data{'home'}\E$/,@ids)) {
  643:                         if (&Apache::lonnet::reply('ping',$data{'home'}) eq 'con_lost') {
  644:                             my $otherserver = &conlost_userhome($r,\@ids,\%data);
  645:                             if ($otherserver ne '') {
  646:                                 &Apache::lonnet::logthis("No connection to home server ($data{'home'}) for $data{'username'}:$data{'domain'}. Switching to $otherserver");
  647:                             }
  648:                             return OK;
  649:                         }
  650:                     }
  651:                 }
  652:             }
  653:         }
  654:     }
  655: 
  656:     my $udom;
  657:     if (&Apache::lonnet::domain($data{'domain'})) {
  658:         $udom=$data{'domain'};
  659:     }
  660:     if ($home eq 'no_host') { return &goto_login($r,$udom,\%data); }
  661:     if (&Apache::lonnet::hostname($home) eq '') { return &goto_login($r,$udom,\%data); }
  662: 
  663:     unless (grep(/^\Q$home\E$/,@ids)) {
  664:         my $lonhost = $r->dir_config('lonHostID');
  665:         my $loncaparev = $r->dir_config('lonVersion');
  666:         unless (&canhost($data{'username'},$data{'domain'},$lonhost,$loncaparev)) {
  667:             return &goto_login($r,$udom,\%data);
  668:         }
  669:     }
  670: 
  671:     my $rolemsg;
  672:     if ($data{'role'}) {
  673:         $rolemsg = "role: $data{'role'}";
  674:     } else {
  675:         $rolemsg = '(no role)';
  676:     }
  677: 
  678:     &Apache::lonnet::logthis("Allowing access for $data{'username'}:$data{'domain'} $rolemsg");
  679: 
  680:     my $sso_env = &sso_check(\%data);
  681:     my $lti_env = &lti_check(\%data);
  682: 
  683:     my $extra_env;
  684:     if ((ref($sso_env) eq 'HASH') && (keys(%{$sso_env}))) {
  685:         $extra_env = $sso_env;
  686:     } elsif ((ref($lti_env) eq 'HASH') && (keys(%{$lti_env}))) {
  687:         $extra_env = $lti_env;
  688:     }
  689:     if (($data{'balancer'}) && ($data{'server'}) && ($data{'balcookie'})) {
  690:         if (ref($extra_env) eq 'HASH') {
  691:             $extra_env->{'request.balancercookie'} = $data{'server'}.':'.$data{'balcookie'};
  692:         } else {
  693:             $extra_env = { 'request.balancercookie' => $data{'server'}.':'.$data{'balcookie'} };
  694:         }
  695:     } elsif (($data{'server'}) && ($data{'otherbalcookie'})) {
  696:         my ($balancer,$balcookie) = split(/:/,$data{'otherbalcookie'});
  697:         if (defined(&Apache::lonnet::hostname($balancer)) && $balcookie =~ /^[a-f0-9]{32}$/) {
  698:             my $baldom = &Apache::lonnet::host_domain($balancer);
  699:             if (&Apache::lonnet::shared_institution($baldom)) {
  700:                 my $cookieid = join('_',$udom,$data{'username'},$balcookie);
  701:                 &Apache::lonnet::updatebalcookie($cookieid,$balancer,$data{'server'});
  702:                 if (ref($extra_env) eq 'HASH') {
  703:                     $extra_env->{'request.balancercookie'} = $data{'otherbalcookie'};
  704:                 } else {
  705:                     $extra_env = { 'request.balancercookie' => $data{'otherbalcookie'} };
  706:                 }
  707:             }
  708:         }
  709:     }
  710: 
  711:     if (($data{'conlost'}) && ($data{'server'})) {
  712:         my @conlosts = split(/,/,$data{'conlost'});
  713:         my $switchfrom = $data{'server'};
  714:         if (@conlosts) {
  715:             if (grep(/^\Q$switchfrom\E$/,@conlosts)) {
  716:                 &log_switch($r,\%data,$extra_env,$ip);
  717:             }
  718:         }
  719:     }
  720: 
  721:     my (%form,$cid);
  722:     if ($data{'symb'} ne '') {
  723:         $form{'symb'} = $data{'symb'};
  724:     }
  725:     if ($data{'iptoken'} ne '') {
  726:         $form{'iptoken'} = $data{'iptoken'};
  727:     }
  728:     if ($data{'noloadbalance'} ne '') {
  729:         $form{'noloadbalance'} = $data{'noloadbalance'};
  730:     }
  731:     if ($data{'role'}) {
  732:         if ($data{'role'} =~ m{\./($match_domain)/($match_courseid)(?:/\w+|$)}) {
  733:             unless (&Apache::lonnet::homeserver($2,$1) eq 'no_host') {
  734:                 $cid = $1.'_'.$2;
  735:             }
  736:         }
  737:     } else {
  738:         my ($handle,$expirepub);
  739:         $handle = &Apache::lonnet::check_for_valid_session($r);
  740: 
  741: # For "public user" - remove any existing "public" cookie so actual user is logged in.
  742:         if ($handle) {
  743:             if ($handle=~/^publicuser\_/) {
  744:                 my $lonidsdir=$r->dir_config('lonIDsDir');
  745:                 if ($lonidsdir ne '') {
  746:                     unlink("$lonidsdir/$handle.id");
  747:                 }
  748:                 undef($handle);
  749:                 $expirepub = 1;
  750:             }
  751:         }
  752: 	if ($handle) {
  753: 	    &Apache::lonnet::transfer_profile_to_env($r->dir_config('lonIDsDir'),
  754: 						     $handle);
  755:             my ($checklaunch,$prevlaunch);
  756:             if ($data{'origurl'} =~ m{^/tiny/$match_domain/\w+$}) {
  757:                 unless ($env{'request.linkprot'} eq $data{'linkprot'}) {
  758:                     $checklaunch = 1;
  759:                 }
  760:                 unless ($env{'request.linkprotexit'} eq $data{'linkprotexit'}) {
  761:                     $checklaunch = 1;
  762:                 }
  763:                 unless ($env{'request.linkprotpbid'} eq $data{'linkprotpbid'}) {
  764:                     $checklaunch = 1;
  765:                 }
  766:                 unless ($env{'request.linkprotpburl'} eq $data{'linkprotpburl'}) {
  767:                     $checklaunch = 1;
  768:                 }
  769:                 unless ($env{'request.linkkey'} eq $data{'linkkey'}) {
  770:                     $checklaunch = 1;
  771:                 }
  772:                 unless ($env{'request.deeplink.login'} eq $data{'deeplink.login'}) {
  773:                     $checklaunch = 1;
  774:                 }
  775:             }
  776:             if ($data{'linkprot'} ne '') {
  777:                 if (($env{'user.name'} ne $data{'username'}) ||
  778:                     ($env{'user.domain'} ne $data{'domain'})) {
  779:                     my %linkprot_env;
  780:                     foreach my $item ('linkprot','linkprotexit','linkprotpbid','linkprotpburl','deeplink.login') {
  781:                         if ($data{$item}) {
  782:                             $linkprot_env{$item} = $data{$item};
  783:                         }
  784:                     }
  785:                     &logout($r,$ip,$handle,\%data,undef,\%linkprot_env);
  786:                     return OK;
  787:                 }
  788:                 &Apache::lonnet::appenv({'request.linkprot' => $data{'linkprot'}});
  789:                 if ($data{'linkprotexit'}) {
  790:                     &Apache::lonnet::appenv({'request.linkprotexit' => $data{'linkprotexit'}});
  791:                 }
  792:                 if ($env{'request.linkkey'}) {
  793:                     &Apache::lonnet::delenv('request.linkkey');
  794:                 }
  795:                 my ($linkprotector,$deeplink) = split(/:/,$data{'linkprot'},2);
  796:                 if ($env{'user.linkprotector'}) {
  797:                     my @protectors = split(/,/,$env{'user.linkprotector'});
  798:                     unless (grep(/^\Q$linkprotector\E$/,@protectors)) {
  799:                         push(@protectors,$linkprotector);
  800:                         @protectors = sort { $a <=> $b } @protectors;
  801:                         &Apache::lonnet::appenv({'user.linkprotector' => join(',',@protectors)});
  802:                     }
  803:                 } else {
  804:                     &Apache::lonnet::appenv({'user.linkprotector' => $linkprotector });
  805:                 }
  806:                 if ($env{'user.linkproturi'}) {
  807:                     my @proturis = split(/,/,$env{'user.linkproturi'});
  808:                     unless(grep(/^\Q$deeplink\E$/,@proturis)) {
  809:                         push(@proturis,$deeplink);
  810:                         @proturis = sort @proturis;
  811:                         &Apache::lonnet::appenv({'user.linkproturi' => join(',',@proturis)});
  812:                     }
  813:                 } else {
  814:                     &Apache::lonnet::appenv({'user.linkproturi' => $deeplink});
  815:                 }
  816:             } elsif ($data{'linkkey'} ne '') {
  817:                 &Apache::lonnet::appenv({'request.linkkey' => $data{'linkkey'}});
  818:                 if ($env{'request.linkprot'}) {
  819:                     &Apache::lonnet::delenv('request.linkprot');
  820:                 }
  821:                 my $deeplink = $data{'deeplink.login'};
  822:                 my $linkkey = $data{'linkkey'};
  823:                 if ($env{'user.deeplinkkey'} ne '') {
  824:                     my @linkkeys = split(/,/,$env{'user.deeplinkkey'});
  825:                     unless (grep(/^\Q$linkkey\E$/,@linkkeys)) {
  826:                         push(@linkkeys,$linkkey);
  827:                         &Apache::lonnet::appenv({'user.deeplinkkey' => join(',',sort(@linkkeys))});
  828:                     }
  829:                 } else {
  830:                     &Apache::lonnet::appenv({'user.deeplinkkey' => $linkkey});
  831:                 }
  832:                 if ($deeplink) {
  833:                     if ($env{'user.keyedlinkuri'}) {
  834:                         my @keyeduris = split(/,/,$env{'user.keyedlinkuri'});
  835:                         unless (grep(/^\Q$deeplink\E$/,@keyeduris)) {
  836:                             push(@keyeduris,$deeplink);
  837:                             &Apache::lonnet::appenv({'user.keyedlinkuri' => join(',',sort(@keyeduris))});
  838:                         }
  839:                     } else {
  840:                         &Apache::lonnet::appenv({'user.keyedlinkuri' => $deeplink});
  841:                     }
  842:                 }
  843:             }
  844:             if ($data{'deeplink.login'}) {
  845:                 &Apache::lonnet::appenv({'request.deeplink.login' => $data{'deeplink.login'}});
  846:             } elsif ($env{'request.deeplink.login'}) {
  847:                 $prevlaunch = $env{'request.deeplink.login'};
  848:             }
  849:             if ($data{'lti.login'}) {
  850:                 my $needslogout;
  851:                 if ($env{'request.lti.login'}) {
  852:                     if (($env{'user.name'} ne $data{'username'}) ||
  853:                         ($env{'user.domain'} ne $data{'domain'})) {
  854:                         $needslogout = 1;
  855:                     }
  856:                 } else {
  857:                     $needslogout = 1;
  858:                 }
  859: # If access is via LTI, and user already has a non-LTI session cookie 
  860: # (and session) or has an LTI session cookie for a different username,
  861: # logout the existing session, and start a new one
  862:                 if ($needslogout) {
  863:                     &logout($r,$ip,$handle,\%data,$lti_env);
  864:                 } elsif (($data{'lti.reqcrs'}) && ($data{'lti.reqrole'} eq 'cc')) {
  865:                     $form{'lti.reqcrs'} = $data{'lti.reqcrs'};
  866:                     $form{'lti.reqrole'} = $data{'lti.reqrole'};
  867:                     $form{'lti.sourcecrs'} = $data{'lti.sourcecrs'};
  868:                     $form{'lti.uri'} = $data{'lti.uri'};
  869:                     if ($data{'lti.passbackid'}) {
  870:                         $form{'lti.passbackid'} = $data{'lti.passbackid'};
  871:                     }
  872:                     if ($data{'lti.passbackurl'}) {
  873:                         $form{'lti.passbackurl'} = $data{'lti.passbackurl'};
  874:                     }
  875:                     if ($data{'lti.rosterid'}) {
  876:                         $form{'lti.rosterid'} = $data{'lti.rosterid'};
  877:                     }
  878:                     if ($data{'lti.rosterurl'}) {
  879:                         $form{'lti.rosterurl'} = $data{'lti.rosterurl'};
  880:                     }
  881:                     if ($data{'lti.target'}) {
  882:                         $form{'lti.target'} = $data{'lti.target'};
  883:                     }
  884:                     &Apache::loncommon::content_type($r,'text/html');
  885:                     $r->send_http_header;
  886:                     &Apache::ltiauth::lti_reqcrs($r,$data{'domain'},\%form,$data{'username'},$data{'domain'});
  887:                 } else {
  888:                     if (ref($lti_env) eq 'HASH') {
  889:                         delete($lti_env->{'reqcrs'});
  890:                         delete($lti_env->{'reqrole'});
  891:                         delete($lti_env->{'selfenrollrole'});
  892:                     }
  893:                     if ($data{'lti.selfenrollrole'}) {
  894:                         if (&Apache::ltiauth::lti_enroll($data{'username'},$data{'domain'},
  895:                                                          $data{'lti.selfenrollrole'}) eq 'ok') {
  896:                             my $url = '/adm/roles?selectrole=1&'.
  897:                                       &escape($data{'lti.selfenrollrole'}).'=1';
  898:                             if ($data{'origurl'} =~ m{/default_\d+\.sequence$}) {
  899:                                 $url .= '&orgurl='.$data{'origurl'}.'&navmap=1';
  900:                             } elsif ($data{'origurl'} ne '') {
  901:                                 $url .= '&orgurl='.$data{'origurl'};
  902:                             }
  903:                             if (ref($lti_env) eq 'HASH') {
  904:                                 &Apache::lonnet::appenv($lti_env);
  905:                             }
  906:                             $r->internal_redirect($url);
  907:                         } else {
  908:                             &Apache::ltiauth::invalid_request($r,23);
  909:                         }
  910:                     } elsif ($data{'origurl'} ne '') {
  911:                         my $url = $data{'origurl'};
  912:                         if ($url =~ m{/default_\d+\.sequence$}) {
  913:                             $url .= (($url =~/\?/)?'&':'?').'navmap=1';
  914:                         }
  915:                         if (ref($lti_env) eq 'HASH') {
  916:                             &Apache::lonnet::appenv($lti_env);
  917:                         }
  918:                         $r->internal_redirect($url);
  919:                     } else {
  920:                         if (ref($lti_env) eq 'HASH') {
  921:                             &Apache::lonnet::appenv($lti_env);
  922:                         }
  923:                     }
  924:                 }
  925:             } elsif ($data{'origurl'} ne '') {
  926:                 my $dest = $data{'origurl'};
  927:                 if (($env{'request.deeplink.login'} eq $data{'origurl'}) &&
  928:                     (($env{'request.linkprot'}) || ($env{'request.linkkey'} ne ''))) {
  929:                     my %info;
  930:                     if ($env{'request.linkprot'}) {
  931:                         $info{'linkprot'} = $env{'request.linkprot'};
  932:                         foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') {
  933:                             if ($data{$item}) {
  934:                                 $info{$item} = $data{$item};
  935:                             }
  936:                         }
  937:                     } elsif ($env{'request.linkkey'} ne '') {
  938:                         $info{'linkkey'} = $env{'request.linkkey'};
  939:                     }
  940:                     $info{'origurl'} = $data{'origurl'};
  941:                     if ($checklaunch) {
  942:                         $info{'checklaunch'} = 1;
  943:                     }
  944:                     if ($prevlaunch) {
  945:                         $info{'prevlaunch'} = $prevlaunch;
  946:                     }
  947:                     my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link');
  948:                     unless (($token eq 'con_lost') || ($token eq 'refused') || ($token =~ /^error:/) ||
  949:                             ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) {
  950:                         $dest .= (($dest =~ /\?/) ? '&' : '?') . 'ttoken='.$token;
  951:                     }
  952:                 }
  953:                 $r->internal_redirect($dest);
  954:             } elsif ($env{'request.course.id'}) {
  955:                 $r->internal_redirect('/adm/navmaps');
  956: 	    } else {
  957: 		$r->internal_redirect('/adm/roles');
  958: 	    }
  959: 	} else {
  960:             my $desturl = '/adm/roles';
  961:             if ($data{'lti.login'}) {
  962:                 if ($data{'lti.selfenrollrole'}) {
  963:                     $desturl .= '?selectrole=1&'.
