--- loncom/interface/domainprefs.pm 2021/02/16 13:47:22 1.379
+++ loncom/interface/domainprefs.pm 2021/11/03 13:49:57 1.389
@@ -1,7 +1,7 @@
# The LearningOnline Network with CAPA
# Handler to set domain-wide configuration settings
#
-# $Id: domainprefs.pm,v 1.379 2021/02/16 13:47:22 raeburn Exp $
+# $Id: domainprefs.pm,v 1.389 2021/11/03 13:49:57 raeburn Exp $
#
# Copyright Michigan State University Board of Trustees
#
@@ -223,7 +223,7 @@ sub handler {
'ltitools','ssl','trust','lti','privacy','passwords',
'proctoring','wafproxy'],$dom);
my %encconfig =
- &Apache::lonnet::get_dom('encconfig',['ltitools','lti','proctoring'],$dom);
+ &Apache::lonnet::get_dom('encconfig',['ltitools','lti','proctoring'],$dom,undef,1);
if (ref($domconfig{'ltitools'}) eq 'HASH') {
if (ref($encconfig{'ltitools'}) eq 'HASH') {
foreach my $id (keys(%{$domconfig{'ltitools'}})) {
@@ -297,7 +297,10 @@ sub handler {
{col1 => 'Log-in Help',
col2 => 'Value'},
{col1 => 'Custom HTML in document head',
- col2 => 'Value'}],
+ col2 => 'Value'},
+ {col1 => 'SSO',
+ col2 => 'Dual login: SSO and non-SSO options'},
+ ],
print => \&print_login,
modify => \&modify_login,
},
@@ -311,16 +314,16 @@ sub handler {
print => \&print_defaults,
modify => \&modify_defaults,
},
- 'wafproxy' =>
- { text => 'Web Application Firewall/Reverse Proxy',
+ 'wafproxy' =>
+ { text => 'Web Application Firewall/Reverse Proxy',
help => 'Domain_Configuration_WAF_Proxy',
- header => [{col1 => 'Domain server',
- col2 => 'Alias for WAF/Reverse Proxy',
+ header => [{col1 => 'Domain(s)',
+ col2 => 'Servers and WAF/Reverse Proxy alias(es)',
},
- {col1 => 'Setting',
- col2 => 'Value',}],
+ {col1 => 'Domain(s)',
+ col2 => 'WAF Configuration',}],
print => \&print_wafproxy,
- modify => \&modify_wafproxy,
+ modify => \&modify_wafproxy,
},
'passwords' =>
{ text => 'Passwords (Internal authentication)',
@@ -632,7 +635,10 @@ sub handler {
{col1 => 'Log-in Help',
col2 => 'Value'},
{col1 => 'Custom HTML in document head',
- col2 => 'Value'}],
+ col2 => 'Value'},
+ {col1 => 'SSO',
+ col2 => 'Dual login: SSO and non-SSO options'},
+ ],
print => \&print_login,
modify => \&modify_login,
};
@@ -855,6 +861,12 @@ sub print_config_box {
$output .= <i_javascript($settings);
} elsif ($action eq 'proctoring') {
$output .= &proctoring_javascript($settings);
+ } elsif ($action eq 'wafproxy') {
+ $output .= &wafproxy_javascript($dom);
+ } elsif ($action eq 'autoupdate') {
+ $output .= &autoupdate_javascript();
+ } elsif ($action eq 'login') {
+ $output .= &saml_javascript();
}
$output .=
'
@@ -874,7 +886,7 @@ sub print_config_box {
my $leftnobr = '';
if (($action eq 'rolecolors') || ($action eq 'defaults') ||
($action eq 'directorysrch') ||
- (($action eq 'login') && ($numheaders < 4))) {
+ (($action eq 'login') && ($numheaders < 5))) {
$colspan = ' colspan="2"';
}
if ($action eq 'usersessions') {
@@ -905,7 +917,7 @@ sub print_config_box {
} elsif ($action eq 'scantron') {
$output .= $item->{'print'}->($r,'top',$dom,$confname,$settings,\$rowtotal);
} elsif ($action eq 'login') {
- if ($numheaders == 4) {
+ if ($numheaders == 5) {
$colspan = ' colspan="2"';
$output .= &print_login('service',$dom,$confname,$phase,$settings,\$rowtotal);
} else {
@@ -1046,7 +1058,7 @@ sub print_config_box {
'.&mt($item->{'header'}->[3]->{'col2'}).' '.
$item->{'print'}->('bottom',$dom,$settings,\$rowtotal);
} elsif ($action eq 'login') {
- if ($numheaders == 4) {
+ if ($numheaders == 5) {
$output .= &print_login('page',$dom,$confname,$phase,$settings,\$rowtotal).'
@@ -1070,7 +1082,7 @@ sub print_config_box {
';
- if ($numheaders == 4) {
+ if ($numheaders == 5) {
$output .= '
'.&mt($item->{'header'}->[3]->{'col1'}).'
'.&mt($item->{'header'}->[3]->{'col2'}).'
