--- loncom/auth/lonauth.pm 2021/12/16 21:48:19 1.121.2.23 +++ loncom/auth/lonauth.pm 2023/07/05 17:33:03 1.121.2.24.2.7 @@ -1,7 +1,7 @@ # The LearningOnline Network # User Authentication Module # -# $Id: lonauth.pm,v 1.121.2.23 2021/12/16 21:48:19 raeburn Exp $ +# $Id: lonauth.pm,v 1.121.2.24.2.7 2023/07/05 17:33:03 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -29,23 +29,25 @@ package Apache::lonauth; use strict; -use LONCAPA; +use LONCAPA qw(:DEFAULT :match); use Apache::Constants qw(:common); use CGI qw(:standard); use Apache::loncommon(); use Apache::lonnet; use Apache::lonmenu(); use Apache::createaccount; +use Apache::ltiauth; use Fcntl qw(:flock); use Apache::lonlocal; use Apache::File(); use HTML::Entities; use Digest::MD5; +use CGI::Cookie(); # ------------------------------------------------------------ Successful login sub success { my ($r, $username, $domain, $authhost, $lowerurl, $extra_env, - $form,$cid,$expirepub) = @_; + $form,$skipcritical,$cid,$expirepub,$write_to_opener) = @_; # ------------------------------------------------------------ Get cookie ready my $cookie = @@ -65,10 +67,12 @@ sub success { # ------------------------------------------------- Check for critical messages - my @what=&Apache::lonnet::dump('critical',$domain,$username); - if ($what[0]) { - if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) { - $lowerurl='/adm/email?critical=display'; + unless ($skipcritical) { + my @what=&Apache::lonnet::dump('critical',$domain,$username); + if ($what[0]) { + if (($what[0] ne 'con_lost') && ($what[0]!~/^error\:/)) { + $lowerurl='/adm/email?critical=display'; + } } } @@ -95,7 +99,35 @@ sub success { } # -------------------------------------------------------- Menu script and info my $destination = $lowerurl; - + if ($env{'request.lti.login'}) { + if (($env{'request.lti.reqcrs'}) && ($env{'request.lti.reqrole'} eq 'cc')) { + &Apache::loncommon::content_type($r,'text/html'); + if ($securecookie) { + $r->headers_out->add('Set-cookie' => $securecookie); + } + if ($defaultcookie) { + $r->headers_out->add('Set-cookie' => $defaultcookie); + } + $r->send_http_header; + if (ref($form) eq 'HASH') { + $form->{'lti.login'} = $env{'request.lti.login'}; + $form->{'lti.reqcrs'} = $env{'request.lti.reqcrs'}; + $form->{'lti.reqrole'} = $env{'request.lti.reqrole'}; + $form->{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'}; + } + &Apache::ltiauth::lti_reqcrs($r,$domain,$form,$username,$domain); + return; + } + if ($env{'request.lti.selfenrollrole'}) { + if (&Apache::ltiauth::lti_enroll($username,$domain, + $env{'request.lti.selfenrollrole'}) eq 'ok') { + $form->{'role'} = $env{'request.lti.selfenrollrole'}; + &Apache::lonnet::delenv('request.lti.selfenrollrole'); + } else { + &Apache::ltiauth::invalid_request($r,24); + } + } + } if (defined($form->{role})) { my $envkey = 'user.role.'.$form->{role}; my $now=time; @@ -115,6 +147,10 @@ sub success { $destination .= 'selectrole=1&'.$newrole.'=1'; } } + } elsif (defined($form->{display})) { + if ($destination =~ m{^/adm/email($|\?)}) { + $destination .= ($destination =~ /\?/) ? '&' : '?' .'display='.&escape($form->{display}); + } } if (defined($form->{symb})) { my $destsymb = $form->{symb}; @@ -147,22 +183,59 @@ sub success { $destination .= 'source=login'; } + my $brcrum = [{'href' => '', + 'text' => 'Successful Login'},]; + my $args = {'no_inline_link' => 1, + 'bread_crumbs' => $brcrum,}; + if (($env{'request.deeplink.login'} eq $lowerurl) && + (($env{'request.linkprot'}) || ($env{'request.linkkey'} ne ''))) { + my %info; + if ($env{'request.linkprot'}) { + $info{'linkprot'} = $env{'request.linkprot'}; + foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') { + if ($form->{$item}) { + $info{$item} = $form->{$item}; + } + } + $args = {'only_body' => 1,}; + } elsif ($env{'request.linkkey'} ne '') { + $info{'linkkey'} = $env{'request.linkkey'}; + } + $info{'origurl'} = $lowerurl; + my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link'); + unless (($token eq 'con_lost') || ($token eq 'refused') || + ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) { + $destination .= (($destination =~ /\?/) ? '&' : '?') . 'ttoken='.$token; + } + } + if (($env{'request.deeplink.login'}) || ($env{'request.lti.login'})) { + if ($env{'environment.remote'} eq 'on') { + &Apache::lonnet::appenv({'environment.remote' => 'off'}); + } + } + my $startupremote; + if ($write_to_opener) { + if ($env{'environment.remote'} eq 'on') { + &Apache::lonnet::appenv({'environment.remote' => 'off'}); + } + $args->{'redirect'} = [0,$destination,'',$write_to_opener]; + } else { + $startupremote=&Apache::lonmenu::startupremote($destination); + } + my $windowinfo=&Apache::lonmenu::open($env{'browser.os'}); - my $startupremote=&Apache::lonmenu::startupremote($destination); my $remoteinfo=&Apache::lonmenu::load_remote_msg($lowerurl); my $setflags=&Apache::lonmenu::setflags(); my $maincall=&Apache::lonmenu::maincall(); - my $brcrum = [{'href' => '', - 'text' => 'Successful Login'},]; my $start_page=&Apache::loncommon::start_page('Successful Login', - $startupremote, - {'no_inline_link' => 1, - 'bread_crumbs' => $brcrum,}); + $startupremote,$args); my $end_page =&Apache::loncommon::end_page(); my $continuelink; if ($env{'environment.remote'} eq 'off') { - $continuelink=''.&mt('Continue').''; + unless ($write_to_opener) { + $continuelink=''.&mt('Continue').''; + } } # ------------------------------------------------- Output for successful login @@ -181,17 +254,24 @@ sub success { } $r->send_http_header; - my %lt=&Apache::lonlocal::texthash( - 'wel' => 'Welcome', - 'pro' => 'Login problems?', - ); - my $loginhelp = &loginhelpdisplay($domain); - if ($loginhelp) { - $loginhelp = '

