loncom/auth/switchserver.pm - view

File: [LON-CAPA] / loncom / auth / switchserver.pm
Revision 1.42: download - view: text, annotated - select for diffs
Sat Nov 24 16:19:04 2018 UTC (5 years, 7 months ago) by raeburn
Branches: MAIN
CVS tags: HEAD

- Domain config for load balancer to use cookie to record offload target.
  Subsequent requests by same user/browser will send requests to same target
  if remote session still active, and remote node not overloaded.

1: # The LearningOnline Network 2: # Switch Servers Handler 3: # 4: # $Id: switchserver.pm,v 1.42 2018/11/24 16:19:04 raeburn Exp $ 5: # 6: # Copyright Michigan State University Board of Trustees 7: # 8: # This file is part of the LearningOnline Network with CAPA (LON-CAPA). 9: # 10: # LON-CAPA is free software; you can redistribute it and/or modify 11: # it under the terms of the GNU General Public License as published by 12: # the Free Software Foundation; either version 2 of the License, or 13: # (at your option) any later version. 14: # 15: # LON-CAPA is distributed in the hope that it will be useful, 16: # but WITHOUT ANY WARRANTY; without even the implied warranty of 17: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18: # GNU General Public License for more details. 19: # 20: # You should have received a copy of the GNU General Public License 21: # along with LON-CAPA; if not, write to the Free Software 22: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23: # 24: # /home/httpd/html/adm/gpl.txt 25: # 26: # http://www.lon-capa.org/ 27: # 28: 29: package Apache::switchserver; 30: 31: use strict; 32: use Apache::Constants qw(:common); 33: use Apache::lonnet; 34: use Apache::lonmenu; 35: use Digest::MD5 qw(md5_hex); 36: use CGI::Cookie(); 37: use Apache::lonlocal; 38: use LONCAPA qw(:DEFAULT :match); 39: 40: sub init_env { 41: my ($r) = @_; 42: 43: if (-e $env{'user.environment'}) { 44: return $env{'user.environment'}; 45: } 46: my $requrl=$r->uri; 47: my $handle= &Apache::lonnet::check_for_valid_session($r); 48: if ($handle ne '') { 49: return undef; 50: } 51: my $lonidsdir=$r->dir_config('lonIDsDir'); 52: &Apache::lonnet::transfer_profile_to_env($lonidsdir,$handle); 53: 54: return $r->dir_config('lonIDsDir')."/$handle.id"; 55: } 56: 57: sub do_redirect { 58: my ($r,$url,$only_body,$extra_text) = @_; 59: $r->send_http_header; 60: my $start_page = 61: &Apache::loncommon::start_page('Switching Server ...',undef, 62: {'redirect' => [0.5,$url], 63: 'only_body' => $only_body,}); 64: my $end_page = &Apache::loncommon::end_page(); 65: $r->print($start_page.$extra_text.$end_page); 66: unless ($env{'user.name'} eq 'public' && ($env{'user.domain'} eq 'public')) { 67: $r->register_cleanup(\&flush_course_logs); 68: } 69: return OK; 70: } 71: 72: sub flush_course_logs { 73: &Apache::lonnet::flushcourselogs(); 74: return OK; 75: } 76: 77: sub handler { 78: my ($r) = @_; 79: 80: my $handle=&init_env($r); 81: if (!defined($handle)) { return FORBIDDEN; } 82: 83: &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'}, 84: ['otherserver','role','origurl','symb']); 85: 86: my $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'}); 87: if (! $env{'form.otherserver'}) { 88: $env{'form.otherserver'} = 89: &Apache::lonnet::find_existing_session($env{'user.domain'}, 90: $env{'user.name'}); 91: if (! $env{'form.otherserver'}) { 92: $env{'form.otherserver'} = 93: &Apache::lonnet::spareserver(30000,undef,1); 94: } 95: $switch_to=&Apache::lonnet::hostname($env{'form.otherserver'}); 96: } 97: 98: if (!defined($switch_to)) { return FORBIDDEN; } 99: 100: my $protocol = 'http'; 101: if ($env{'form.otherserver'}) { 102: if ($Apache::lonnet::protocol{$env{'form.otherserver'}} eq 'https') { 103: $protocol = $Apache::lonnet::protocol{$env{'form.otherserver'}}; 104: } 105: } 106: 107: if ($env{'user.name'} eq 'public' 108: && $env{'user.domain'} eq 'public') { 109: my $url = $protocol.'://'.