@@ -1082,7 +1094,27 @@ sub print_config_box {
';
}
$rowtotal ++;
- $output .= &print_login('headtag',$dom,$confname,$phase,$settings,\$rowtotal);
+ $output .= &print_login('headtag',$dom,$confname,$phase,$settings,\$rowtotal).'
+
+
+
+
+
+
+ ';
+ if ($numheaders == 5) {
+ $output .= '
+ '.&mt($item->{'header'}->[4]->{'col1'}).'
+ '.&mt($item->{'header'}->[4]->{'col2'}).'
+ ';
+ } else {
+ $output .= '
+ '.&mt($item->{'header'}->[3]->{'col1'}).'
+ '.&mt($item->{'header'}->[3]->{'col2'}).'
+ ';
+ }
+ $rowtotal ++;
+ $output .= &print_login('saml',$dom,$confname,$phase,$settings,\$rowtotal);
} elsif ($action eq 'requestcourses') {
$output .= &print_requestmail($dom,$action,$settings,\$rowtotal);
$rowtotal ++;
@@ -1217,9 +1249,12 @@ sub print_config_box {
sub print_login {
my ($caller,$dom,$confname,$phase,$settings,$rowtotal) = @_;
- my ($css_class,$datatable);
+ my ($css_class,$datatable,$switchserver,%lt);
my %choices = &login_choices();
-
+ if (($caller eq 'help') || ($caller eq 'headtag') || ($caller eq 'saml')) {
+ %lt = &login_file_options();
+ $switchserver = &check_switchserver($dom,$confname);
+ }
if ($caller eq 'service') {
my %servers = &Apache::lonnet::internet_dom_servers($dom);
my $choice = $choices{'disallowlogin'};
@@ -1413,18 +1448,10 @@ sub print_login {
$datatable .= &display_color_options($dom,$confname,$phase,'login',$itemcount,\%choices,\%is_custom,\%defaults,\%designs,\@images,\@bgs,\@links,\%alt_text,$rowtotal,\@logintext);
$datatable .= '
';
} elsif ($caller eq 'help') {
- my ($defaulturl,$defaulttype,%url,%type,%lt,%langchoices);
- my $switchserver = &check_switchserver($dom,$confname);
+ my ($defaulturl,$defaulttype,%url,%type,%langchoices);
my $itemcount = 1;
$defaulturl = '/adm/loginproblems.html';
$defaulttype = 'default';
- %lt = &Apache::lonlocal::texthash (
- del => 'Delete?',
- rep => 'Replace:',
- upl => 'Upload:',
- default => 'Default',
- custom => 'Custom',
- );
%langchoices = &Apache::lonlocal::texthash(&get_languages_hash());
my @currlangs;
if (ref($settings) eq 'HASH') {
@@ -1521,14 +1548,6 @@ sub print_login {
}
}
}
- my %lt = &Apache::lonlocal::texthash(
- del => 'Delete?',
- rep => 'Replace:',
- upl => 'Upload:',
- curr => 'View contents',
- none => 'None',
- );
- my $switchserver = &check_switchserver($dom,$confname);
foreach my $lonhost (sort(keys(%domservers))) {
my $exempt = &check_exempt_addresses($currexempt{$lonhost});
$datatable .= ''.$domservers{$lonhost}.' ';
@@ -1552,6 +1571,88 @@ sub print_login {
$datatable .= ''.
+ ' '.
- ''.&mt($title{'run'}).' '.
- ''.
+ $enable = ''.
+ ''.$choices{'run'}.' '.
+ ''.
' '.
+ $updateoff.' value="0" />'.&mt('No').' '.
' '.
- ''.&mt($title{'classlists'}).' '.
- ''.
- ' ';
- $$rowtotal += 2;
+ my @toggles = ('classlists','unexpired');
+ my %defaultchecked = ('classlists' => 'off',
+ 'unexpired' => 'off'
+ );
+ $$rowtotal ++;
+ ($datatable,$itemcount) = &radiobutton_prefs($settings,\@toggles,\%defaultchecked,
+ \%choices,$itemcount,'','','left','no');
+ $datatable = $enable.$datatable;
+ $$rowtotal += $itemcount;
+ my $lastactiveon = ' ';
+ my $lastactiveoff = ' checked="checked" ';
+ my $lastactivestyle = 'none';
+ my $lastactivedays;
+ my $onclick = ' onclick="javascript:toggleLastActiveDays(this.form);"';
+ if (ref($settings) eq 'HASH') {
+ if ($settings->{'lastactive'} =~ /^\d+$/) {
+ $lastactiveon = $lastactiveoff;
+ $lastactiveoff = ' ';
+ $lastactivestyle = 'inline-block';
+ $lastactivedays = $settings->{'lastactive'};
+ }
+ }
+ my $css_class = $itemcount%2?' class="LC_odd_row"':'';
+ $datatable .= ''.
+ ''.$choices{'lastactive'}.' '.
+ ''.
+ ' '.
+ ' '.
+ ' '.
+ ''.
