loncom/auth/switchserver.pm - view

File: [LON-CAPA] / loncom / auth / switchserver.pm
Revision 1.50: download - view: text, annotated - select for diffs
Tue Oct 20 01:38:12 2020 UTC (3 years, 6 months ago) by raeburn
Branches: MAIN
CVS tags: HEAD

- For non-SSO login on a balancer node, check for balancer cookie in lonauth.pm
  after login credentials validated. (Same as lonacc::sso_login for SSO login).
- Not all calls to check_loadbalancing() require determination of a server
  to which to offload, even when $is_balancer is true.

1: # The LearningOnline Network 2: # Switch Servers Handler 3: # 4: # $Id: switchserver.pm,v 1.50 2020/10/20 01:38:12 raeburn Exp $ 5: # 6: # Copyright Michigan State University Board of Trustees 7: # 8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA). 9: # 10: # LON-CAPA is free software; you can redistribute it and/or modify 11: # it under the terms of the GNU General Public License as published by 12: # the Free Software Foundation; either version 2 of the License, or 13: # (at your option) any later version. 14: # 15: # LON-CAPA is distributed in the hope that it will be useful, 16: # but WITHOUT ANY WARRANTY; without even the implied warranty of 17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18: # GNU General Public License for more details. 19: # 20: # You should have received a copy of the GNU General Public License 21: # along with LON-CAPA; if not, write to the Free Software 22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23: # 24: # /home/httpd/html/adm/gpl.txt 25: # 26: # http://www.lon-capa.org/ 27: # 28: 29: package Apache::switchserver; 30: 31: use strict; 32: use Apache::Constants qw(:common); 33: use Apache::lonnet; 34: use Digest::MD5 qw(md5_hex); 35: use CGI::Cookie(); 36: use Apache::lonlocal; 37: use LONCAPA qw(:DEFAULT :match); 38: 39: sub init_env { 40: my ($r) = @_; 41: 42: if (-e $env{'user.environment'}) { 43: return $env{'user.environment'}; 44: } 45: my $requrl=$r->uri; 46: my $handle= &Apache::lonnet::check_for_valid_session($r); 47: if ($handle ne '') { 48: return undef; 49: } 50: my $lonidsdir=$r->dir_config('lonIDsDir'); 51: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); 52: 53: return $r->dir_config('lonIDsDir')."/$handle.id"; 54: } 55: 56: sub do_redirect { 57: my ($r,$url,$only_body,$extra_text) = @_; 58: $r->send_http_header; 59: my $delay = 0.5; 60: if ($only_body) { 61: $delay = 0; 62: } 63: my $start_page = 64: &Apache::loncommon::start_page('Switching Server ...',undef, 65: {'redirect' => [$delay,$url], 66: 'only_body' => $only_body,}); 67: my $end_page = &Apache::loncommon::end_page(); 68: $r->print($start_page.$extra_text.$end_page); 69: unless ($env{'user.name'} eq 'public' && ($env{'user.domain'} eq 'public')) { 70: $r->register_cleanup(\&flush_course_logs); 71: } 72: return OK; 73: } 74: 75: sub balancer_cookieid { 76: my ($r,$desthost,$uname,$udom) = @_; 77: my @hosts = &Apache::lonnet::current_machine_ids(); 78: my $newcookieid; 79: unless (grep(/^\Q$desthost\E$/,@hosts)) { 80: my $balancedir=$r->dir_config('lonBalanceDir'); 81: $newcookieid = &md5_hex(&md5_hex(time.{}.rand().$$)); 82: my $cookie = $udom.'_'.$uname.'_'.$newcookieid; 83: my $balcookie = "balanceID=$cookie; path=/; HttpOnly;"; 84: if (open(my $fh,'>',"$balancedir/$cookie.id")) { 85: print $fh $desthost; 86: close($fh); 87: $r->headers_out->add('Set-cookie' => $balcookie); 88: } 89: } 90: return $newcookieid; 91: } 92: 93: sub flush_course_logs { 94: &Apache::lonnet::flushcourselogs(); 95: return OK; 96: } 97: 98: sub handler { 99: my ($r) = @_; 100: 101: my $handle=&init_env($r); 102: if (!defined($handle)) { return FORBIDDEN; } 103: 104: &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'}, 105: ['otherserver','role','origurl','symb']); 106: 107: my $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'}); 108: if (! $env{'form.otherserver'}) { 109: $env{'form.otherserver'} = 110: &Apache::lonnet::find_existing_session($env{'user.domain'}, 111: $env{'user.name'}); 112: if (! $env{'form.otherserver'}) { 113: $env{'form.otherserver'} = 114: &Apache::lonnet::spareserver(30000,undef,1); 115: } 116: $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'}); 117: } 118: 119: if (!defined($switch_to)) { return FORBIDDEN; } 120: 121: my $protocol = 'http'; 122: if ($env{'form.otherserver'}) { 123: if ($Apache::lonnet::protocol{$env{'form.otherserver'}} eq 'https') { 124: $protocol = $Apache::lonnet::protocol{$env{'form.otherserver'}}; 125: } 126: } 127: 128: if ($env{'user.name'} eq 'public' 129: && $env{'user.domain'} eq 'public') { 130: my $url = $protocol.'://'.