$switch_to.$r->uri; 110: unlink($handle); 111: #expire the cookie 112: my $c = new CGI::Cookie(-name => 'lonPubID', 113: -value => '', 114: -expires => '-10y',); 115: $r->header_out('Set-cookie' => $c); 116: return &do_redirect($r,$url,1) 117: } 118: 119: my $skip_canhost_check = ''; 120: if ($env{'form.role'}) { 121: if (!exists($env{'user.role.'.$env{'form.role'}})) { 122: delete($env{'form.role'}); 123: } else { 124: my $now = time; 125: my ($start,$end) = split(/\./,$env{'user.role.'.$env{'form.role'}}); 126: if (($start && $start > $now) || ($end && $end < $now)) { 127: delete($env{'form.role'}); 128: } elsif ($env{'form.role'} eq 'au./'.$env{'user.domain'}.'/') { 129: if (&Apache::lonnet::homeserver($env{'user.name'},$env{'user.domain'}) eq $env{'form.otherserver'}) { 130: $skip_canhost_check = 1; 131: } 132: } elsif ($env{'form.role'} =~ m{^[ac]a\./($match_domain)/($match_username)$}) { 133: my ($audom,$auname) = ($1,$2); 134: if (&Apache::lonnet::homeserver($auname,$audom) eq $env{'form.otherserver'}) { 135: if ((&Apache::lonnet::will_trust('othcoau',$audom,$env{'user.domain'})) && 136: (&Apache::lonnet::will_trust('coremau',$env{'user.domain'},$audom))) { 137: $skip_canhost_check = 1; 138: } 139: } 140: } 141: } 142: } 143: 144: unless ($skip_canhost_check) { 145: my $canhost = 1; 146: my $uprimary_id = &Apache::lonnet::domain($env{'user.domain'},'primary'); 147: my $uint_dom = &Apache::lonnet::internet_dom($uprimary_id); 148: my @intdoms; 149: my $internet_names = &Apache::lonnet::get_internet_names($env{'form.otherserver'}); 150: if (ref($internet_names) eq 'ARRAY') { 151: @intdoms = @{$internet_names}; 152: } 153: unless ($uint_dom ne '' && grep(/^\Q$uint_dom\E$/,@intdoms)) { 154: my $serverhomeID = &Apache::lonnet::get_server_homeID($switch_to); 155: my $serverhomedom = &Apache::lonnet::host_domain($serverhomeID); 156: my %defdomdefaults = &Apache::lonnet::get_domain_defaults($serverhomedom); 157: my %udomdefaults = &Apache::lonnet::get_domain_defaults($env{'user.domain'}); 158: my $remoterev = &Apache::lonnet::get_server_loncaparev($env{'user.domain'},$env{'form.otherserver'}); 159: $canhost = 160: &Apache::lonnet::can_host_session($env{'user.domain'}, 161: $env{'form.otherserver'}, 162: $remoterev, 163: $udomdefaults{'remotesessions'}, 164: $defdomdefaults{'hostedsessions'}); 165: } 166: unless ($canhost) { return FORBIDDEN; } 167: } 168: 169: #remove session env, and log event 170: if (unlink($handle)) { 171: if ($env{'user.linkedenv'} ne '') { 172: my $lonidsdir=$r->dir_config('lonIDsDir'); 173: if (($env{'user.linkedenv'} =~ /^[a-f0-9]+_linked$/) && 174: (-l "$lonidsdir/$env{'user.linkedenv'}.id") && 175: (readlink("$lonidsdir/$env{'user.linkedenv'}.id") eq $handle)) { 176: unlink("$lonidsdir/$env{'user.linkedenv'}.id"); 177: } 178: } 179: } 180: my $now = time; 181: my %temp=('switchserver' => $now.':'.$env{'form.otherserver'}, 182: $env{'form.role'}); 183: &Apache::lonnet::put('email_status',\%temp); 184: my $logmsg = "Switch Server to $env{'form.otherserver'}"; 185: if ($env{'form.role'}) { 186: $logmsg .= " with role: $env{'form.role'}"; 187: } elsif (($env{'form.lti.reqcrs'}) && ($env{'form.lti.reqrole'} eq 'cc')) { 188: $logmsg .= " to create new LTI course"; 189: } elsif ($env{'form.lti.selfenrollrole'}) { 190: $logmsg .= " to selfenroll with role: $env{'form.lti.selfenrollrole'}"; 191: } else { 192: $logmsg .= " (no role)"; 193: } 194: $logmsg .= ' '.$ENV{'REMOTE_ADDR'}; 195: &Apache::lonnet::log($env{'user.domain'},$env{'user.name'}, 196: $env{'user.home'},$logmsg); 197: 198: &Apache::loncommon::content_type($r,'text/html'); 199: 200: #expire the cookies 201: my %cookies=CGI::Cookie->parse($r->header_in('Cookie')); 202: foreach my $name (keys(%cookies)) { 203: next unless ($name =~ /^lon(|S|Link|Pub)ID$/); 204: my $c = new CGI::Cookie(-name => $name, 205: -value => '', 206: -expires => '-10y',); 207: $r->headers_out->add('Set-cookie' => $c); 208: } 209: if ($r->header_only) { 210: $r->send_http_header; 211: return OK; 212: } 213: # -------------------------------------------------------- Menu script and info 214: 215: # ---------------------------------------------------------------- Get handover 216: 217: my $newcookieid; 218: (my $is_balancer,undef,my $setcookie) = 219: &Apache::lonnet::check_loadbalancing($env{'user.name'},$env{'user.domain'}); 220: if ($is_balancer && $setcookie && $env{'form.otherserver'}) { 221: 222: # Set a balancer cookie unless browser already sent LON-CAPA load balancer 223: # cookie which points at the target server 224: my ($found_server,$balancer_cookie) = &Apache::lonnet::check_for_balancer_cookie($r,1); 225: 226: unless (($found_server eq $env{'form.otherserver'}) && 227: ($balancer_cookie =~ /^\Q$env{'user.domain'}\E_\Q$env{'user.name'}\E_/)) { 228: my @hosts = &Apache::lonnet::current_machine_ids(); 229: my $desthost = $env{'form.otherserver'}; 230: unless (grep(/^\Q$desthost\E$/,@hosts)) { 231: my $balancedir=$r->dir_config('lonBalanceDir'); 232: $newcookieid = &md5_hex(&md5_hex($now.{}.rand().$$)); 233: my $cookie = $env{'user.domain'}.'_'.$env{'user.name'}.'_'.$newcookieid; 234: my $balcookie = "balanceID=$cookie; path=/; HttpOnly;"; 235: if (open(my $fh,'>',"$balancedir/$cookie.id")) { 236: print $fh $env{'form.otherserver'}; 237: close($fh); 238: } 239: $r->headers_out->add('Set-cookie' => $balcookie); 240: } 241: } 242: } 243: 244: my %info=('ip' => $ENV{'REMOTE_ADDR'}, 245: 'domain' => $env{'user.domain'}, 246: 'username' => $env{'user.name'}, 247: 'role' => $env{'form.role'}, 248: 'server' => $r->dir_config('lonHostID'), 249: 'balancer' => $is_balancer); 250: if ($newcookieid) { 251: $info{'balcookie'} = $newcookieid; 252: } 253: if ($env{'form.origurl'}) { 254: $info{'origurl'} = $env{'form.origurl'}; 255: } 256: if ($env{'form.symb'}) { 257: $info{'symb'} = $env{'form.symb'}; 258: } 259: if ($env{'request.sso.login'}) { 260: $info{'sso.login'} = $env{'request.sso.login'}; 261: } 262: if ($env{'request.sso.reloginserver'}) { 263: $info{'sso.reloginserver'} = $env{'request.sso.reloginserver'}; 264: } 265: if ($env{'request.lti.login'}) { 266: $info{'lti.login'} = $env{'request.lti.login'}; 267: } 268: if ($env{'request.lti.uri'}) { 269: $info{'lti.uri'} = $env{'request.lti.uri'}; 270: } 271: if ($env{'request.lti.reqcrs'}) { 272: $info{'lti.reqcrs'} = $env{'request.lti.reqcrs'}; 273: } 274: if ($env{'request.lti.reqrole'}) { 275: $info{'lti.reqrole'} = $env{'request.lti.reqrole'}; 276: } 277: if ($env{'request.lti.selfenrollrole'}) { 278: $info{'lti.selfenrollrole'} = $env{'request.lti.selfenrollrole'}; 279: } 280: if ($env{'request.lti.sourcecrs'}) { 281: $info{'lti.sourcecrs'} = $env{'request.lti.sourcecrs'}; 282: } 283: if ($env{'request.lti.passbackid'}) { 284: $info{'lti.passbackid'} = $env{'request.lti.passbackid'}; 285: } 286: if ($env{'request.lti.passbackurl'}) { 287: $info{'lti.passbackurl'} = $env{'request.lti.passbackurl'}; 288: } 289: if ($env{'request.lti.rosterid'}) { 290: $info{'lti.rosterid'} = $env{'request.lti.rosterid'}; 291: } 292: if ($env{'request.lti.rosterurl'}) { 293: $info{'lti.rosterurl'} = $env{'request.lti.rosterurl'}; 294: } 295: if ($env{'request.lti.target'}) { 296: $info{'lti.target'} = $env{'request.lti.target'}; 297: } 298: my $token = &Apache::lonnet::tmpput(\%info,$env{'form.otherserver'}); 299: my $url =$protocol.'://'.$switch_to.'/adm/login?'. 300: 'domain='.$env{'user.domain'}. 301: '&username='.$env{'user.name'}. 302: '&token='.$token; 303: # --------------------------------------------------------------- Screen Output 304: return &do_redirect($r, $url, 0); 305: } 306: 307: 1; 308: __END__ 309: 310: 311: 312: 313: 314: 315: 316: