--- loncom/auth/switchserver.pm 2007/09/08 02:43:33 1.16
+++ loncom/auth/switchserver.pm 2021/01/03 23:53:15 1.53
@@ -1,7 +1,7 @@
# The LearningOnline Network
# Switch Servers Handler
#
-# $Id: switchserver.pm,v 1.16 2007/09/08 02:43:33 raeburn Exp $
+# $Id: switchserver.pm,v 1.53 2021/01/03 23:53:15 raeburn Exp $
#
# Copyright Michigan State University Board of Trustees
#
@@ -31,9 +31,10 @@ package Apache::switchserver;
use strict;
use Apache::Constants qw(:common);
use Apache::lonnet;
-use Apache::lonmenu;
+use Digest::MD5 qw(md5_hex);
use CGI::Cookie();
use Apache::lonlocal;
+use LONCAPA qw(:DEFAULT :match);
sub init_env {
my ($r) = @_;
@@ -42,35 +43,56 @@ sub init_env {
return $env{'user.environment'};
}
my $requrl=$r->uri;
- my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
- my $lonid=$cookies{'lonID'};
- my $cookie;
- if (!$lonid) { return undef; }
-
- my $handle=&LONCAPA::clean_handle($lonid->value);
- my $lonidsdir=$r->dir_config('lonIDsDir');
- if ((!-e "$lonidsdir/$handle.id") || ($handle eq '')) {
- $r->log_reason("Cookie $handle not valid", $r->filename);
+ my $handle= &Apache::lonnet::check_for_valid_session($r);
+ if ($handle ne '') {
return undef;
}
-
+ my $lonidsdir=$r->dir_config('lonIDsDir');
&Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle);
-
+
return $r->dir_config('lonIDsDir')."/$handle.id";
}
sub do_redirect {
my ($r,$url,$only_body,$extra_text) = @_;
$r->send_http_header;
+ my $delay = 0.5;
+ if ($only_body) {
+ $delay = 0;
+ }
my $start_page =
&Apache::loncommon::start_page('Switching Server ...',undef,
- {'redirect' => [0.5,$url],
- 'no_inline_link' => 1,
+ {'redirect' => [$delay,$url],
'only_body' => $only_body,});
my $end_page = &Apache::loncommon::end_page();
$r->print($start_page.$extra_text.$end_page);
+ unless ($env{'user.name'} eq 'public' && ($env{'user.domain'} eq 'public')) {
+ $r->register_cleanup(\&flush_course_logs);
+ }
return OK;
+}
+
+sub balancer_cookieid {
+ my ($r,$desthost,$uname,$udom) = @_;
+ my @hosts = &Apache::lonnet::current_machine_ids();
+ my $newcookieid;
+ unless (grep(/^\Q$desthost\E$/,@hosts)) {
+ my $balancedir=$r->dir_config('lonBalanceDir');
+ $newcookieid = &md5_hex(&md5_hex(time.{}.rand().$$));
+ my $cookie = $udom.'_'.$uname.'_'.$newcookieid;
+ my $balcookie = "balanceID=$cookie; path=/; HttpOnly;";
+ if (open(my $fh,'>',"$balancedir/$cookie.id")) {
+ print $fh $desthost;
+ close($fh);
+ $r->headers_out->add('Set-cookie' => $balcookie);
+ }
+ }
+ return $newcookieid;
+}
+sub flush_course_logs {
+ &Apache::lonnet::flushcourselogs();
+ return OK;
}
sub handler {
@@ -80,69 +102,246 @@ sub handler {
if (!defined($handle)) { return FORBIDDEN; }
&Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'},
- ['otherserver','role']);
+ ['otherserver','role','origurl','symb']);
my $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'});
- if (!$env{'form.otherserver'}) {
- $env{'form.otherserver'}=&Apache::lonnet::spareserver(30000,undef,1);
+ if (! $env{'form.otherserver'}) {
+ $env{'form.otherserver'} =
+ &Apache::lonnet::find_existing_session($env{'user.domain'},
+ $env{'user.name'});
+ if (! $env{'form.otherserver'}) {