$switch_to.$r->uri; 131: unlink($handle); 132: #expire the cookie 133: my $c = new CGI::Cookie(-name => 'lonPubID', 134: -value => '', 135: -expires => '-10y',); 136: $r->header_out('Set-cookie' => $c); 137: return &do_redirect($r,$url,1) 138: } 139: 140: my $skip_canhost_check = ''; 141: my $now = time; 142: if ($env{'form.role'}) { 143: if (!exists($env{'user.role.'.$env{'form.role'}})) { 144: delete($env{'form.role'}); 145: } else { 146: my ($start,$end) = split(/\./,$env{'user.role.'.$env{'form.role'}}); 147: if (($start && $start > $now) || ($end && $end < $now)) { 148: delete($env{'form.role'}); 149: } elsif ($env{'form.role'} eq 'au./'.$env{'user.domain'}.'/') { 150: if (&Apache::lonnet::homeserver($env{'user.name'},$env{'user.domain'}) eq $env{'form.otherserver'}) { 151: $skip_canhost_check = 1; 152: } 153: } elsif ($env{'form.role'} =~ m{^[ac]a\./($match_domain)/($match_username)$}) { 154: my ($audom,$auname) = ($1,$2); 155: if (&Apache::lonnet::homeserver($auname,$audom) eq $env{'form.otherserver'}) { 156: if ((&Apache::lonnet::will_trust('othcoau',$env{'user.domain'},$audom)) && 157: (&Apache::lonnet::will_trust('coaurem',$audom,$env{'user.domain'}))) { 158: $skip_canhost_check = 1; 159: } 160: } 161: } 162: } 163: } 164: 165: unless ($skip_canhost_check) { 166: my $canhost = 1; 167: my $uprimary_id = &Apache::lonnet::domain($env{'user.domain'},'primary'); 168: my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id); 169: my @intdoms; 170: my $internet_names = &Apache::lonnet::get_internet_names($env{'form.otherserver'}); 171: if (ref($internet_names) eq 'ARRAY') { 172: @intdoms = @{$internet_names}; 173: } 174: unless ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) { 175: my $serverhomeID = &Apache::lonnet::get_server_homeID($switch_to); 176: my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID); 177: my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom); 178: my %udomdefaults = &Apache::lonnet::get_domain_defaults($env{'user.domain'}); 179: my $remoterev = &Apache::lonnet::get_server_loncaparev($env{'user.domain'},$env{'form.otherserver'}); 180: $canhost = 181: &Apache::lonnet::can_host_session($env{'user.domain'}, 182: $env{'form.otherserver'}, 183: $remoterev, 184: $udomdefaults{'remotesessions'}, 185: $defdomdefaults{'hostedsessions'}); 186: } 187: unless ($canhost) { return FORBIDDEN; } 188: } 189: 190: #remove session env, and log event 191: if (unlink($handle)) { 192: if ($env{'user.linkedenv'} ne '') { 193: my $lonidsdir=$r->dir_config('lonIDsDir'); 194: if (($env{'user.linkedenv'} =~ /^[a-f0-9]+_linked$/) && 195: (-l "$lonidsdir/$env{'user.linkedenv'}.id") && 196: (readlink("$lonidsdir/$env{'user.linkedenv'}.id") eq $handle)) { 197: unlink("$lonidsdir/$env{'user.linkedenv'}.id"); 198: } 199: } 200: } 201: my %temp=('switchserver' => $now.':'.$env{'form.otherserver'}, 202: $env{'form.role'}); 203: &Apache::lonnet::put('email_status',\%temp); 204: my $logmsg = "Switch Server to $env{'form.otherserver'}"; 205: if ($env{'form.role'}) { 206: $logmsg .= " with role: $env{'form.role'}"; 207: } elsif (($env{'form.lti.reqcrs'}) && ($env{'form.lti.reqrole'} eq 'cc')) { 208: $logmsg .= " to create new LTI course"; 209: } elsif ($env{'form.lti.selfenrollrole'}) { 210: $logmsg .= " to selfenroll with role: $env{'form.lti.selfenrollrole'}"; 211: } else { 212: $logmsg .= " (no role)"; 213: } 214: $logmsg .= ' '.$ENV{'REMOTE_ADDR'}; 215: &Apache::lonnet::log($env{'user.domain'},$env{'user.name'}, 216: $env{'user.home'},$logmsg); 217: 218: &Apache::loncommon::content_type($r,'text/html'); 219: 220: #expire the cookies 221: my %cookies=CGI::Cookie->parse($r->header_in('Cookie')); 222: foreach my $name (keys(%cookies)) { 223: next unless ($name =~ /^lon(|S|Link|Pub)ID$/); 224: my $c = new CGI::Cookie(-name => $name, 225: -value => '', 226: -expires => '-10y',); 227: $r->headers_out->add('Set-cookie' => $c); 228: } 229: if ($r->header_only) { 230: $r->send_http_header; 231: return OK; 232: } 233: # -------------------------------------------------------- Menu script and info 234: 235: # ---------------------------------------------------------------- Get handover 236: 237: my ($is_balancer,$setcookie,$newcookieid,$offloadto,$dom_balancers); 238: my $only_body = 0; 239: ($is_balancer,undef,$setcookie,$offloadto,$dom_balancers) = 240: &Apache::lonnet::check_loadbalancing($env{'user.name'},$env{'user.domain'},'switchserver'); 241: if ($is_balancer && $setcookie && $env{'form.otherserver'}) { 242: 243: # Set a balancer cookie unless browser already sent LON-CAPA load balancer 244: # cookie which points at the target server 245: my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r,1); 246: 247: if (($found_server eq $env{'form.otherserver'}) && 248: ($balancer_cookie =~ /^\Q$env{'user.domain'}\E_\Q$env{'user.name'}\E_/)) { 249: $only_body = 1; 250: } else { 251: $newcookieid = &balancer_cookieid($r,$env{'form.otherserver'}, 252: $env{'user.name'},$env{'user.domain'}); 253: } 254: } 255: 256: my %info=('ip' => $ENV{'REMOTE_ADDR'}, 257: 'domain' => $env{'user.domain'}, 258: 'username' => $env{'user.name'}, 259: 'home' => $env{'user.home'}, 260: 'role' => $env{'form.role'}, 261: 'server' => $r->dir_config('lonHostID'), 262: 'balancer' => $is_balancer, 263: 'dom_balancers' => $dom_balancers, 264: 'offloadto' => ''); 265: if (ref($offloadto) eq 'HASH') { 266: foreach my $key (keys(%{$offloadto})) { 267: if (ref($offloadto->{$key}) eq 'ARRAY') { 268: $info{'offloadto'} .= $key.'='.join(',',@{$offloadto->{$key}}).'&'; 269: } 270: } 271: $info{'offloadto'} =~ s/\&$//; 272: } elsif (ref($offloadto) eq 'ARRAY') { 273: $info{'offloadto'} = join(',',@{$offloadto}); 274: } 275: if ($newcookieid) { 276: $info{'balcookie'} = $newcookieid; 277: } 278: if ($env{'form.origurl'}) { 279: $info{'origurl'} = $env{'form.origurl'}; 280: } 281: if ($env{'form.symb'}) { 282: $info{'symb'} = $env{'form.symb'}; 283: } 284: if ($env{'request.sso.login'}) { 285: $info{'sso.login'} = $env{'request.sso.login'}; 286: } 287: if ($env{'request.sso.reloginserver'}) { 288: $info{'sso.reloginserver'} = $env{'request.sso.reloginserver'}; 289: } 290: if ($env{'request.linkprot'}) { 291: $info{'linkprot'} = $env{'request.linkprot'}; 292: } 293: if ($env{'request.deeplink.login'}) { 294: $info{'deeplink.login'} = $env{'request.deeplink.login'}; 295: if ($env{'request.linkkey'}) { 296: $info{'linkkey'} = $env{'request.linkkey'}; 297: } 298: } 299: if ($env{'request.lti.login'}) { 300: $info{'lti.login'} = $env{'request.lti.login'}; 301: } 302: if ($env{'request.lti.uri'}) { 303: $info{'lti.uri'} = $env{'request.lti.uri'}; 304: } 305: if ($env{'request.lti.reqcrs'}) { 306: $info{'lti.reqcrs'} = $env{'request.lti.reqcrs'}; 307: } 308: if ($env{'request.lti.reqrole'}) { 309: $info{'lti.reqrole'} = $env{'request.lti.reqrole'}; 310: } 311: if ($env{'request.lti.selfenrollrole'}) { 312: $info{'lti.selfenrollrole'} = $env{'request.lti.selfenrollrole'}; 313: } 314: if ($env{'request.lti.sourcecrs'}) { 315: $info{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'}; 316: } 317: if ($env{'request.lti.passbackid'}) { 318: $info{'lti.passbackid'} = $env{'request.lti.passbackid'}; 319: } 320: if ($env{'request.lti.passbackurl'}) { 321: $info{'lti.passbackurl'} = $env{'request.lti.passbackurl'}; 322: } 323: if ($env{'request.lti.rosterid'}) { 324: $info{'lti.rosterid'} = $env{'request.lti.rosterid'}; 325: } 326: if ($env{'request.lti.rosterurl'}) { 327: $info{'lti.rosterurl'} = $env{'request.lti.rosterurl'}; 328: } 329: if ($env{'request.lti.target'}) { 330: $info{'lti.target'} = $env{'request.lti.target'}; 331: } 332: my $token = &Apache::lonnet::tmpput(\%info,$env{'form.otherserver'}); 333: my $url =$protocol.'://'.$switch_to.'/adm/login?'. 334: 'domain='.$env{'user.domain'}. 335: '&username='.$env{'user.name'}. 336: '&token='.$token; 337: # --------------------------------------------------------------- Screen Output 338: return &do_redirect($r, $url, $only_body); 339: } 340: 341: 1; 342: __END__ 343: 344: 345: 346: 347: 348: 349: 350: