--- loncom/lond	2021/10/26 15:52:55	1.569
+++ loncom/lond	2022/02/25 09:38:47	1.574
@@ -2,7 +2,7 @@
 # The LearningOnline Network
 # lond "LON Daemon" Server (port "LOND" 5663)
 #
-# $Id: lond,v 1.569 2021/10/26 15:52:55 raeburn Exp $
+# $Id: lond,v 1.574 2022/02/25 09:38:47 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -65,7 +65,7 @@ my $DEBUG = 0;		       # Non zero to ena
 my $status='';
 my $lastlog='';
 
-my $VERSION='$Revision: 1.569 $'; #' stupid emacs
+my $VERSION='$Revision: 1.574 $'; #' stupid emacs
 my $remoteVERSION;
 my $currenthostid="default";
 my $currentdomainid;
@@ -266,6 +266,7 @@ my %trust = (
                ls => {remote => 1, enroll => 1, content => 1,},
                ls2 => {remote => 1, enroll => 1, content => 1,},
                ls3 => {remote => 1, enroll => 1, content => 1,},
+               lti => {institutiononly => 1},
                makeuser => {remote => 1, enroll => 1, domroles => 1,},
                mkdiruserfile => {remote => 1, enroll => 1,},
                newput => {remote => 1, enroll => 1, reqcrs => 1, domroles => 1,},
@@ -2036,7 +2037,7 @@ sub read_lonnet_global {
                 }
                 if ($what eq 'perlvar') {
                     if (!exists($packagevars{$what}{'lonBalancer'})) {
-                        if ($dist =~ /^(centos|rhes|fedora|scientific|oracle)/) {
+                        if ($dist =~ /^(centos|rhes|fedora|scientific|oracle|rocky|alma)/) {
                             my $othervarref=LONCAPA::Configuration::read_conf('httpd.conf');
                             if (ref($othervarref) eq 'HASH') {
                                 $items->{'lonBalancer'} = $othervarref->{'lonBalancer'};
@@ -5141,7 +5142,7 @@ sub get_domain_handler {
     my $userinput = "$cmd:$tail";
 
     my ($udom,$namespace,$what)=split(/:/,$tail,3);
-    if ($namespace =~ /^enc/) {
+    if (($namespace =~ /^enc/) || ($namespace eq 'private')) {
         &Failure( $client, "refused\n", $userinput);
     } else {
         my $res = LONCAPA::Lond::get_dom($userinput);
@@ -5156,12 +5157,101 @@ sub get_domain_handler {
 }
 &register_handler("getdom", \&get_domain_handler, 0, 1, 0);
 
+#
+# Encrypted get from the namespace database file at the domain level.
+# This function retrieves a keyed item from a specific named database in the
+# domain directory.
+#
+# Parameters:
+#   $cmd             - Command request keyword (egetdom).
+#   $tail            - Tail of the command.  This is a colon separated list
+#                      consisting of the domain and the 'namespace'
+#                      which selects the gdbm file to do the lookup in,
+#                      & separated list of keys to lookup.  Note that
+#                      the values are returned as an & separated list too.
+#   $client          - File descriptor open on the client.
+# Returns:
+#   1       - Continue processing.
+#   0       - Exit.
+#  Side effects:
+#     reply is encrypted before being written to $client.
+#
 sub encrypted_get_domain_handler {
     my ($cmd, $tail, $client) = @_;
 
     my $userinput = "$cmd:$tail";
 
-    my $res = LONCAPA::Lond::get_dom($userinput);
+    my ($udom,$namespace,$what) = split(/:/,$tail,3);
+    if ($namespace eq 'private') {
+        &Failure( $client, "refused\n", $userinput);
+    } else {
+        my $res = LONCAPA::Lond::get_dom($userinput);
+        if ($res =~ /^error:/) {
+            &Failure($client, \$res, $userinput);
+        } else {
+            if ($cipher) {
+                my $cmdlength=length($res);
+                $res.="         ";
+                my $encres='';
+                for (my $encidx=0;$encidx<=$cmdlength;$encidx+=8) {
+                    $encres.= unpack("H16",
+                                     $cipher->encrypt(substr($res,
+                                                             $encidx,
+                                                             8)));
+                }
+                &Reply( $client,"enc:$cmdlength:$encres\n",$userinput);
+            } else {
+                &Failure( $client, "error:no_key\n",$userinput);
+            }
+        }
+    }
+    return 1;
+}
+&register_handler("egetdom", \&encrypted_get_domain_handler, 1, 1, 0);
+
+#
+# Encrypted get from the namespace database file at the domain level.
+# This function retrieves a keyed item from a specific named database in the
+# domain directory.
+#
+# Parameters:
+#   $cmd             - Command request keyword (lti).
+#   $tail            - Tail of the command.  This is a colon-separated list
+#                      consisting of the domain, coursenum, if for LTI-
+#                      enabled deep-linking to course content using
+#                      link protection configured within a course,
+#                      context (=deeplink) if for LTI-enabled deep-linking
+#                      to course content using LTI Provider settings
+#                      configured within a course's domain, the (escaped)
+#                      launch URL, the (escaped) method (typically POST),
+#                      and a frozen hash of the LTI launch parameters
+#                      from the LTI payload.
+#   $client          - File descriptor open on the client.
+# Returns:
+#   1       - Continue processing.
+#   0       - Exit.
+#  Side effects:
+#     The reply will contain an LTI itemID, if the signed LTI payload
+#     could be verified using the consumer key and the shared secret 
+#     available for that key (for the itemID) for either the course or domain, 
+#     depending on values for cnum and context. The reply is encrypted before 
+#     being written to $client.
+#
+sub lti_handler {
+    my ($cmd, $tail, $client) = @_;
+
+    my $userinput = "$cmd:$tail";
+
+    my ($cdom,$cnum,$context,$escurl,$escmethod,$items) = split(/:/,$tail);
+    my $url = &unescape($escurl);
+    my $method = &unescape($escmethod);
+    my $params = &Apache::lonnet::thaw_unescape($items);
+    my $res;
+    if ($cnum ne '') {
+        $res = &LONCAPA::Lond::crslti_itemid($cdom,$cnum,$url,$method,$params,$perlvar{'lonVersion'});
+    } else {
+        $res = &LONCAPA::Lond::domlti_itemid($cdom,$context,$url,$method,$params,$perlvar{'lonVersion'});
+    }
     if ($res =~ /^error:/) {
         &Failure($client, \$res, $userinput);
     } else {
@@ -5182,7 +5272,7 @@ sub encrypted_get_domain_handler {
     }
     return 1;
 }
-&register_handler("egetdom", \&encrypted_get_domain_handler, 1, 1, 0);
+&register_handler("lti", \&lti_handler, 1, 1, 0);
 
 #
 #  Puts an id to a domains id database. 
@@ -7802,7 +7892,7 @@ sub make_new_child {
         &Authen::Krb5::init_context();
 
         my $no_ets;
-        if ($dist =~ /^(?:centos|rhes|scientific|oracle)(\d+)$/) {
+        if ($dist =~ /^(?:centos|rhes|scientific|oracle|rocky|alma)(\d+)/) {
             if ($1 >= 7) {
                 $no_ets = 1;
             }
@@ -8297,8 +8387,15 @@ sub validate_user {
             } elsif ((($domdefaults{'auth_def'} eq 'krb4') || 
                       ($domdefaults{'auth_def'} eq 'krb5')) &&
                      ($domdefaults{'auth_arg_def'} ne '')) {
-                $howpwd = $domdefaults{'auth_def'};
-                $contentpwd = $domdefaults{'auth_arg_def'}; 
+                #
+                # Don't attempt authentication for username and password supplied
+                # for user without an account if uername contains @ to avoid
+                # call to &Authen::Krb5::parse_name() which will result in con_lost 
+                #
+                unless ($user =~ /\@/) {
+                    $howpwd = $domdefaults{'auth_def'};
+                    $contentpwd = $domdefaults{'auth_arg_def'};
+                }
             }
         }
     }