+ $env{'form.otherserver'} =
+ &Apache::lonnet::spareserver(30000,undef,1);
+ }
$switch_to=&Apache::lonnet::hostname($env{'form.otherserver'});
}
if (!defined($switch_to)) { return FORBIDDEN; }
+ my $protocol = 'http';
+ if ($env{'form.otherserver'}) {
+ if ($Apache::lonnet::protocol{$env{'form.otherserver'}} eq 'https') {
+ $protocol = $Apache::lonnet::protocol{$env{'form.otherserver'}};
+ }
+ }
+
if ($env{'user.name'} eq 'public'
&& $env{'user.domain'} eq 'public') {
- my $url = 'http://'.$switch_to.'/'.$r->uri;
+ my $url = $protocol.'://'.$switch_to.$r->uri;
+ unlink($handle);
+ #expire the cookie
+ my $c = new CGI::Cookie(-name => 'lonPubID',
+ -value => '',
+ -expires => '-10y',);
+ $r->header_out('Set-cookie' => $c);
return &do_redirect($r,$url,1)
}
- if ($env{'form.role'} &&
- !exists($env{'user.role.'.$env{'form.role'}})) { return FORBIDDEN; }
+ my $skip_canhost_check = '';
+ my $now = time;
+ if ($env{'form.role'}) {
+ if (!exists($env{'user.role.'.$env{'form.role'}})) {
+ delete($env{'form.role'});
+ } else {
+ my ($start,$end) = split(/\./,$env{'user.role.'.$env{'form.role'}});
+ if (($start && $start > $now) || ($end && $end < $now)) {
+ delete($env{'form.role'});
+ } elsif ($env{'form.role'} eq 'au./'.$env{'user.domain'}.'/') {
+ if (&Apache::lonnet::homeserver($env{'user.name'},$env{'user.domain'}) eq $env{'form.otherserver'}) {
+ $skip_canhost_check = 1;
+ }
+ } elsif ($env{'form.role'} =~ m{^[ac]a\./($match_domain)/($match_username)$}) {
+ my ($audom,$auname) = ($1,$2);
+ if (&Apache::lonnet::homeserver($auname,$audom) eq $env{'form.otherserver'}) {
+ if ((&Apache::lonnet::will_trust('othcoau',$env{'user.domain'},$audom)) &&
+ (&Apache::lonnet::will_trust('coaurem',$audom,$env{'user.domain'}))) {
+ $skip_canhost_check = 1;
+ }
+ }
+ }
+ }
+ }
+
+ unless ($skip_canhost_check) {
+ my $canhost = 1;
+ my $uprimary_id = &Apache::lonnet::domain($env{'user.domain'},'primary');
+ my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id);
+ my @intdoms;
+ my $internet_names = &Apache::lonnet::get_internet_names($env{'form.otherserver'});
+ if (ref($internet_names) eq 'ARRAY') {
+ @intdoms = @{$internet_names};
+ }
+ unless ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) {
+ my $serverhomeID = &Apache::lonnet::get_server_homeID($switch_to);
+ my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID);
+ my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom);
+ my %udomdefaults = &Apache::lonnet::get_domain_defaults($env{'user.domain'});
+ my $remoterev = &Apache::lonnet::get_server_loncaparev($env{'user.domain'},$env{'form.otherserver'});
+ $canhost =
+ &Apache::lonnet::can_host_session($env{'user.domain'},
+ $env{'form.otherserver'},
+ $remoterev,
+ $udomdefaults{'remotesessions'},
+ $defdomdefaults{'hostedsessions'});
+ }
+ unless ($canhost) { return FORBIDDEN; }
+ }
#remove session env, and log event
- unlink($handle);
- my %temp=('switchserver' => time.':'.$env{'form.otherserver'},
+ if (unlink($handle)) {
+ if ($env{'user.linkedenv'} ne '') {
+ my $lonidsdir=$r->dir_config('lonIDsDir');
+ if (($env{'user.linkedenv'} =~ /^[a-f0-9]+_linked$/) &&
