[LON-CAPA-cvs] cvs: loncom /html/adm/help/tex Domain_Configuration_Login_Page.tex

[raeburn]

raeburn		Wed Dec  8 14:45:01 2021 EDT

  Modified files:              
    /loncom/html/adm/help/tex	Domain_Configuration_Login_Page.tex 
  Log:
  - Update log-in page documentation, e.g., dual login (SSO + non-SSO options)
  
  
Index: loncom/html/adm/help/tex/Domain_Configuration_Login_Page.tex
diff -u loncom/html/adm/help/tex/Domain_Configuration_Login_Page.tex:1.9 loncom/html/adm/help/tex/Domain_Configuration_Login_Page.tex:1.10
--- loncom/html/adm/help/tex/Domain_Configuration_Login_Page.tex:1.9	Thu Mar 30 02:09:17 2017
+++ loncom/html/adm/help/tex/Domain_Configuration_Login_Page.tex	Wed Dec  8 14:45:01 2021
@@ -1,4 +1,7 @@
 \label{Domain_Configuration_Login_Page}
+
+\textbf{Log-in Service}
+
 If your domain has more than one server you have the option to configure whether 
 any of the servers will redirect to another server whenever the log-in page is requested.  This can be useful if you maintain a portal or ``Load Balancer'' server which 
 forms your institution's gateway to LON-CAPA. You can specify the path to which 
@@ -6,6 +9,10 @@
 IP addresses should be exempt from the redirection.  The exemption is useful 
 if you run a monitoring script which tests log-in, course display, and logout periodically for each of your LON-CAPA servers.
 
+\hfill{}
+
+\textbf{Log-in Page Items}
+
 If your domain only has one LON-CAPA server, or you have multiple servers and will 
 display their log-in pages, their appearance can be customized as follows:
 
@@ -17,8 +24,6 @@
 Logos displayed in the login page configuration table are scaled down
 from the full size used in the login-page itself. 
 
-
-
 \hfill{}
 
 \noindent The following elements are configurable: 
@@ -57,6 +62,8 @@
 
 \hfill{}
 
+\textbf{Log-in Help}
+
 Where the ``Contact Helpdesk'' web form is in use it can be configured to include a CAPTCHA
 mechanism to discourage robotic form completion.  There are two types of CAPTCHA to choose
 from -- the ``original'' CAPTCHA which uses a self-contained perl module included with the
@@ -69,10 +76,65 @@
 
 \hfill{}
 
+\textbf{Custom HTML in document head}
+
 The head portion of the log-in page may contain custom mark up (e.g., a script block containing
 javascript for page analytics) in a file which will be uploaded and published public.
 Different custom markup may be uploaded for each server in a domain, and a comma separated list
 of IP addresses may be specified for which the custom markup will not not be included in the page, 
 when the request for the log-in page originates from one of those addresses. A use case for the
 exempt IP addresses is where robotic requests for the log-in page and made from a monitoring
-machine, used to detect when a LON-CAPA server is not working correctly. 
+machine, used to detect when a LON-CAPA server is not working correctly.
+
+\hfill{}
+
+\textbf{Dual login: SSO and non-SSO}
+
+For a LON-CAPA node configured to support Single Sign On (SSO), e.g., by operating as a Shibboleth SP,
+entries in Apache config files (loncapa_apache.conf, if Shibboleth) will cause display of an SSO login page
+when a user without a current LON-CAPA session accesses /adm/roles.  If, instead, it is preferred
+to display /adm/login configured to offer dual SSO log-in (e.g., Shibboleth), and non-SSO login
+(i.e., LON-CAPA), that can be set using the ``Dual login: SSO and non-SSO options'' section.
+
+Check the ``Yes'' radio button for each of the domain's servers which will offer dual login check "Yes" and then set:  
+
+\begin{itemize}
+\item SSO: Text, Image, Alt Text, URL, Tool Tip
+\item non-SSO: Text
+\end{itemize}
+
+The value in the URL field will be /adm/sso for Shibboleth, and the image will be for a button to be clicked
+to load /adm/sso to prompt for SSO login. The alt and title attributes for the button can also be set.
+
+With this in effect the LON-CAPA login page /adm/login will display the following:
+
+\begin{itemize}
+\item Log-in type:
+Immediately followed by the text for either SSO, or non-SSO login, as entered in the ``Dual login: SSO and non-SSO options'' 
+textboxes for SSO and non-SSO.
+
+\item Change?
+A link below the ``Login type:'' line which can be used to toggle between the SSO and non-SSO logins
+
+\item Button (SSO) or Log-in box (non-SSO)
+
+\begin{itemize}
+
+\item SSO - an image (i.e., clickable button) which as uploaded in the SSO option item, with alt text, and a tool tip
+shown when hovering over the button.
+
+\item Non-SSO - standard LON-CAPA login box for username, password, domain and "Log In" button.
+
+\end{itemize}
+
+\end{itemize}
+
+If the SSO service is something other than Shibboleth (e.g., CAS or Sentinel) and the PerlVar lonOtherAuthenUrl has
+been set to a preferred URL (e.g., /adm/sentinel), then the URL item in the SSO entry in the dual login options
+should be set to that preferred URL also.
+
+Note: if the original page request by an unauthenticated user included a query string with any of the following items:
+role, symb, and linkkey, then they will be stored in a token file on the server, for access later to support deep-linking. 
+Similarly, if the query string contained an ltoken item from successful launch from an LTI Consumer, where LON-CAPA is the LTI Provider,
+and for that Consumer LON-CAPA is not configured to accept user information, and the destination is a deep-link URL:
+/tiny/domain/uniqueID, then the LTI number, type (c or d), and tiny URL will be saved as the linkprot item in a token file.