+ ': '.&mt('inactive = no activity in last [_1] days',
+ '
';
+ $$rowtotal ++;
} elsif ($position eq 'middle') {
my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
my $numinrow = 3;
@@ -4444,7 +4778,7 @@ sub helpdeskroles_access {
sub radiobutton_prefs {
my ($settings,$toggles,$defaultchecked,$choices,$itemcount,$onclick,
- $additional,$align) = @_;
+ $additional,$align,$firstval) = @_;
return unless ((ref($toggles) eq 'ARRAY') && (ref($defaultchecked) eq 'HASH') &&
(ref($choices) eq 'HASH'));
@@ -4484,15 +4818,21 @@ sub radiobutton_prefs {
} else {
$datatable .= '';
}
- $datatable .=
- ''.
- ' '.$additional.
- ' '.
- '';
+ $datatable .= '';
+ if ($firstval eq 'no') {
+ $datatable .=
+ ' '.$additional.'';
$itemcount ++;
}
return ($datatable,$itemcount);
@@ -6155,7 +6495,7 @@ sub print_coursedefaults {
my $currcanclone = 'none';
my $onclick;
my @cloneoptions = ('none','domain');
- my %clonetitles = (
+ my %clonetitles = &Apache::lonlocal::texthash (
none => 'No additional course requesters',
domain => "Any course requester in course's domain",
instcode => 'Course requests for official courses ...',
@@ -7178,121 +7518,275 @@ sub print_wafproxy {
my $itemcount = 0;
my $datatable;
my %servers = &Apache::lonnet::internet_dom_servers($dom);
- my (%othercontrol,%otherdoms,%aliases,%values,$setdom);
+ my (%othercontrol,%otherdoms,%aliases,%saml,%values,$setdom,$showdom);
my %lt = &wafproxy_titles();
foreach my $server (sort(keys(%servers))) {
my $serverhome = &Apache::lonnet::get_server_homeID($servers{$server});
+ next if ($serverhome eq '');
my $serverdom;
if ($serverhome ne $server) {
$serverdom = &Apache::lonnet::host_domain($serverhome);
- $othercontrol{$server} = $serverdom;
+ if (($serverdom ne '') && (&Apache::lonnet::domain($serverdom) ne '')) {
+ $othercontrol{$server} = $serverdom;
+ }
} else {
$serverdom = &Apache::lonnet::host_domain($server);
+ next if (($serverdom eq '') || (&Apache::lonnet::domain($serverdom) eq ''));
if ($serverdom ne $dom) {
$othercontrol{$server} = $serverdom;
} else {
$setdom = 1;
if (ref($settings) eq 'HASH') {
- %{$values{$dom}} = ();
if (ref($settings->{'alias'}) eq 'HASH') {
$aliases{$dom} = $settings->{'alias'};
+ if ($aliases{$dom} ne '') {
+ $showdom = 1;
+ }
}
- foreach my $item ('ipheader','trusted','vpnint','vpnext') {
- $values{$dom}{$item} = $settings->{$item};
+ if (ref($settings->{'saml'}) eq 'HASH') {
+ $saml{$dom} = $settings->{'saml'};
}
}
}
}
}
+ if ($setdom) {
+ %{$values{$dom}} = ();
+ if (ref($settings) eq 'HASH') {
+ foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext') {
+ $values{$dom}{$item} = $settings->{$item};
+ }
+ }
+ }
if (keys(%othercontrol)) {
%otherdoms = reverse(%othercontrol);
foreach my $domain (keys(%otherdoms)) {
%{$values{$domain}} = ();
my %config = &Apache::lonnet::get_dom('configuration',['wafproxy'],$domain);
- if (ref($config{$domain}) eq 'HASH') {
- if (ref($config{$domain}{'wafproxy'}) eq 'HASH') {
- $aliases{$domain} = $config{$domain}{'wafproxy'}{'alias'};
- foreach my $item ('ipheader','trusted','vpnint','vpnext') {
- $values{$domain}{$item} = $config{$domain}{'wafproxy'}{$item};
- }
+ if (ref($config{'wafproxy'}) eq 'HASH') {
+ $aliases{$domain} = $config{'wafproxy'}{'alias'};
+ if (exists($config{'wafproxy'}{'saml'})) {
+ $saml{$domain} = $config{'wafproxy'}{'saml'};
+ }
+ foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext') {
+ $values{$domain}{$item} = $config{'wafproxy'}{$item};
}
}
}
}
if ($position eq 'top') {
my %servers = &Apache::lonnet::internet_dom_servers($dom);
+ my %aliasinfo;
foreach my $server (sort(keys(%servers))) {
- $itemcount ++;
- $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
- $datatable .= ''.
- ''.&mt('Hostname').': '.
- &Apache::lonnet::hostname($server).' '.
- '';
+ $itemcount ++;
+ my $dom_in_effect;
+ my $aliasrows = ' '.
+ ''.
+ &mt('Hostname').': '.
+ ''.&Apache::lonnet::hostname($server).' ';
if ($othercontrol{$server}) {
- my $current;
- if (ref($aliases{$othercontrol{$server}}) eq 'HASH') {
- $current = $aliases{$othercontrol{$server}{$server}};
+ $dom_in_effect = $othercontrol{$server};
+ my ($current,$forsaml);
+ if (ref($aliases{$dom_in_effect}) eq 'HASH') {
+ $current = $aliases{$dom_in_effect}{$server};
+ }
+ if (ref($saml{$dom_in_effect}) eq 'HASH') {
+ if ($saml{$dom_in_effect}{$server}) {
+ $forsaml = 1;
+ }
}
+ $aliasrows .= ''.
+ &mt('Alias').': ';
if ($current) {
- $datatable .= $current;
+ $aliasrows .= $current;
+ if ($forsaml) {
+ $aliasrows .= ' ('.&mt('also for Shibboleth').')';
+ }
} else {
- $datatable .= &mt('None in effect');
+ $aliasrows .= &mt('None');
}
- $datatable .= '('.
- &mt('WAF/Reverse Proxy controlled by domain: [_1]',
- ''.$othercontrol{$server}.' ').' ';
+ $aliasrows .= ' ('.
+ &mt('controlled by domain: [_1]',
+ ''.$dom_in_effect.' ').') ';
} else {
- my $current;
+ $dom_in_effect = $dom;
+ my ($current,$samlon,$samloff);
+ $samloff = ' checked="checked"';
if (ref($aliases{$dom}) eq 'HASH') {
if ($aliases{$dom}{$server}) {
$current = $aliases{$dom}{$server};
}
}
- $datatable .= ''.
+ &mt('Alias').': '.
+ ''.
+ &mt('Alias used for Shibboleth').': '.
+ ' '.
+ ' '.
+ ' ';
+ }
+ $aliasrows .= ' ';
+ $aliasinfo{$dom_in_effect} .= $aliasrows;
+ }
+ if ($aliasinfo{$dom}) {
+ my ($onclick,$wafon,$wafoff,$showtable);
+ $onclick = ' onclick="javascript:toggleWAF();"';
+ $wafoff = ' checked="checked"';
+ $showtable = ' style="display:none";';
+ if ($showdom) {
+ $wafon = $wafoff;
+ $wafoff = '';
+ $showtable = ' style="display:inline;"';
+ }
+ $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+ $datatable = ''.
+ ''.&mt('Domain: [_1]',''.$dom.' ').''.&mt('WAF in use?').' '.
+ ' '.(' 'x2).''.
+ ' '.
+ ''.
+ ' ';
+ $itemcount++;
+ }
+ if (keys(%otherdoms)) {
+ foreach my $key (sort(keys(%otherdoms))) {
+ $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+ $datatable .= ''.
+ ''.&mt('Domain: [_1]',''.$key.' ').' '.
+ ''.
+ my ($nowafstyle,$wafstyle,$curr_remotip,$currwafdisplay,$vpndircheck,$vpnaliascheck,
+ $currwafvpn,$wafrangestyle,$alltossl,$ssltossl);
+ $wafstyle = ' style="display:none;"';
+ $nowafstyle = ' style="display:table-row;"';
+ $currwafdisplay = ' style="display: none"';
+ $wafrangestyle = ' style="display: none"';
+ $curr_remotip = 'n';
+ $ssltossl = ' checked="checked"';
+ if ($showdom) {
+ $wafstyle = ' style="display:table-row;"';
+ $nowafstyle = ' style="display:none;"';
+ if (keys(%{$values{$dom}})) {
+ if ($values{$dom}{remoteip} =~ /^[nmh]$/) {
+ $curr_remotip = $values{$dom}{remoteip};
+ }
+ if ($curr_remotip eq 'h') {
+ $currwafdisplay = ' style="display:table-row"';
+ $wafrangestyle = ' style="display:inline-block;"';
+ }
+ if ($values{$dom}{'sslopt'}) {
+ $alltossl = ' checked="checked"';
+ $ssltossl = '';
+ }
+ }
+ if (($values{$dom}{'vpnint'} ne '') || ($values{$dom}{'vpnext'} ne '')) {
+ $vpndircheck = ' checked="checked"';
+ $currwafvpn = ' style="display:table-row;"';
+ $wafrangestyle = ' style="display:inline-block;"';
+ } else {
+ $vpnaliascheck = ' checked="checked"';
+ $currwafvpn = ' style="display:none;"';
+ }
+ }
+ $datatable .= ''.
+ ''.&mt('Domain: [_1]',''.$dom.' ').' '.
+ ''.&mt('WAF not in use, nothing to set').' '.
+ ''.
+ ''.
''.&mt('Domain: [_1]',''.$dom.' ').' '.
- ''.&mt('Format for comma separated IP ranges').':
'.
+ ''.
- ''.&mt('Domain: [_1]',$domain).' '.
+ ''.&mt('Domain: [_1]',''.$domain.' ').' '.
'';
- foreach my $item ('ipheader','trusted','vpnint','vpnext') {
+ foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
my $showval = &mt('None');
+ if ($item eq 'ssl') {
+ $showval = $lt{'ssltossl'};
+ }
if ($values{$domain}{$item}) {
- $showval = $values{$domain}{$item};
+ $showval = $values{$domain}{$item};
+ if ($item eq 'ssl') {
+ $showval = $lt{'alltossl'};
+ } elsif ($item eq 'remoteip') {
+ $showval = $ip_methods{$values{$domain}{$item}};
+ }
}
$datatable .= ''.