+ (-l "$lonidsdir/$env{'user.linkedenv'}.id") &&
+ (readlink("$lonidsdir/$env{'user.linkedenv'}.id") eq $handle)) {
+ unlink("$lonidsdir/$env{'user.linkedenv'}.id");
+ }
+ }
+ }
+ my %temp=('switchserver' => $now.':'.$env{'form.otherserver'},
$env{'form.role'});
&Apache::lonnet::put('email_status',\%temp);
+ my $logmsg = "Switch Server to $env{'form.otherserver'}";
+ if ($env{'form.role'}) {
+ $logmsg .= " with role: $env{'form.role'}";
+ } elsif (($env{'form.lti.reqcrs'}) && ($env{'form.lti.reqrole'} eq 'cc')) {
+ $logmsg .= " to create new LTI course";
+ } elsif ($env{'form.lti.selfenrollrole'}) {
+ $logmsg .= " to selfenroll with role: $env{'form.lti.selfenrollrole'}";
+ } else {
+ $logmsg .= " (no role)";
+ }
+ my $ip = &Apache::lonnet::get_requestor_ip();
+ $logmsg .= ' '.$ip;
&Apache::lonnet::log($env{'user.domain'},$env{'user.name'},
- $env{'user.home'},
- "Switch Server to $env{'form.otherserver'} with role $env{'form.role'} $ENV{'REMOTE_ADDR'}");
+ $env{'user.home'},$logmsg);
&Apache::loncommon::content_type($r,'text/html');
- #expire the cookie
- my $c = new CGI::Cookie(-name => 'lonID',
- -value => '',
- -expires => '-10y',);
- $r->header_out('Set-cookie' => $c);
- $r->send_http_header;
- return OK if $r->header_only;
+ #expire the cookies
+ my %cookies=CGI::Cookie->parse($r->header_in('Cookie'));
+ foreach my $name (keys(%cookies)) {
+ next unless ($name =~ /^lon(|S|Link|Pub)ID$/);
+ my $c = new CGI::Cookie(-name => $name,
+ -value => '',
+ -expires => '-10y',);
+ $r->headers_out->add('Set-cookie' => $c);
+ }
+ if ($r->header_only) {
+ $r->send_http_header;
+ return OK;
+ }
# -------------------------------------------------------- Menu script and info
-
- my $windowinfo=
- &Apache::lonmenu::close().
- &Apache::lonnavmaps::close();
+
# ---------------------------------------------------------------- Get handover
- my %info=('ip' => $ENV{'REMOTE_ADDR'},
- 'domain' => $env{'user.domain'},
- 'username' => $env{'user.name'},
- 'role' => $env{'form.role'},
- 'server' => $r->dir_config('lonHostID'));
+ my ($is_balancer,$setcookie,$newcookieid,$otherbalcookie,$offloadto,$dom_balancers);
+ my $only_body = 0;
+ ($is_balancer,undef,$setcookie,$offloadto,$dom_balancers) =
+ &Apache::lonnet::check_loadbalancing($env{'user.name'},$env{'user.domain'},'switchserver');
+ if ($is_balancer && $setcookie && $env{'form.otherserver'}) {
+
+ # Set a balancer cookie unless browser already sent LON-CAPA load balancer
+ # cookie which points at the target server
+ my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r,1);
+
+ if (($found_server eq $env{'form.otherserver'}) &&
+ ($balancer_cookie =~ /^\Q$env{'user.domain'}\E_\Q$env{'user.name'}\E_/)) {
+ $only_body = 1;
+ } else {
+ $newcookieid = &balancer_cookieid($r,$env{'form.otherserver'},
+ $env{'user.name'},$env{'user.domain'});
+ }
+ }
+ if ((!$is_balancer) && ($env{'request.balancercookie'})) {
+ $otherbalcookie = $env{'request.balancercookie'};
+ }
+
+ my %info=('ip' => $ip,
+ 'domain' => $env{'user.domain'},
+ 'username' => $env{'user.name'},
+ 'home' => $env{'user.home'},
+ 'role' => $env{'form.role'},
+ 'server' => $r->dir_config('lonHostID'),