'.$lt{'pro'}.'

'; - } + if (($env{'request.linkprot'}) || ($env{'request.lti.login'})) { + $r->print(<$continuelink +$end_page +END + } else { + my %lt=&Apache::lonlocal::texthash( + 'wel' => 'Welcome', + 'pro' => 'Login problems?', + ); + my $loginhelp = &loginhelpdisplay($domain); + if ($loginhelp) { + $loginhelp = '

'.$lt{'pro'}.'

'; + } - my $welcome = &mt('Welcome to the Learning[_1]Online[_2] Network with CAPA. Please wait while your session is being set up.','',''); - $r->print(<',''); + $r->print(< 1}; } + if ($form->{firsturl} =~ m{^/tiny/$match_domain/\w+$}) { + if ($form->{linkprot}) { + $args->{only_body} = 1; + } + } + my @actions; my $start_page = &Apache::loncommon::start_page('Unsuccessful Login',undef,$args); my $uname = &Apache::loncommon::cleanup_html($form->{'uname'}); my $udom = &Apache::loncommon::cleanup_html($form->{'udom'}); if (&Apache::lonnet::domain($udom,'description') eq '') { undef($udom); } + my $authtype; + if (($udom ne '') && ($uname ne '') && ($authhost eq 'no_host')) { + $authtype = &Apache::lonnet::queryauthenticate($uname,$udom); + } my $retry = '/adm/login'; - if ($uname eq $form->{'uname'}) { + if (($uname eq $form->{'uname'}) && ($authtype !~ /^lti:/)) { $retry .= '?username='.$uname; } if ($udom) { @@ -250,6 +341,28 @@ sub failed { my $firsturl = &Apache::loncommon::cleanup_html($form->{firsturl}); if ($firsturl ne '') { $retry .= (($retry=~/\?/)?'&':'?').'firsturl='.$firsturl; + if ($form->{firsturl} =~ m{^/tiny/$match_domain/\w+$}) { + unless (exists($form->{linkprot})) { + if (exists($form->{linkkey})) { + $retry .= 'linkkey='.$form->{linkkey}; + } + } + } + } + } + if (exists($form->{linkprot})) { + my %info = ( + 'linkprot' => $form->{'linkprot'}, + ); + foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') { + if ($form->{$item} ne '') { + $info{$item} = $form->{$item}; + } + } + my $ltoken = &Apache::lonnet::tmpput(\%info, + $r->dir_config('lonHostID'),'retry'); + if ($ltoken) { + $retry .= (($retry =~ /\?/) ? '&' : '?').'ltoken='.$ltoken; } } } elsif ($querystr ne '') { @@ -258,18 +371,28 @@ sub failed { my $end_page = &Apache::loncommon::end_page(); &Apache::loncommon::content_type($r,'text/html'); $r->send_http_header; - my @actions = - (&mt('Please [_1]log in again[_2].','','')); + if ($authtype =~ /^lti:/) { + $message = &mt('Direct login is not supported with the username you entered.'). + '

'. + &mt('You likely need to launch LON-CAPA from within a course in a different Learning Management System.'). + '
'. + &mt('You can also try to log in with a different username.'); + @actions = + (&mt('Try your [_1]log in again[_2].','','')); + } else { + $message = &mt($message); + @actions = + (&mt('Please [_1]log in again[_2].','','')); + } my $loginhelp = &loginhelpdisplay($udom); if ($loginhelp) { push(@actions, ''.&mt('Login problems?').''); } #FIXME: link to helpdesk might be added here - $r->print( $start_page .'

'.&mt('Sorry ...').'

' - .&Apache::lonhtmlcommon::confirm_success(&mt($message),1).'

' + .&Apache::lonhtmlcommon::confirm_success($message,1).'

' .&Apache::lonhtmlcommon::actionbox(\@actions) .$end_page ); @@ -332,6 +455,58 @@ sub handler { if ($firsturl ne '') { $info{'firsturl'} = $firsturl; $dest = $firsturl; + my $relogin; + if ($dest =~ m{^/tiny/$match_domain/\w+$}) { + if ($env{'request.course.id'}) { + my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'}; + my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'}; + my $symb = &Apache::loncommon::symb_from_tinyurl($dest,$cnum,$cdom); + if ($symb) { + unless (&set_deeplink_login(%info) eq 'ok') { + $relogin = 1; + } + } + } + if ($relogin) { + $r->print( + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please [_1]log out[_2] first, and then try your access again', + '','') + .'

' + .$end_page); + } else { + if (($info{'linkprot'}) || ($info{'linkkey'} ne '')) { + if (($info{'linkprot'}) && ($info{'linkprotuser'} ne '')) { + unless ($info{'linkprotuser'} eq $env{'user.name'}.':'.$env{'user.domain'}) { + $r->print( + $start_page + .'

'.&mt('You are already logged in, but as a different user from the one expected for the link you followed from another system').'

' + .'

'.&mt('Please [_1]log out[_2] first, and then try following the link again from the other system', + '','') + + .'

' + .$end_page); + return OK; + } + } + my $token = &Apache::lonnet::tmpput(\%info,$r->dir_config('lonHostID'),'link'); + unless (($token eq 'con_lost') || ($token eq 'refused') || + ($token eq 'unknown_cmd') || ($token eq 'no_such_host')) { + $dest .= (($dest =~ /\?/) ? '&' : '?') . 'ttoken='.$token; + } + } + $r->print( + $start_page + .'

'.&mt('You are already logged in!').'

' + .'