''.$lt{$item}.': '.$showval.' ';
}
- $datatable .= '
'.$item.' '.
''.&mt('Name displayed:').
+ ' '.&mt('Name displayed').':'.
' '.
- &mt('Name displayed:').
+ &mt('Name displayed').':'.
' '.$error.' '.$puberror.' '.$error.' '.&mt("$title{$item} in use for [_1]","$lonhost ").
+ '';
+ foreach my $key ('text','img','alt','url','title','notsso') {
+ if ($currsaml{$lonhost}{$key} eq '') {
+ $resulttext .= ''.&mt("$notlt{$key} not in use").' ';
+ } else {
+ my $value = "'$currsaml{$lonhost}{$key}'";
+ if ($key eq 'img') {
+ $value = ''.&mt("$notlt{$key} set to: [_1]",
+ $value).' ';
+ }
+ }
+ $resulttext .= ' ';
+ } else {
+ $resulttext .= ''.&mt("$title{$item} not in use for [_1]",$lonhost).' ';
+ }
+ }
+ }
} elsif ($item eq 'captcha') {
if (ref($loginhash{'login'}) eq 'HASH') {
my $chgtxt;
@@ -13269,7 +13934,7 @@ sub modify_ltitools {
my %ltienchash = (
$action => { %encconfig }
);
- &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom);
+ &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom,undef,1);
if (keys(%changes) > 0) {
my $cachetime = 24*60*60;
my %ltiall = %confhash;
@@ -13843,7 +14508,7 @@ sub modify_proctoring {
my %proc_enchash = (
$action => { %encconfhash }
);
- &Apache::lonnet::put_dom('encconfig',\%proc_enchash,$dom);
+ &Apache::lonnet::put_dom('encconfig',\%proc_enchash,$dom,undef,1);
if (keys(%changes) > 0) {
my $cachetime = 24*60*60;
my %procall = %confhash;
@@ -14335,7 +15000,7 @@ sub modify_lti {
my %ltienchash = (
$action => { %encconfig }
);
- &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom);
+ &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom,undef,1);
if (keys(%changes) > 0) {
my $cachetime = 24*60*60;
my %ltiall = %confhash;
@@ -14677,8 +15342,10 @@ sub modify_autoupdate {
}
my @offon = ('off','on');
my %title = &Apache::lonlocal::texthash (
- run => 'Auto-update:',
- classlists => 'Updates to user information in classlists?'
+ run => 'Auto-update:',
+ classlists => 'Updates to user information in classlists?',
+ unexpired => 'Skip updates for users without active or future roles?',
+ lastactive => 'Skip updates for inactive users?',
);
my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
my %fieldtitles = &Apache::lonlocal::texthash (
@@ -14722,12 +15389,23 @@ sub modify_autoupdate {
my %updatehash = (
autoupdate => { run => $env{'form.autoupdate_run'},
classlists => $env{'form.classlists'},
+ unexpired => $env{'form.unexpired'},
fields => {%fields},
lockablenames => \@lockablenames,
}
);
+ my $lastactivedays;
+ if ($env{'form.lastactive'}) {
+ $lastactivedays = $env{'form.lastactivedays'};
+ $lastactivedays =~ s/^\s+|\s+$//g;
+ unless ($lastactivedays =~ /^\d+$/) {
+ undef($lastactivedays);
+ $env{'form.lastactive'} = 0;
+ }
+ }
+ $updatehash{'autoupdate'}{'lastactive'} = $lastactivedays;
foreach my $key (keys(%currautoupdate)) {
- if (($key eq 'run') || ($key eq 'classlists')) {
+ if (($key eq 'run') || ($key eq 'classlists') || ($key eq 'unexpired') || ($key eq 'lastactive')) {
if (exists($updatehash{autoupdate}{$key})) {
if ($currautoupdate{$key} ne $updatehash{autoupdate}{$key}) {
$changes{$key} = 1;
@@ -14773,6 +15451,16 @@ sub modify_autoupdate {
$changes{'lockablenames'} = 1;
}
}
+ unless (grep(/^unexpired$/,keys(%currautoupdate))) {
+ if ($updatehash{'autoupdate'}{'unexpired'}) {
+ $changes{'unexpired'} = 1;
+ }
+ }
+ unless (grep(/^lastactive$/,keys(%currautoupdate))) {
+ if ($updatehash{'autoupdate'}{'lastactive'} ne '') {
+ $changes{'lastactive'} = 1;
+ }
+ }
foreach my $item (@{$types},'default') {
if (defined($fields{$item})) {
if (ref($currautoupdate{'fields'}) eq 'HASH') {
@@ -14835,6 +15523,11 @@ sub modify_autoupdate {
my $newvalue;
if ($key eq 'run') {
$newvalue = $offon[$env{'form.autoupdate_run'}];
+ } elsif ($key eq 'lastactive') {
+ $newvalue = $offon[$env{'form.lastactive'}];
+ unless ($lastactivedays eq '') {
+ $newvalue .= '; '.&mt('inactive = no activity in last [quant,_1,day]',$lastactivedays);
+ }
} else {
$newvalue = $offon[$env{'form.'.$key}];
}
@@ -19574,34 +20267,55 @@ sub modify_selfenrollment {
sub modify_wafproxy {
my ($dom,$action,$lastactref,%domconfig) = @_;
my %servers = &Apache::lonnet::internet_dom_servers($dom);
- my (%othercontrol,%canset,%values,%curralias,%currvalue,@warnings,%wafproxy,
- %changes,%expirecache);
+ my (%othercontrol,%canset,%values,%curralias,%currsaml,%currvalue,@warnings,
+ %wafproxy,%changes,%expirecache,%expiresaml);
foreach my $server (sort(keys(%servers))) {
my $serverhome = &Apache::lonnet::get_server_homeID($servers{$server});
if ($serverhome eq $server) {
my $serverdom = &Apache::lonnet::host_domain($server);
if ($serverdom eq $dom) {
$canset{$server} = 1;
- if (ref($domconfig{'wafproxy'}) eq 'HASH') {
- %{$values{$dom}} = ();
- if (ref($domconfig{'wafproxy'}{'alias'}) eq 'HASH') {
- %curralias = %{$domconfig{'wafproxy'}{'alias'}};
- }
- foreach my $item ('ipheader','trusted','exempt') {
- $currvalue{$item} = $domconfig{'wafproxy'}{$item};
- }
- }
}
}
}
+ if (ref($domconfig{'wafproxy'}) eq 'HASH') {
+ %{$values{$dom}} = ();
+ if (ref($domconfig{'wafproxy'}{'alias'}) eq 'HASH') {
+ %curralias = %{$domconfig{'wafproxy'}{'alias'}};
+ }
+ if (ref($domconfig{'wafproxy'}{'saml'}) eq 'HASH') {
+ %currsaml = %{$domconfig{'wafproxy'}{'saml'}};
+ }
+ foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
+ $currvalue{$item} = $domconfig{'wafproxy'}{$item};
+ }
+ }
my $output;
if (keys(%canset)) {
%{$wafproxy{'alias'}} = ();
+ %{$wafproxy{'saml'}} = ();
foreach my $key (sort(keys(%canset))) {
- $wafproxy{'alias'}{$key} = $env{'form.wafproxy_alias_'.$key};
- $wafproxy{'alias'}{$key} =~ s/^\s+|\s+$//g;
- if ($wafproxy{'alias'}{$key} ne $curralias{$key}) {
- $changes{'alias'} = 1;
+ if ($env{'form.wafproxy_'.$dom}) {
+ $wafproxy{'alias'}{$key} = $env{'form.wafproxy_alias_'.$key};
+ $wafproxy{'alias'}{$key} =~ s/^\s+|\s+$//g;
+ if ($wafproxy{'alias'}{$key} ne $curralias{$key}) {
+ $changes{'alias'} = 1;
+ }
+ if ($env{'form.wafproxy_alias_saml_'.$key}) {
+ $wafproxy{'saml'}{$key} = 1;
+ }
+ if ($wafproxy{'saml'}{$key} ne $currsaml{$key}) {
+ $changes{'saml'} = 1;
+ }
+ } else {
+ $wafproxy{'alias'}{$key} = '';
+ $wafproxy{'saml'}{$key} = '';
+ if ($curralias{$key}) {
+ $changes{'alias'} = 1;
+ }
+ if ($currsaml{$key}) {
+ $changes{'saml'} = 1;
+ }
}
if ($wafproxy{'alias'}{$key} eq '') {
if ($curralias{$key}) {
@@ -19609,28 +20323,59 @@ sub modify_wafproxy {
}
delete($wafproxy{'alias'}{$key});
}
+ if ($wafproxy{'saml'}{$key} eq '') {
+ if ($currsaml{$key}) {
+ $expiresaml{$key} = 1;
+ }
+ delete($wafproxy{'saml'}{$key});
+ }
}
unless (keys(%{$wafproxy{'alias'}})) {
delete($wafproxy{'alias'});
}
- # Localization for values in %warn occus in &mt() calls separately.
+ unless (keys(%{$wafproxy{'saml'}})) {
+ delete($wafproxy{'saml'});
+ }
+ # Localization for values in %warn occurs in &mt() calls separately.
my %warn = (
trusted => 'trusted IP range(s)',
- exempt => 'exempt IP range(s)',
+ vpnint => 'internal IP range(s) for VPN sessions(s)',
+ vpnext => 'IP range(s) for backend WAF connections',
);
- foreach my $item ('ipheader','trusted','exempt') {
+ foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
my $possible = $env{'form.wafproxy_'.$item};
$possible =~ s/^\s+|\s+$//g;
if ($possible ne '') {
- if ($item eq 'ipheader') {
- $wafproxy{$item} = $possible;
+ if ($item eq 'remoteip') {
+ if ($possible =~ /^[mhn]$/) {
+ $wafproxy{$item} = $possible;
+ }
+ } elsif ($item eq 'ipheader') {
+ if ($wafproxy{'remoteip'} eq 'h') {
+ $wafproxy{$item} = $possible;
+ }
+ } elsif ($item eq 'sslopt') {
+ if ($possible =~ /^0|1$/) {
+ $wafproxy{$item} = $possible;
+ }
} else {
my (@ok,$count);
- $possible =~ s/[\r\n]+/\s/g;
- $possible =~ s/\s*-\s*/-/g;
- $possible =~ s/\s+/,/g;
+ if (($item eq 'vpnint') || ($item eq 'vpnext')) {
+ unless ($env{'form.wafproxy_vpnaccess'}) {
+ $possible = '';
+ }
+ } elsif ($item eq 'trusted') {
+ unless ($wafproxy{'remoteip'} eq 'h') {
+ $possible = '';
+ }
+ }
+ unless ($possible eq '') {
+ $possible =~ s/[\r\n]+/\s/g;
+ $possible =~ s/\s*-\s*/-/g;
+ $possible =~ s/\s+/,/g;
+ }
$count = 0;
- if ($possible) {
+ if ($possible ne '') {
foreach my $poss (split(/\,/,$possible)) {
$count ++;
if (&validate_ip_pattern($poss)) {
@@ -19647,15 +20392,25 @@ sub modify_wafproxy {
$diff,$warn{$item}).
'');
}
- if ($wafproxy{$item} ne $currvalue{$item}) {
- $changes{$item} = 1;
- }
}
}
- } else {
- if ($currvalue{$item}) {
+ if ($wafproxy{$item} ne $currvalue{$item}) {
$changes{$item} = 1;
}
+ } elsif ($currvalue{$item}) {
+ $changes{$item} = 1;
+ }
+ }
+ } else {
+ if (keys(%curralias)) {
+ $changes{'alias'} = 1;
+ }
+ if (keys(%currsaml)) {
+ $changes{'saml'} = 1;
+ }
+ if (keys(%currvalue)) {
+ foreach my $key (keys(%currvalue)) {
+ $changes{$key} = 1;
}
}
}
@@ -19668,7 +20423,7 @@ sub modify_wafproxy {
if ($putresult eq 'ok') {
my $cachetime = 24*60*60;
my (%domdefaults,$updatedomdefs);
- foreach my $item ('ipheader','trusted','exempt') {
+ foreach my $item ('ipheader','trusted','vpnint','vpnext','sslopt') {
if ($changes{$item}) {
unless ($updatedomdefs) {
%domdefaults = &Apache::lonnet::get_domain_defaults($dom);
@@ -19704,8 +20459,25 @@ sub modify_wafproxy {
$lastactref->{'proxyalias'} = \%updates;
}
}
+ if ((exists($wafproxy{'saml'})) || (keys(%expiresaml))) {
+ my %samlupdates = %expiresaml;
+ foreach my $key (keys(%expiresaml)) {
+ &Apache::lonnet::devalidate_cache_new('proxysaml',$key);
+ }
+ if (ref($wafproxy{'saml'}) eq 'HASH') {
+ my $cachetime = 24*60*60;
+ foreach my $key (keys(%{$wafproxy{'saml'}})) {
+ $samlupdates{$key} = 1;
+ &Apache::lonnet::do_cache_new('proxysaml',$key,$wafproxy{'saml'}{$key},
+ $cachetime);
+ }
+ }
+ if (ref($lastactref) eq 'HASH') {
+ $lastactref->{'proxysaml'} = \%samlupdates;
+ }
+ }
$output = &mt('Changes were made to Web Application Firewall/Reverse Proxy').'';
- foreach my $item ('alias','ipheader','trusted','exempt') {
+ foreach my $item ('alias','remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
if ($changes{$item}) {
if ($item eq 'alias') {
my $numaliased = 0;
@@ -19727,27 +20499,66 @@ sub modify_wafproxy {
unless ($numaliased) {
$output .= ''.&mt('Aliases deleted for hostnames').' ';
}
+ } elsif ($item eq 'saml') {
+ my $shown;
+ if (ref($wafproxy{'saml'}) eq 'HASH') {
+ if (keys(%{$wafproxy{'saml'}})) {
+ $shown = join(', ',sort(keys(%{$wafproxy{'saml'}})));
+ }
+ }
+ if ($shown) {
+ $output .= ''.&mt('Alias used by Shibboleth for: [_1]',
+ $shown).' ';
+ } else {
+ $output .= ''.&mt('No alias used for Shibboleth').' ';
+ }
} else {
- if ($item eq 'ipheader') {
+ if ($item eq 'remoteip') {
+ my %ip_methods = &remoteip_methods();
+ if ($wafproxy{$item} =~ /^[mh]$/) {
+ $output .= ''.&mt("Method for determining user's IP set to: [_1]",
+ $ip_methods{$wafproxy{$item}}).' ';
+ } else {
+ if (($env{'form.wafproxy_'.$dom}) && (ref($wafproxy{'alias'}) eq 'HASH')) {
+ $output .= ''.&mt("No method in use to get user's real IP (will report IP used by WAF).").