  964:                                 &escape($data{'lti.selfenrollrole'}).'=1';
  965:                     if ($data{'origurl'} ne '') {
  966:                         $desturl .= '&orgurl='.$data{'origurl'};
  967:                         if ($data{'origurl'} =~ m{/default_\d+\.sequence$}) {
  968:                             $desturl .= '&navmap=1';
  969:                         }  
  970:                     }
  971:                 } elsif ($data{'origurl'} ne '') {
  972:                     $desturl = $data{'origurl'}; 
  973:                     if ($desturl =~ m{/default_\d+\.sequence$}) {
  974:                         $desturl .= (($desturl =~/\?/)?'&':'?').'navmap=1';
  975:                     }
  976:                 }
  977:             } elsif ($data{'origurl'} ne '') {
  978:                 $desturl = $data{'origurl'};
  979:                 if ($data{'linkprot'}) {
  980:                     my ($linkprotector,$linkuri) = split(/:/,$data{'linkprot'},2);
  981:                     if ($linkprotector) {
  982:                         if (ref($extra_env) eq 'HASH') {
  983:                             $extra_env->{'user.linkprotector'} = $linkprotector;
  984:                             $extra_env->{'user.linkproturi'} = $linkuri;
  985:                             $extra_env->{'request.linkprot'} = $data{'linkprot'};
  986:                         } else {
  987:                             $extra_env = {'user.linkprotector' => $linkprotector,
  988:                                           'user.linkproturi' => $linkuri,
  989:                                           'request.linkprot' => $data{'linkprot'}};
  990:                         }
  991:                         if ($data{'linkprotexit'}) {
  992:                             $extra_env->{'request.linkprotexit'} = $data{'linkprotexit'};
  993:                         }
  994:                         if ($data{'linkprotpbid'}) {
  995:                             $extra_env->{'request.linkprotpbid'} = $data{'linkprotpbid'};
  996:                         }
  997:                         if ($data{'linkprotpburl'}) {
  998:                             $extra_env->{'request.linkprotpburl'} = $data{'linkprotpburl'};
  999:                         }
 1000:                     }
 1001:                     foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') {
 1002:                         if ($data{$item} ne '') {
 1003:                             $form{$item} = $data{$item};
 1004:                         }
 1005:                     }
 1006:                 } elsif ($data{'linkkey'} ne '') {
 1007:                     if (ref($extra_env) eq 'HASH') {
 1008:                         $extra_env->{'user.deeplinkkey'} = $data{'linkkey'};
 1009:                         $extra_env->{'user.keyedlinkuri'} = $data{'deeplink.login'};
 1010:                         $extra_env->{'request.linkkey'} = $data{'linkkey'};
 1011:                      } else {
 1012:                         $extra_env = {'user.deeplinkkey' => $data{'linkkey'},
 1013:                                       'user.keyedlinkuri' => $data{'deeplink.login'},
 1014:                                       'request.linkkey' => $data{'linkkey'}};
 1015:                     }
 1016:                 }
 1017:                 if ($data{'deeplink.login'}) {
 1018:                    if (ref($extra_env) eq 'HASH') {
 1019:                         $extra_env->{'request.deeplink.login'} = $data{'deeplink.login'};
 1020:                     } else {
 1021:                         $extra_env = {'request.deeplink.login' => $data{'deeplink.login'}};
 1022:                     }
 1023:                 }
 1024:                 if ($desturl eq '/adm/email') {
 1025:                     if (($data{'display'}) && ($data{'mailrecip'})) {
 1026:                         if (&unescape($data{'mailrecip'}) eq "$data{'username'}:$data{'domain'}") {
 1027:                             $form{'display'} = &unescape($data{'display'});
 1028:                         }
 1029:                     }
 1030:                 }
 1031:             }
 1032:             my $skipcritical;
 1033:             if ($data{'lti.login'}) {
 1034:                 if ((($data{'lti.reqcrs'}) &&
 1035:                      ($data{'lti.reqrole'} eq 'cc')) ||
 1036:                     ($data{'lti.selfenrollrole'})) {
 1037:                     $skipcritical = 1;
 1038:                 }
 1039:             }
 1040: 	    &Apache::lonauth::success($r,$data{'username'},$data{'domain'},
 1041: 				      $home,$desturl,$extra_env,\%form,$skipcritical,'',
 1042:                                       $expirepub,$data{'lcssowin'});
 1043: 	}
 1044: 	return OK;
 1045:     }
 1046: 
 1047:     if ($data{'lti.login'}) {
 1048:         my $handle = &Apache::lonnet::check_for_valid_session($r);
 1049:         if ($handle) {
 1050:             &Apache::lonnet::transfer_profile_to_env($r->dir_config('lonIDsDir'),
 1051:                                                      $handle);
 1052:             my $needslogout;
 1053:             if ($env{'request.lti.login'}) {
 1054:                 if (($env{'user.name'} ne $data{'username'}) ||
 1055:                     ($env{'user.domain'} ne $data{'domain'})) {
 1056:                     $needslogout = 1;
 1057:                 }
 1058:             } else {
 1059:                 $needslogout = 1;
 1060:             }
 1061:             if ($needslogout) {
 1062:                 &logout($r,$ip,$handle,\%data,$lti_env);
 1063:                 return OK;
 1064:             }
 1065:         }
 1066:     }
 1067: 
 1068: # check if current user, and role match those expected.