+ 'balancer' => $is_balancer,
+ 'dom_balancers' => $dom_balancers,
+ 'offloadto' => '');
+ if (ref($offloadto) eq 'HASH') {
+ foreach my $key (keys(%{$offloadto})) {
+ if (ref($offloadto->{$key}) eq 'ARRAY') {
+ $info{'offloadto'} .= $key.'='.join(',',@{$offloadto->{$key}}).'&';
+ }
+ }
+ $info{'offloadto'} =~ s/\&$//;
+ } elsif (ref($offloadto) eq 'ARRAY') {
+ $info{'offloadto'} = join(',',@{$offloadto});
+ }
+ if ($newcookieid) {
+ $info{'balcookie'} = $newcookieid;
+ } elsif ($otherbalcookie) {
+ $info{'otherbalcookie'} = $otherbalcookie;
+ }
+ if ($env{'form.origurl'}) {
+ $info{'origurl'} = $env{'form.origurl'};
+ }
+ if ($env{'form.symb'}) {
+ $info{'symb'} = $env{'form.symb'};
+ }
if ($env{'request.sso.login'}) {
$info{'sso.login'} = $env{'request.sso.login'};
}
if ($env{'request.sso.reloginserver'}) {
$info{'sso.reloginserver'} = $env{'request.sso.reloginserver'};
}
+ if ($env{'request.linkprot'}) {
+ $info{'linkprot'} = $env{'request.linkprot'};
+ }
+ if ($env{'request.deeplink.login'}) {
+ $info{'deeplink.login'} = $env{'request.deeplink.login'};
+ if ($env{'request.linkkey'}) {
+ $info{'linkkey'} = $env{'request.linkkey'};
+ }
+ }
+ if ($env{'request.lti.login'}) {
+ $info{'lti.login'} = $env{'request.lti.login'};
+ }
+ if ($env{'request.lti.uri'}) {
+ $info{'lti.uri'} = $env{'request.lti.uri'};
+ }
+ if ($env{'request.lti.reqcrs'}) {
+ $info{'lti.reqcrs'} = $env{'request.lti.reqcrs'};
+ }
+ if ($env{'request.lti.reqrole'}) {
+ $info{'lti.reqrole'} = $env{'request.lti.reqrole'};
+ }
+ if ($env{'request.lti.selfenrollrole'}) {
+ $info{'lti.selfenrollrole'} = $env{'request.lti.selfenrollrole'};
+ }
+ if ($env{'request.lti.sourcecrs'}) {
+ $info{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'};
+ }
+ if ($env{'request.lti.passbackid'}) {
+ $info{'lti.passbackid'} = $env{'request.lti.passbackid'};
+ }
+ if ($env{'request.lti.passbackurl'}) {
+ $info{'lti.passbackurl'} = $env{'request.lti.passbackurl'};
+ }
+ if ($env{'request.lti.rosterid'}) {
+ $info{'lti.rosterid'} = $env{'request.lti.rosterid'};
+ }
+ if ($env{'request.lti.rosterurl'}) {
+ $info{'lti.rosterurl'} = $env{'request.lti.rosterurl'};
+ }
+ if ($env{'request.lti.target'}) {
+ $info{'lti.target'} = $env{'request.lti.target'};
+ }
my $token = &Apache::lonnet::tmpput(\%info,$env{'form.otherserver'});
- my $url ='http://'.$switch_to.'/adm/login?'.
+ my $url =$protocol.'://'.$switch_to.'/adm/login?'.
'domain='.$env{'user.domain'}.
- '&username='.$env{'user.name'}.
- '&token='.$token;
+ '&username='.$env{'user.name'}.
+ '&token='.$token;
# --------------------------------------------------------------- Screen Output
- &Apache::lonnet::flushcourselogs();
- return &do_redirect($r,$url,0,$windowinfo);
+ return &do_redirect($r, $url, $only_body);
}
1;
500 Internal Server Error
Internal Server Error
The server encountered an internal error or
misconfiguration and was unable to complete
your request.
Please contact the server administrator at
root@localhost to inform them of the time this error occurred,
and the actions you performed just before this error.
More information about this error may be available
in the server error log.