'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4] first, and then try your access again', + '','', + '','') + .'

' + .$end_page); + } + return OK; + } } } } @@ -399,6 +574,9 @@ sub handler { my ($key,$value) = split(/=/,$item); $form{$key} = &unescape($value); } + if ($firsturl =~ m{^/tiny/$match_domain/\w+$}) { + $form{'firsturl'} = $firsturl; + } my $upass = &Apache::loncommon::des_decrypt($des_key,$form{'upass0'}); # ---------------------------------------------------------------- Authenticate @@ -420,9 +598,33 @@ sub handler { # --------------------------------------------------------------------- Failed? if ($authhost eq 'no_host') { - &failed($r,'Username and/or password could not be authenticated.', - \%form); - return OK; + my $pwdverify; + if (&Apache::lonnet::homeserver($form{'uname'},$form{'udom'}) eq 'no_host') { + my %possunames = &alternate_unames_check($form{'uname'},$form{'udom'}); + if (keys(%possunames) > 0) { + foreach my $rulematch (keys(%possunames)) { + my $possuname = $possunames{$rulematch}; + if (($possuname ne '') && ($possuname =~ /^$match_username$/)) { + $authhost=Apache::lonnet::authenticate($possuname,$upass, + $form{'udom'},undef, + $clientcancheckhost); + if (($authhost eq 'no_host') || ($authhost eq 'no_account_on_host')) { + next; + } elsif (($authhost ne '') && (&Apache::lonnet::hostname($authhost) ne '')) { + $pwdverify = 1; + &Apache::lonnet::logthis("Authenticated user: $possuname was submitted as: $form{'uname'}"); + $form{'uname'} = $possuname; + last; + } + } + } + } + } + unless ($pwdverify) { + &failed($r,'Username and/or password could not be authenticated.', + \%form,$authhost); + return OK; + } } elsif ($authhost eq 'no_account_on_host') { if ($defaultauth) { my $domdesc = &Apache::lonnet::domain($form{'udom'},'description'); @@ -542,6 +744,18 @@ sub handler { } } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + if (($form{'linkprot'}) && ($form{'linkprotuser'} ne '')) { + unless($form{'linkprotuser'} eq $form{'uname'}.':'.$form{'udom'}) { + delete($form{'udom'}); + delete($form{'uname'}); + &failed($r,'Username and/or domain are different to that expected for the link you followed from another system', + \%form,$authhost); + return OK; + } + } + } + my ($is_balancer,$otherserver); unless ($hosthere) { @@ -583,6 +797,24 @@ sub handler { if ($form{'symb'}) { $switchto .= '&symb='.$form{'symb'}; } + if ($form{'linkprot'}) { + $env{'request.linkprot'} = $form{'linkprot'}; + foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') { + if ($form{$item}) { + $env{'request.'.$item} = $form{$item}; + } + } + } elsif ($form{'linkkey'} ne '') { + $env{'request.linkkey'} = $form{'linkkey'}; + } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + &set_deeplink_login(%form); + } elsif ($firsturl eq '/adm/email') { + if ($form{'display'} && ($form{'mailrecip'} eq "$form{'uname'}:$form{'udom'}")) { + $env{'request.display'} = $form{'display'}; + $env{'request.mailrecip'} = $form{'mailrecip'}; + } + } $r->internal_redirect($switchto); } else { &Apache::loncommon::content_type($r,'text/html'); @@ -606,6 +838,24 @@ sub handler { if ($form{'symb'}) { $switchto .= '&symb='.$form{'symb'}; } + if ($form{'linkprot'}) { + $env{'request.linkprot'} = $form{'linkprot'}; + foreach my $item ('linkprotuser','linkprotexit','linkprotpbid','linkprotpburl') { + if ($form{$item}) { + $env{'request.'.$item} = $form{$item}; + } + } + } elsif ($form{'linkkey'} ne '') { + $env{'request.linkkey'} = $form{'linkkey'}; + } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + &set_deeplink_login(%form); + } elsif ($firsturl eq '/adm/email') { + if ($form{'display'} && ($form{'mailrecip'} eq "$form{'uname'}:$form{'udom'}")) { + $env{'request.display'} = $form{'display'}; + $env{'request.mailrecip'} = $form{'mailrecip'}; + } + } $r->internal_redirect($switchto); } else { &Apache::loncommon::content_type($r,'text/html'); @@ -637,6 +887,19 @@ sub handler { if ($unloaded) { &success($r,$form{'uname'},$form{'udom'},$authhost,'noredirect', undef,\%form); + if ($form{'linkprot'}) { + $env{'request.linkprot'} = $form{'linkprot'}; + } elsif ($form{'linkkey'} ne '') { + $env{'request.linkkey'} = $form{'linkkey'}; + } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + &set_deeplink_login(%form); + } elsif ($firsturl eq '/adm/email') { + if ($form{'display'} && ($form{'mailrecip'} eq "$form{'uname'}:$form{'udom'}")) { + $env{'request.display'} = $form{'display'}; + $env{'request.mailrecip'} = $form{'mailrecip'}; + } + } $r->internal_redirect('/adm/switchserver?otherserver='.