CVS log for loncom/auth/switchserver.pm

Up to [LON-CAPA] / loncom / auth

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

- For 2.11.4 (modified)
  Include changes in 1.38, 1.39, 1.40, 1.49, 1.62 (part), 1.65.

- Bugs 6754 and 6907
  - Return of grades to launcher CMS supported for resources or folders
    accessed via LTI-mediated deep link.
  - Support option: "Encrypt stored consumer secrets defined in domain"
  - Signing of LTI payloads for roster retrieval, passback of grades,
    and callback to logput launcher CMS session all now occur on
    primary library server for course's domain.

- For 2.11.4 (modified)
  Include changes in 1.64

- For 2.11.4 (modified)
  Include changes in 1.63 (part).

- Support access to specific LON-CAPA message after login in cases where a
  LON-CAPA loadbalancer node is used as the portal for a domain.

- In course context, switch server to resource's home server opens new tab
  when editing published resource, and ca role is loaded,  when user's domain
  (by default) disallows session hosting of domain's users in resource's domain.
- New arg (skip_enc_check) in redirect args , used by loncommon::headtag()
  it true, omit application of check_encrypt().
- New seventh item ($shownsymb) in args for lonhtmlcommon::jump_to_editres()

- For 2.11.4 (modified)
  Include changes in 1.62

- Dual SSO and non-SSO login from /adm/login
  - Display of domain configuration for each server split into two tables
    so input textboxes can be longer.
  - "Pop-up if iframe" (Y/N) item added.  If Y, when login page is in an
    iframe, SSO log-in dialog will be displayed in a new window, i.e.,
    not within the iframe, e.g., to satisfy sameorigin requirement in
    x-frame-options in header sent by SSO server.

- For 2.11.4 (modified)
  Include changes in 1.60, 1.61

- Bug 6907
  "Exit Tool" button available to logout a session launched via deep link
  and escape iframe and redirect (for LTI-protected link).

- Bug 6907
  For LTI-protected deep links in which username is included in launch payload
  compare username in payload with username for any existing LON-CAPA session
  in current web browser and expire old session, if different user.

- For 2.11.4 (modified)
  Include changes in 1.47, 1.48, 1.57, 1.59

- For 2.11
  Backport 1.54, 1.55, 1.56, 1.58

- 0 is a valid linkkey.

- Remove unused scalar and duplicate line added in rev. 1.56

- Bug 6907
  - Deep-linking when user has an existing LON-CAPA session, need to support
    case where role change is not needed, but course session update needed to
    enforce link protection (lti-based or key-based access control).

- Support case where SSO is used on a LON-CAPA loadbalancer node.
  Optional lonSSOUserLogoutScriptFile PerlVar can be defined in the Apache
  config file (e.g. loncapa_apache_local.conf) e.g., to load custom javascript
  into the switchserver page to when switching. (e.g., an XMLHttpRequest call).

- Bug 6914.
  Replace hostname with alias when creating absolute URLs, if alias in use.

- Bug 6914
 - Check whether WAF proxy alias should be used when using switchserver.
 - Requests for /adm/dns/hosts and /adm/dns/domain from other nodes in the
   network do not require redirecting to an alias (if in use).

- For 2.11
  Backport 1.52, 1.53

- Retrieval of requestor's IP address centralized in lonnet::get_requestor_ip()

- Retrieval of requestor's IP address centralized in lonnet::get_requestor_ip()
- Domain configuration to allow domain's LON-CAPA nodes to operate behind a
  WAF/Reverse Proxy using aliased hostname (CNAME).
- Web requests from other nodes bypass the WAF as their requests are made
  directly to the server hostname (A record); same for internal LON-CAPA
  connections for lonc -> lond.

- For 2.11
  Include one change in backport of 1.51 omitted in rev. 1.35.2.3

- For 2.11
  Backport 1.50, 1.51

- If $env{'request.balancercookie'} set for user's session, and switch made
  to a different node, update hostID in cookie on balancer node once migrated.

- For non-SSO login on a balancer node, check for balancer cookie in lonauth.pm
  after login credentials validated. (Same as lonacc::sso_login for SSO login).
- Not all calls to check_loadbalancing() require determination of a server
  to which to offload, even when $is_balancer is true.

- For 2.11
  Backport 1.36, 1.41

- For 2.11
  Backport 1.42, 1.44, 1.45

- Bug 6754
  - Domain config for load balancer to use cookie to record offload target
    will apply when LON-CAPA is an LTI Provider, and launch URL is a load
    balancer.

- Bug 6400
  - Enforce access restrictions for content which is deeplink-only (users
    with "advanced priv for current role are exempt).
  - Support "key" link type in deeplink parameter (requested link must either
    be sent with linkkey as element in POSTed data, or with linkkey in query
    string).  Corresponding value must match key set in deeplink parameter.

- Bug 6400 Deep-linking
  - URLs like /adm/lti/tiny/domain/uniqueID can be used to restrict use of
    deep links to access from another LTI-enabled application (no user data
    passed in this context).

- Trust settings
  - Fix logic for checking whether co-author role admissible
  - Correct key for: "Co-author roles for this domain's users elsewhere".

- Cookie creation moved to &balancer_cookieid() to facilitate re-use.

- Use of Apache::lonmenu::close() was eliminated in rev. 1.23

- Bug 6876
  If node switched to from balancer can't connect to lond on user's
  homeserver, then session is switched to another node in the original list
  of usable nodes sent by the balancer.

- Domain config for load balancer to use cookie to record offload target.
  Subsequent requests by same user/browser will send requests to same target
  if remote session still active, and remote node not overloaded.

- Use 'secure' attribute for session cookie on servers using Apache/SSL.

- Bug 6754 LON-CAPA as LTI Provider
  - Original LTI launch of LON-CAPA is for a resource, a map, or an entire
    course, and display is for iframe, tab or window; retain this in %env.

- Bug 6754 LON-CAPA as LTI Provider
  - Creation of new LON-CAPA user account available from an LTI Consumer.
  - Creation of new LON-CAPA course available from an LTI Consumer.
  - Self-enrollment in a LON-CAPA course available from an LTI Consumer.

- Bug 6754 LTI Integration: LON-CAPA as LTI Provider
  - Work in progress

- Take into account trust settings for:
  - othcoau ("Co-author roles in this domain for others")
  - coaurem ("Co-author roles for this domain's users elsewhere")
  when displaying "Switch Server" link to Authoring Space's home server,
  and whether to skip check for ability to host a user on a remote server.

- Use 'secure' attribute for session cookie on servers using Apache/SSL.

- If requested role is not an active role assisgned to the user, delete role
  form item and allow switch to the otherserver, instead of returning a 403.

- Make switch server entries in a user's activity.log file less confusing
  by only including the phrase "with role", if a role was passed to
  /adm/switchserver.

- Replace two instances of protocols statically defined as http with
  protocol retrieved from value for key for target host, as defined in
  %Apache::lonnet::protocol.

- Bug 6675
- Case where $env{'REMOTE_ADDR'} as reported to server selected to host
  user session, is different from $env{'REMOTE_ADDR'} as reported to
  server which handled original authentication request.
  - Domain configuration for a load balancing server can be set to one of
    the following, if an IP mismatch is detected by /adm/migrateuser
    during credentials checking after redirect via /adm/switchserver
    (i) Session will be hosted on Load Balancer
    (ii) Session will be hosted on offload server
    for each of (a) SSO users from load balancer's domain, (b) non-SSO users
  - Setting to host on load balancer will be ignored if switch server was called
    by an author or co-author switching to server housing the authoring space.

- Backport 1.31.

- Bug 6436.  Typo in regexp added in rev 1.28 so switching server to the
  home server for Construction Space for: ca or aa role takes precedence
  over any session hosting restictions.

- Backport 1.30.

- Move lonnet::flushcourselogs() call to cleanup phase, so delivery of
  content to user is not delayed.

- Backport 1.29.

- lonnet::get_internet_names() returns a reference to an array.

- For 2.10, reverse changes in 1.23, 1.24 and 1.25.
  - Remote Control still retained for LON-CAPA 2.10.

- Switching server to the home server for Construction Space for:
  co-author or assistannt co-author role
  takes precedence over anysession hosting restictions which
  may apply to the user's domain.

- Control hosting of user sessions.
  - To accommodate multi-domain library servers, use internet domain names (e.g., msu.edu)
    instead of LON-CAPA domains in interface DC uses to set options for session hosting.

  - Provide mechanism to retrieve lonHostID for a hostname, so we can tell which
    domain determines session hosting config for external users on a multi-domain
    machine.

  - New routines in lonnet.pm:
     &get_server_homeID()  -- gets lonHostID for a hostname
     &internet_dom() -- gets internet domain name for a LON-CAPA Host ID
     &get_internet_names() -- gets internet domain names for all domains
                              for a server given one of the LC host IDs for the server.

   - New file in /home/httpd/lonTabs:
     - serverhomeIDs.tab (populated by loncron). : paired hostname:lonHostID

   - New subroutine in loncron: &write_serverhomeIDs() -- populates serverhomeIDs.tab
   - New subroutine in lond: &server_homeID_handler() -- returns LON-CAPA Host ID of server
   - New scalar in lond: $clienthomedom -- set to domain of LON-CAPA Host ID of client
   - New subroutine in domainprefs.pm: &build_location_hashes()
       -- used to set up options for session hosting as internet domain names
           - where two names (e.g., msu.edu, loncapa.org) are controlled by the same
             institution these will receive a single checkbox.

- Following the switch to 2.10, domains may prefer that their users do not have sessions hosted on older versions of LON-CAPA.
- Domain Coordinators can control:
  (a) where their users may have sessions hosted (by domain and/or LON-CAPA version).
  (b) which other domains will have user sessions hosted on servers in the domain.

In process of removing remote control, remote navmap and different icon modes code
- removed no_inline_link argument from loncommon::start_page, loncommon::bodytag
- removed subs
    o loncommon::head: it wasn't used
    o loncommon::endheadtag: functionality now covered by loncommon::headtag
    o lonmenu::registerurl: functionality moved to loncommon::headtag, because it was the only function that called registerurl
- removed remote control related translations in de.pm
- refactoring and cleanup

In process of removing remote control, remote navmap and different icon modes code
- mostly remote navmap related code and files removed
- some minor refactoring
- some translations added/removed

In process of removing remote control, remote navmap and different icon modes code
Also some minor refactoring.

- HTML documents uploaded directly to a course can be edited by a Course Coordinator (mdc priv).
- "Edit this resource" link displayed in inline menu.
- Link will switch server to course's home server if session is currently hoosted elsewehere (unless a lock is in place).

- Deep linking:
  - origurl and symb args can be included in query string for switchserver call, so switched session will go to the same resource on the new server.

Work in progress.
Logging needed: changes, and by whom.

- xhtml

- BUG#5519 - switch server was outputing headers twice

- don't insert an extra / into public redirects

- use the check_for_valid session code

- when offloading a user session to a different server, check the remote
  servers for an existing session and pick one of those first
  - new lond command that checks if a session file exists for a specific user
  - new lonnet routines to probe servers for one

Use redirect arg in call to start_page so there is a "Continue" link as well as the meta refresh.

- remove changes that affected the monitoring script

- public users it switch ed just need redirecting, not full switchservering

- starting work on moving to distributed DNS, eliminate usage of the lonnet hostanme global

- BUG#5212 unset the cookie when logging out.

Look for lonSSOReloginServer set in an apache conf file (e.g., sentinel.conf at MSU), so the "login again" link displayed on logout points to a SSO-enabled server if the user's login was originally SSO-authenticated.

- swithc to using helper cleaing functions and helper matchi re

- don't need the inline link when switching servers

- preserve the fact that we ssoed in

- start_page

- BUG #4524 swtchserver works in a backward to 2.0 and before manner

-making switchserver work when something has already loaded the env

- switch server can now pick a destination server if one isn't specified
- migrate user can redirect to roles screen if no role specified

- migrateuser checks the input data more carefully
- tmpput and tmpget now have lonnet implementations

- removing some debug

- 'switch server' now really does