loncom/cgi/lonauthcgi.pm - view

File: [LON-CAPA] / loncom / cgi / lonauthcgi.pm
Revision 1.8: download - view: text, annotated - select for diffs
Mon Oct 17 17:23:25 2011 UTC (12 years, 7 months ago) by raeburn
Branches: MAIN
CVS tags: HEAD

- Rights to run /cgi-bin/ping.pl on any server in the cluster, from any other host
  in the cluster.
- For scripts using lonauthcgi::check_ipbased_access(), access permitted for both 127.0.0.1
  and also if remote IP is same as IP of host server.
- check_domain_ip() - new routine: allows access to scripts from any server which belongs
  to the same domain as the host server.
- update POD for check_ipbased_access().
- Add new global hash: Apache::lonnet::managerstab to store contents of:
  /home/httpd/lonTabs/managers.tab, loaded within BEGIN {} block.
- No automatic access to toggledebug and takeoffline items from server listed in
  managers.tab (unlike other keys in %serverstatus_titles).

1: # 2: # LON-CAPA authorization for cgi-bin scripts 3: # 4: # $Id: lonauthcgi.pm,v 1.8 2011/10/17 17:23:25 raeburn Exp $ 5: # 6: # Copyright Michigan State University Board of Trustees 7: # 8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA). 9: # 10: # LON-CAPA is free software; you can redistribute it and/or modify 11: # it under the terms of the GNU General Public License as published by 12: # the Free Software Foundation; either version 2 of the License, or 13: # (at your option) any later version. 14: # 15: # LON-CAPA is distributed in the hope that it will be useful, 16: # but WITHOUT ANY WARRANTY; without even the implied warranty of 17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18: # GNU General Public License for more details. 19: # 20: # You should have received a copy of the GNU General Public License 21: # along with LON-CAPA; if not, write to the Free Software 22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23: # 24: # /home/httpd/html/adm/gpl.txt 25: # 26: # http://www.lon-capa.org/ 27: # 28: ############################################# 29: ############################################# 30: 31: =pod 32: 33: =head1 NAME 34: 35: lonauthcgi 36: 37: =head1 SYNOPSIS 38: 39: Provides subroutines for checking if access to cgi pages is allowed 40: based on IP address, or for logged-in users based on role and/or 41: identity. Also provides subroutines to give a user an explanation 42: when access is denied, and descriptions of various server status pages 43: generated by CGI scripts which use these subroutines for authorization. 44: 45: =head1 Subroutines 46: 47: =over 4 48: 49: =cut 50: 51: ############################################# 52: ############################################# 53: 54: package LONCAPA::lonauthcgi; 55: 56: use strict; 57: use lib '/home/httpd/lib/perl'; 58: use Socket; 59: use Apache::lonnet; 60: use Apache::lonlocal; 61: use LONCAPA; 62: 63: ############################################# 64: ############################################# 65: 66: =pod 67: 68: =item check_ipbased_access() 69: 70: Inputs: $page, the identifier of the page to be viewed, 71: can be one of the keys in the hash from &serverstatus_titles() 72: 73: $ip, the IP address of the client requesting the page. 74: 75: Returns: 1 if access is permitted for the requestor's IP. 76: Access is allowed if one of the following is true: 77: (a) the requestor IP is the loopback address. 78: (b) the requestor IP is the IP of the current server. 79: (c) the requestor IP is the IP of a manager, 80: if the page to view is not "takeoffline" or "toggledebug" 81: (d) the requestor IP is the IP of a server belonging 82: to a domain included in domains hosted on this server. 83: (e) Domain configurations for domains hosted on this server include 84: the requestor's IP as one of the specified IPs with access 85: to this page. (not applicable to 'ping' page). 