File:
[LON-CAPA] /
loncom /
auth /
lonshibauth.pm
Revision
1.11:
download - view:
text,
annotated -
select for diffs
Tue Oct 26 15:52:54 2021 UTC (2 years, 11 months ago) by
raeburn
Branches:
MAIN
CVS tags:
HEAD
- Use token to store role, symb, linkprot, and/or linkkey when dual log-in
page to support SSO (Shibboleth) and non-SSO is in use, and for "log in
again" retry link for failed login, instead of using query string directly.
- When digest is used by tmpput handler in lond to generate an id, only use
id which does not already exist in LON-CAPA's tmp directory.
# The LearningOnline Network
# Redirect Shibboleth authentication to designated URL (/adm/sso).
#
# $Id: lonshibauth.pm,v 1.11 2021/10/26 15:52:54 raeburn Exp $
#
# Copyright Michigan State University Board of Trustees
#
# This file is part of the LearningOnline Network with CAPA (LON-CAPA).
#
# LON-CAPA is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# LON-CAPA is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with LON-CAPA; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# /home/httpd/html/adm/gpl.txt
#
# http://www.lon-capa.org/
#
=head1 NAME
Apache::lonshibauth - Redirect Shibboleth authentication
=head1 SYNOPSIS
Invoked when lonOtherAuthen is set to yes, and type is Shibboleth
If server is configured as a Shibboleth SP, the main Apache
configuration file, e.g., /etc/httpd/conf/httpd.conf
(for RHEL/CentOS/Scentific Linux/Fedora) should contain:
LoadModule mod_shib /usr/lib/shibboleth/mod_shib_22.so
or equivalent (depending on Apache version)
before the line to include conf/loncapa_apache.conf
=head1 INTRODUCTION
Redirects a user requiring Single Sign On via Shibboleth to a
URL -- /adm/sso -- on the server which is configured to use that service.
=head1 HANDLER SUBROUTINE
This routine is called by Apache and mod_perl.
=over 4
If $r->user defined and requested uri not /adm/sso
redirect to /adm/sso
Otherwise return DECLINED
=back
=cut
package Apache::lonshibauth;
use strict;
use lib '/home/httpd/lib/perl/';
use Apache::lonnet;
use Apache::loncommon;
use Apache::lonacc;
use Apache::Constants qw(:common REDIRECT);
use LONCAPA qw(:DEFAULT :match);
sub handler {
my $r = shift;
my $target = '/adm/sso';
if (&Apache::lonnet::get_saml_landing()) {
$target = '/adm/login';
}
if (($r->user eq '') && ($r->uri ne $target) && ($r->uri ne '/adm/sso')) {
my $lonhost = $Apache::lonnet::perlvar{'lonHostID'};
my $hostname = &Apache::lonnet::hostname($lonhost);
if (!$hostname) { $hostname = $r->hostname(); }
my $protocol = $Apache::lonnet::protocol{$lonhost};
unless ($protocol eq 'https') { $protocol = 'http'; }
my $alias = &Apache::lonnet::use_proxy_alias($r,$lonhost);
if (($alias ne '') &&
(&Apache::lonnet::alias_shibboleth($lonhost))) {
$hostname = $alias;
}
my $dest = $protocol.'://'.$hostname.$target;
if ($target eq '/adm/login') {
my $querystring = &set_token($r,$lonhost);
if ($querystring ne '') {
$dest .= '?'.$querystring;
}
} else {
my $uri = $r->uri;
if ($r->args ne '') {
$dest .= (($dest=~/\?/)?'&':'?').$r->args;
}
unless (($uri eq '/adm/roles') || ($uri eq '/adm/logout')) {
unless ($r->args =~ /origurl=/) {
$dest.=(($dest=~/\?/)?'&':'?').'origurl='.$uri;
}
}
if ($uri =~ m{^/tiny/$match_domain/\w+$}) {
unless (($r->args =~ /ltoken=/) || ($r->args =~ /linkkey=/)) {
&Apache::lonacc::get_posted_cgi($r,['linkkey']);
if ($env{'form.linkkey'} ne '') {
$dest.=(($dest=~/\?/)?'&':'?').'linkkey='.$env{'form.linkkey'};
}
}
}
}
$r->header_out(Location => $dest);
return REDIRECT;
} else {
return DECLINED;
}
}
sub set_token {
my ($r,$lonhost) = @_;
my ($firsturl,$querystring,$ssotoken,@names,%token);
@names = ('role','symb','ltoken','linkkey');
map { $token{$_} = 1; } @names;
unless (($r->uri eq '/adm/roles') || ($r->uri eq '/adm/logout')) {
$firsturl = $r->uri;
}
if ($r->args ne '') {
&Apache::loncommon::get_unprocessed_cgi($r->args);
}
if ($r->uri =~ m{^/tiny/$match_domain/\w+$}) {
unless (($env{'form.ltoken'}) || ($env{'form.linkkey'})) {
&Apache::lonacc::get_posted_cgi($r,['linkkey']);
}
}
my $extras;
foreach my $name (@names) {
if ($env{'form.'.$name} ne '') {
if ($name eq 'ltoken') {
my %info = &Apache::lonnet::tmpget($env{'form.ltoken'});
if ($info{'linkprot'}) {
$extras .= '&linkprot='.&escape($info{'linkprot'});
last;
}
} else {
$extras .= '&'.$name.'='.&escape($env{'form.'.$name});
}
}
}
if (($firsturl ne '') || ($extras ne '')) {
$extras .= ':sso';
$ssotoken = &Apache::lonnet::reply('tmpput:'.&escape($firsturl).
$extras,$lonhost);
$querystring = 'sso='.$ssotoken;
}
if ($r->args ne '') {
foreach my $key (sort(keys(%env))) {
if ($key =~ /^form\.(.+)$/) {
my $name = $1;
next if ($token{$name});
$querystring .= '&'.$name.'='.$env{$key};
}
}
}
return $querystring;
}
1;
__END__
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>