+ ' ';
+ } else {
+ $output .= ''.&mt('WAF/Reverse Proxy not in use').' ';
+ }
+ }
+ } elsif ($item eq 'ipheader') {
if ($wafproxy{$item}) {
- $output .= ''.&mt('Custom request header set to [_1]',
+ $output .= ' '.&mt('Request header with remote IP set to: [_1]',
$wafproxy{$item}).' ';
} else {
- $output .= ''.&mt('Custom request header deleted').' ';
+ $output .= ''.&mt('Request header with remote IP deleted').' ';
}
} elsif ($item eq 'trusted') {
if ($wafproxy{$item}) {
- $output .= ''.&mt('Trusted IP range(s) set to [_1]',
+ $output .= ' '.&mt('Trusted IP range(s) set to: [_1]',
$wafproxy{$item}).' ';
} else {
$output .= ''.&mt('Trusted IP range(s) deleted').' ';
}
- } elsif ($item eq 'exempt') {
+ } elsif ($item eq 'vpnint') {
+ if ($wafproxy{$item}) {
+ $output .= ''.&mt('Internal IP Range(s) for VPN sessions set to: [_1]',
+ $wafproxy{$item}).' ';
+ } else {
+ $output .= ''.&mt('Internal IP Range(s) for VPN sessions deleted').' ';
+ }
+ } elsif ($item eq 'vpnext') {
if ($wafproxy{$item}) {
- $output .= ''.&mt('Exempt IP range(s) set to [_1]',
+ $output .= ' '.&mt('IP Range(s) for backend WAF connections set to: [_1]',
$wafproxy{$item}).' ';
} else {
- $output .= ''.&mt('Exempt IP range(s) deleted').' ';
+ $output .= ''.&mt('IP Range(s) for backend WAF connections deleted').' ';
+ }
+ } elsif ($item eq 'sslopt') {
+ if ($wafproxy{$item}) {
+ $output .= ''.&mt('WAF/Reverse Proxy expected to forward requests to https on LON-CAPA node, regardless of original protocol in web browser (http or https).').' ';
+ } else {
+ $output .= ''.&mt('WAF/Reverse Proxy expected to preserve original protocol in web browser (either http or https) when forwarding to LON-CAPA node.').' ';
}
}
}
@@ -20713,8 +21524,13 @@ sub modify_loadbalancing {
}
}
if ($changes{'curr'}{$balancer}{'cookie'}) {
- $resulttext .= ''.&mt('Load Balancer: [_1] -- cookie use enabled',
- $balancer).' ';
+ if ($currcookies{$balancer}) {
+ $resulttext .= ''.&mt('Load Balancer: [_1] -- cookie use disabled',
+ $balancer).' ';
+ } else {
+ $resulttext .= ''.&mt('Load Balancer: [_1] -- cookie use enabled',
+ $balancer).' ';
+ }
}
}
}
@@ -21494,15 +22310,34 @@ sub devalidate_remote_domconfs {
my %thismachine;
map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
my @posscached = ('domainconfig','domdefaults','ltitools','usersessions',
- 'directorysrch','passwdconf','cats','proxyalias');
+ 'directorysrch','passwdconf','cats','proxyalias','proxysaml');
+ my %cache_by_lonhost;
+ if (exists($cachekeys->{'samllanding'})) {
+ if (ref($cachekeys->{'samllanding'}) eq 'HASH') {
+ my %landing = %{$cachekeys->{'samllanding'}};
+ my %domservers = &Apache::lonnet::get_servers($dom);
+ if (keys(%domservers)) {
+ foreach my $server (keys(%domservers)) {
+ my @cached;
+ next if ($thismachine{$server});
+ if ($landing{$server}) {
+ push(@cached,&escape('samllanding').':'.&escape($server));
+ }
+ if (@cached) {
+ $cache_by_lonhost{$server} = \@cached;
+ }
+ }
+ }
+ }
+ }
if (keys(%servers)) {
foreach my $server (keys(%servers)) {
next if ($thismachine{$server});
my @cached;
foreach my $name (@posscached) {
if ($cachekeys->{$name}) {
- if ($name eq 'proxyalias') {
- if (ref($cachekeys->{$name}) eq 'HASH') {
+ if (($name eq 'proxyalias') || ($name eq 'proxysaml')) {
+ if (ref($cachekeys->{$name}) eq 'HASH') {
foreach my $key (keys(%{$cachekeys->{$name}})) {
push(@cached,&escape($name).':'.&escape($key));
}
@@ -21512,6 +22347,10 @@ sub devalidate_remote_domconfs {
}
}
}
+ if ((exists($cache_by_lonhost{$server})) &&
+ (ref($cache_by_lonhost{$server}) eq 'ARRAY')) {
+ push(@cached,@{$cache_by_lonhost{$server}});
+ }
if (@cached) {
&Apache::lonnet::remote_devalidate_cache($server,\@cached);
}