$unloaded.'&origurl='.$firsturl); return OK; } @@ -655,9 +918,59 @@ sub handler { $form{$item} = $sessiondata{$item}; } } + if ($sessiondata{'origurl'} eq '/adm/email') { + if (($sessiondata{'display'}) && ($sessiondata{'mailrecip'})) { + if (&unescape($sessiondata{'mailrecip'}) eq "$form{'uname'}:$form{'udom'}") { + $form{'display'} = &unescape($sessiondata{'display'}); + $form{'mailrecip'} = &unescape($sessiondata{'mailrecip'}); + } + } + } + } + } + if ($form{'linkprot'}) { + my ($linkprotector,$uri) = split(/:/,$form{'linkprot'},2); + if ($linkprotector) { + $extra_env = {'user.linkprotector' => $linkprotector, + 'user.linkproturi' => $uri}; + } + } elsif ($form{'linkkey'} ne '') { + $extra_env = {'user.deeplinkkey' => $form{'linkkey'}, + 'user.keyedlinkuri' => $form{'firsturl'}}; + } + if ($form{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + &set_deeplink_login(%form); + if ($form{'linkprot'}) { + if (ref($extra_env) eq 'HASH') { + %{$extra_env} = ( %{$extra_env}, 'request.linkprot' => $form{'linkprot'} ); + } else { + $extra_env = {'request.linkprot' => $form{'linkprot'}}; + } + if ($form{'linkprotexit'}) { + $extra_env->{'request.linkprotexit'} = $form{'linkprotexit'}; + } + if ($form{'linkprotpbid'}) { + $extra_env->{'request.linkprotpbid'} = $form{'linkprotpbid'}; + } + if ($form{'linkprotpburl'}) { + $extra_env->{'request.linkprotpburl'} = $form{'linkprotpburl'}; + } + } elsif ($form{'linkkey'} ne '') { + if (ref($extra_env) eq 'HASH') { + %{$extra_env} = ( %{$extra_env}, 'request.linkkey' => $form{'linkkey'} ); + } else { + $extra_env = {'request.linkkey' => $form{'linkkey'}}; + } + } + if ($env{'request.deeplink.login'}) { + if (ref($extra_env) eq 'HASH') { + %{$extra_env} = ( %{$extra_env}, 'request.deeplink.login' => $form{'firsturl'} ); + } else { + $extra_env = {'request.deeplink.login' => $form{'firsturl'}}; + } } } - &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,undef, + &success($r,$form{'uname'},$form{'udom'},$authhost,$firsturl,$extra_env, \%form); return OK; } @@ -679,11 +992,58 @@ sub get_form_items { return %form; } +sub set_deeplink_login { + my (%form) = @_; + my $disallow; + if ($form{'firsturl'} =~ m{^/tiny/($match_domain)/\w+$}) { + my $cdom = $1; + my ($cnum,$symb) = &Apache::loncommon::symb_from_tinyurl($form{'firsturl'},'',$cdom); + if ($symb) { + if ($env{'request.course.id'} eq $cdom.'_'.$cnum) { + my $deeplink; + if ($symb =~ /\.(page|sequence)$/) { + my $mapname = &Apache::lonnet::deversion((&Apache::lonnet::decode_symb($symb))[2]); + my $navmap = Apache::lonnavmaps::navmap->new(); + if (ref($navmap)) { + $deeplink = $navmap->get_mapparam(undef,$mapname,'0.deeplink'); + } + } else { + $deeplink = &Apache::lonnet::EXT('resource.0.deeplink',$symb); + } + if ($deeplink ne '') { + my ($state,$others,$listed,$scope,$protect) = split(/,/,$deeplink); + if (($protect ne 'none') && ($protect ne '')) { + my ($acctype,$item) = split(/:/,$protect); + if ($acctype =~ /lti(c|d)$/) { + unless ($form{'linkprot'} eq $item.$1.':'.$env{'request.deeplink.login'}) { + $disallow = 1; + } + } elsif ($acctype eq 'key') { + unless ($form{'linkkey'} eq $item) { + $disallow = 1; + } + } + } + } + unless ($disallow) { + $env{'request.deeplink.login'} = $form{'firsturl'}; + } + } else { + $env{'request.deeplink.login'} = $form{'firsturl'}; + } + } + } + if ($disallow) { + return; + } + return 'ok'; +} + sub set_retry_token { my ($form,$lonhost,$querystr) = @_; if (ref($form) eq 'HASH') { my ($firsturl,$token,$extras,@names); - @names = ('role','symb','iptoken'); + @names = ('role','symb','linkprotuser','linkprotexit','linkprot','linkkey','iptoken','linkprotpbid','linkprotpburl'); foreach my $name (@names) { if ($form->{$name} ne '') { $extras .= '&'.$name.'='.&escape($form->{$name}); @@ -751,6 +1111,7 @@ sub check_can_host { my $alias = &Apache::lonnet::use_proxy_alias($r,$login_host); $hostname = $alias if ($alias ne ''); my $newurl = $protocol.'://'.$hostname.'/adm/createaccount'; +#FIXME Should preserve where user was going and linkprot by setting ltoken at $login_host $r->print(&Apache::loncommon::start_page('Create a user account in LON-CAPA'). '