86: 87: =cut 88: 89: ############################################# 90: ############################################# 91: sub check_ipbased_access { 92: my ($page,$ip) = @_; 93: my $allowed; 94: if (!defined($ip)) { 95: $ip = $ENV{'REMOTE_ADDR'}; 96: } 97: if ($ip eq '127.0.0.1') { 98: $allowed = 1; 99: return $allowed; 100: } else { 101: my $lonhost = $Apache::lonnet::perlvar{'lonHostID'}; 102: my $host_ip = &Apache::lonnet::get_host_ip($lonhost); 103: if (($host_ip ne '') && ($host_ip eq $ip)) { 104: $allowed = 1; 105: return $allowed; 106: } 107: } 108: if (&is_manager_ip($ip)) { 109: unless (($page eq 'toggledebug') || ($page eq 'takeoffline')) { 110: $allowed = 1; 111: return $allowed; 112: } 113: } 114: if (&check_domain_ip($ip)) { 115: $allowed = 1; 116: return $allowed; 117: } 118: if ($page ne 'ping') { 119: my @poss_domains = &Apache::lonnet::current_machine_domains(); 120: foreach my $dom (@poss_domains) { 121: my %domconfig = &Apache::lonnet::get_dom('configuration',['serverstatuses'],$dom); 122: if (ref($domconfig{'serverstatuses'}) eq 'HASH') { 123: if (ref($domconfig{'serverstatuses'}{$page}) eq 'HASH') { 124: if ($domconfig{'serverstatuses'}{$page}{'machines'} ne '') { 125: my @okmachines = split(/,/,$domconfig{'serverstatuses'}{$page}{'machines'}); 126: if (grep(/^\Q$ip\E$/,@okmachines)) { 127: $allowed = 1; 128: last; 129: } 130: } 131: } 132: } 133: } 134: } 135: return $allowed; 136: } 137: 138: ############################################# 139: ############################################# 140: 141: =pod 142: 143: =item is_manager_ip() 144: 145: Inputs: $remote_ip, the IP address of the client requesting the page. 146: 147: Returns: 1 if the client IP address corresponds to that of a 148: machine listed in /home/httpd/lonTabs/managers.tab 149: 150: =cut 151: 152: ############################################# 153: ############################################# 154: sub is_manager_ip { 155: my ($remote_ip) = @_; 156: return if ($remote_ip eq ''); 157: my ($directory,$is_manager); 158: foreach my $key (keys(%Apache::lonnet::managerstab)) { 159: my $manager_ip; 160: if ($key =~ /:/) { 161: my ($cluname,$dnsname) = split(/:/,$key); 162: my $ip = gethostbyname($dnsname); 163: if (defined($ip)) { 164: $manager_ip = inet_ntoa($ip); 165: } 166: } else { 167: $manager_ip = &Apache::lonnet::get_host_ip($key); 168: } 169: if (defined($manager_ip)) { 170: if ($remote_ip eq $manager_ip) { 171: $is_manager = 1; 172: last; 173: } 174: } 175: } 176: return $is_manager; 177: } 178: 179: ############################################# 180: ############################################# 181: 182: =pod 183: 184: =item check_domain_ip() 185: 186: Inputs: $remote_ip, the IP address of the client requesting the page. 187: 188: Returns: 1 if the client IP address is for a machine in the cluster 189: and domain in common for client machine and this machine. 190: 191: =cut 192: 193: ############################################# 194: ############################################# 195: sub check_domain_ip { 196: my ($remote_ip) = @_; 197: my %remote_doms; 198: my $allowed; 199: if ($remote_ip ne '') { 200: if (&Apache::lonnet::hostname($remote_ip) ne '') { 201: my @poss_domains = &Apache::lonnet::current_machine_domains(); 202: if (@poss_domains > 0) { 203: my @remote_hosts = &Apache::lonnet::get_hosts_from_ip($remote_ip); 204: foreach my $hostid (@remote_hosts) { 205: my $hostdom = &Apache::lonnet::host_domain($hostid); 206: if ($hostdom ne '') { 207: if (grep(/^\Q$hostdom\E$/,@poss_domains)) { 208: $allowed = 1; 209: last; 210: } 211: } 212: } 213: } 214: } 215: } 216: return $allowed; 217: } 218: 219: ############################################# 220: ############################################# 221: 222: =pod 223: 224: =item can_view() 225: 226: Inputs: $page, the identifier of the page to be viewed, 227: can be one of the keys in the hash from &serverstatus_titles() 228: 229: Returns: 1 if access to the page is permitted. 230: Access allowed if one of the following is true: 231: (a) Requestor has LON-CAPA superuser role 232: (b) Requestor's role is Domain Coordinator in one of the domains 233: hosted on this server 234: (c) Domain configurations for domains hosted on this server include 235: the requestor as one of the named users (username:domain) with access 236: to the page. 237: 238: In the case of requests for the 'showenv' page (/adm/test), the domains tested 239: are not the domains hosted on the server, but instead are a single domain - 240: the domain of the requestor. In addition, if the requestor has an active 241: Domain Coordinator role for that domain, access is permitted, regardless of 242: the requestor's current role. 243: 244: =cut 245: 246: ############################################# 247: ############################################# 248: sub can_view { 249: my ($page) = @_; 250: my $allowed; 251: if ($Apache::lonnet::env{'request.role'} =~ m{^su\./}) { 252: $allowed = 1; 253: } else { 254: my @poss_domains; 255: if ($page eq 'showenv') { 256: @poss_domains = ($env{'user.domain'}); 257: my $envkey = 'user.role.dc./'.