 1069:     my ($next_url,$reuse_session);
 1070:     if (($env{'user.name'} eq $data{'username'}) && ($env{'user.domain'} eq $data{'domain'}) &&
 1071:         ($env{'request.role'} eq $data{'role'}) && ($data{'origurl'} ne '')) {
 1072:         $next_url = $data{'origurl'};
 1073:         $reuse_session = 1;
 1074:     } elsif ($data{'origurl'} =~ m{^/tiny/$match_domain/\w+$}) {
 1075:         $next_url=$data{'origurl'};
 1076:     } else {
 1077:         if ($data{'lti.login'}) {
 1078:             $next_url='/adm/roles?selectrole=1&'.&escape($data{'role'}).'=1';
 1079:             if ($data{'origurl'} ne '') {
 1080:                 $next_url .= '&orgurl='.&escape($data{'origurl'});
 1081:             }
 1082:         } else {
 1083:             $next_url='/adm/roles?selectrole=1&amp;'.&escape($data{'role'}).'=1';
 1084:             if ($data{'origurl'} ne '') {
 1085:                 $next_url .= '&amp;orgurl='.&escape($data{'origurl'});
 1086:             }
 1087:         }
 1088:     }
 1089:     if ($data{'lti.login'}) {
 1090:         if (($data{'origurl'} =~ m{/default_\d+\.sequence$}) ||
 1091:             ($data{'origurl'} =~ m{^/res/.+\.sequence$})) {
 1092:             if ($reuse_session) {
 1093:                 $next_url .= '&amp;navmap=1';
 1094:             } else {
 1095:                 $next_url .= '&navmap=1';
 1096:             }
 1097:         }
 1098:     }
 1099:     if ($reuse_session) {
 1100:         $r->internal_redirect($next_url);
 1101:     } else {
 1102:         if ($data{'deeplink.login'}) {
 1103:             if (ref($extra_env) eq 'HASH') {
 1104:                 $extra_env->{'request.deeplink.login'} = $data{'deeplink.login'};
 1105:             } else {
 1106:                 $extra_env = {'request.deeplink.login' => $data{'deeplink.login'}};
 1107:             }
 1108:             if ($data{'linkprot'}) {
 1109:                 $extra_env->{'request.linkprot'} = $data{'linkprot'};
 1110:                 if ($data{'linkprotexit'}) {
 1111:                     $extra_env->{'request.linkprotexit'} = $data{'linkprotexit'};
 1112:                 }
 1113:                 if ($data{'linkprotpbid'}) {
 1114:                     $extra_env->{'request.linkprotpassbid'} = $data{'linkprotpbid'};
 1115:                 }
 1116:                 if ($data{'linkprotpburl'}) {
 1117:                     $extra_env->{'request.linkprotpassburl'} = $data{'linkprotpburl'};
 1118:                 }
 1119:                 foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') {
 1120:                     if ($data{$item}) {
 1121:                         $form{'request.'.$item} = $data{$item};
 1122:                     }
 1123:                 }
 1124:             } elsif ($data{'linkkey'} ne '') {
 1125:                 $extra_env->{'request.linkkey'} = $data{'linkkey'};
 1126:             }
 1127:         }
 1128:         &Apache::lonauth::success($r,$data{'username'},$data{'domain'},$home,
 1129:                                   $next_url,$extra_env,\%form,'',$cid,'',$data{'lcssowin'});
 1130:     }
 1131:     return OK;
 1132: }
 1133: 
 1134: 1;
 1135: __END__

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>