'.&mt('Account creation').'

'. &mt('You do not currently have a LON-CAPA account at this institution.').'
'. @@ -767,6 +1128,19 @@ sub check_can_host { } else { &success($r,$form->{'uname'},$udom,$authhost,'noredirect',undef, $form); + if ($form->{'firsturl'} =~ m{^/tiny/$match_domain/\w+$}) { + $env{'request.deeplink.login'} = $form->{'firsturl'}; + } elsif ($form->{'firsturl'} eq '/adm/email') { + if ($form->{'display'} && ($form->{'mailrecip'} eq $form->{'uname'}.':'.$form->{'udom'})) { + $env{'request.display'} = $form->{'mailrecip'}; + $env{'request.mailrecip'} = $form->{'mailrecip'}; + } + } + if ($form->{'linkprot'}) { + $env{'request.linkprot'} = $form->{'linkprot'}; + } elsif ($form->{'linkkey'} ne '') { + $env{'request.linkkey'} = $form->{'linkkey'}; + } my ($otherserver) = &Apache::lonnet::choose_server($udom); $r->internal_redirect('/adm/switchserver?otherserver='.$otherserver); } @@ -810,6 +1184,20 @@ sub loginhelpdisplay { return; } +sub alternate_unames_check { + my ($uname,$udom) = @_; + my %possunames; + my %domdefs = &Apache::lonnet::get_domain_defaults($udom); + if (ref($domdefs{'unamemap_rule'}) eq 'ARRAY') { + if (@{$domdefs{'unamemap_rule'}} > 0) { + %possunames = + &Apache::lonnet::inst_rulecheck($udom,$uname,undef, + 'unamemap',$domdefs{'unamemap_rule'}); + } + } + return %possunames; +} + 1; __END__