$poss_domains[0].'/'; 258: if (exists($Apache::lonnet::env{$envkey})) { 259: my $livedc = 1; 260: my $then = $Apache::lonnet::env{'user.login.time'}; 261: my ($tstart,$tend)=split(/\./,$Apache::lonnet::env{$envkey}); 262: if ($tstart && $tstart>$then) { $livedc = 0; } 263: if ($tend && $tend <$then) { $livedc = 0; } 264: if ($livedc) { 265: $allowed = 1; 266: } 267: } 268: } else { 269: @poss_domains = &Apache::lonnet::current_machine_domains(); 270: } 271: unless ($allowed) { 272: foreach my $dom (@poss_domains) { 273: my %domconfig = &Apache::lonnet::get_dom('configuration',['serverstatuses'], 274: $dom); 275: if ($Apache::lonnet::env{'request.role'} eq "dc./$dom/") { 276: $allowed = 1; 277: } elsif (ref($domconfig{'serverstatuses'}) eq 'HASH') { 278: if (ref($domconfig{'serverstatuses'}{$page}) eq 'HASH') { 279: if ($domconfig{'serverstatuses'}{$page}{'namedusers'} ne '') { 280: my @okusers = split(/,/,$domconfig{'serverstatuses'}{$page}{'namedusers'}); 281: if (grep(/^\Q$Apache::lonnet::env{'user.name'}:$Apache::lonnet::env{'user.domain'}\E$/,@okusers)) { 282: $allowed = 1; 283: } 284: } 285: } 286: } 287: last if $allowed; 288: } 289: } 290: } 291: return $allowed; 292: } 293: 294: ############################################# 295: ############################################# 296: 297: =pod 298: 299: =item unauthorized_msg() 300: 301: Inputs: $page, the identifier of the page to be viewed, 302: can be one of the keys in the hash from &serverstatus_titles() 303: 304: Returns: A string explaining why access was denied for the particular page. 305: 306: =cut 307: 308: ############################################# 309: ############################################# 310: sub unauthorized_msg { 311: my ($page) = @_; 312: my $titles = &serverstatus_titles(); 313: if ($page eq 'clusterstatus') { 314: return &mt('Your current role does not permit you to view the requested server status page: [_1]',$titles->{$page}); 315: } 316: my @poss_domains = &Apache::lonnet::current_machine_domains(); 317: if (@poss_domains == 1) { 318: my $domdesc = &Apache::lonnet::domain($poss_domains[0]); 319: return &mt('The configuration for domain: [_1] does not permit you to view the requested server status page: [_2].',"$domdesc ($poss_domains[0])",$titles->{$page}); 320: } elsif (@poss_domains > 1) { 321: my $output = &mt('Configurations for the domains housed on this server: ').'<ul>'; 322: foreach my $dom (@poss_domains) { 323: my $domdesc = &Apache::lonnet::domain($dom); 324: $output .= '<li>'.&Apache::lonnet::domain($dom).'('.$dom.')</li>'; 325: } 326: $output .= '</ul>'.&mt('do not permit you to view the requested server status page: [_1]',$titles->{$page}); 327: return $output; 328: } else { 329: return &mt('No domain information exists for this server'); 330: } 331: } 332: 333: ############################################# 334: ############################################# 335: 336: =pod 337: 338: =item serverstatus_titles() 339: 340: Inputs: none 341: 342: Returns: a reference to a hash of pages, where in the hash 343: keys are names of pages which employ loncgi.pm 344: or lonstatusacc.pm for access control, 345: and corresponding values are descriptions of each page 346: 347: =cut 348: 349: ############################################# 350: ############################################# 351: sub serverstatus_titles { 352: my %titles = &Apache::lonlocal::texthash ( 353: 'userstatus' => 'User Status Summary', 354: 'lonstatus' => 'Display Detailed Report', 355: 'loncron' => 'Generate Detailed Report', 356: 'server-status' => 'Apache Status Page', 357: 'codeversions' => 'LON-CAPA Module Versions', 358: 'clusterstatus' => 'Domain status', 359: 'metadata_keywords' => 'Display Metadata Keywords', 360: 'metadata_harvest' => 'Harvest Metadata Searches', 361: 'takeoffline' => 'Offline - replace Log-in page', 362: 'takeonline' => 'Online - restore Log-in page', 363: 'showenv' => 'Show user environment', 364: 'toggledebug' => 'Toggle debug messages', 365: ); 366: return \%titles; 367: } 368: 369: =pod 370: 371: =back 372: 373: =cut 374: 375: 1;