Subject: [LON-CAPA-dev] Environment variables

From: Christian Knieling <[email-masked]>
Date: Wed, 29 Jan 2014 19:20:23 +0100

Hi everybody,

I have a question for the experienced web developers.

My goal is to capture environment variables within LON-CAPA. Those
variables should be/get delivered by a Shibboleth identity provider on
successful authentication.

So, my questions are.

   Will those variables placed into the environment only in
   particular circumstances?

What I mean is, I find those variables in the case of calling a cgi
script but I don't find them when I search for them in any handler that
I tested so far such as "Apache::lontrans", "Apache::lonshibauth",
"Apache::lonshibacc", "Apache::lonacc" or "Apache::createaccount".

So, right now I believe that I won't get those variables in any handler
because it has to be a directly called cgi script.

  Am I wrong with this assumption and I just tested the wrong
  handlers?
  Or can anyone confirm this assumption and behavior?

When I'm right with this assumption:

  Would it be a suitable respectively recommended approach to
  catch those variables by a direct call of such a cgi script,
  save/populate those variables in the environment manually and
  redirect/go on with the standard LON-CAPA processing?

Or to question the other way around:

  Would have had a patch with this above approach a chance to get
  into a release?

Many questions, hopefully anyone has some answers and the time for
telling me them.

Thanks for reading so far ;)
Christian

---

From: Stuart Raeburn <[email-masked]>
Date: Thu, 30 Jan 2014 07:44:58 -0500

Christian,

Thanks for following up on the earlier thread in the lon-capa-admin  
list (e.g.,  
http://mail.lon-capa.org/pipermail/lon-capa-admin/2014-January/002786.html)   
with a post to the lon-capa-dev list.

The lon-capa-dev list is a more appropriate venue for this discussion.

>    particular circumstances?

Shibboleth environment variables in %ENV are available in mod_perl at  
the PerlHandler phase (i.e., createaccount.pm), but not in the earlier  
TransHandler (lontrans.pm) AccesHandler (publiccheck.pm),  
AuthenHandler (lonshibauth.pm) and AuthzHandler (lonshibacc.pm,  
lonacc.pm) phases.

> because it has to be a directly called cgi script.

That is not correct. However, some changes were needed to lonacc.pm  
and createaccount.pm (see below) to make the Shibboleth environment  
variables accessible in createaccount.pm

>   redirect/go on with the standard LON-CAPA processing?

No, that would not be a desirable approach.

> Many questions, hopefully anyone has some answers and the time for

As it turns out, I am currently doing some work on createaccount.pm  
(for bug 6646), so I will be able to fold the minor changes needed to  
support retrieval of Shibboleth environment variables containing user  
information (and their use when creating a new LON-CAPA account for an  
institutionally authenticated user -- Shibboleth SSO), into my current  
work.

I will be including an additional domain configuration to allow  
domains to specify which Shibboleth-supplied variables in %ENV map to  
which LON-CAPA user data fields.  These changes are of sufficiently  
limited scope that I can also roll them into the forthcoming 2.11.0

So far I have committed createaccount.pm rev 1.57, and lonacc.pm 1.153  
(see:  
http://mail.lon-capa.org/pipermail/lon-capa-cvs/Week-of-Mon-20140127/025691.html ) to provide access to the Shibboleth environment variables when creating a new LON-CAPA user  
account.

Stuart Raeburn
LON-CAPA Academic Consortium

Quoting Christian K

---

From: Christian Knieling <[email-masked]>
Date: Thu, 30 Jan 2014 15:55:18 +0100

Hello Stuart,

I appreciate your changes to those files and I can confirm that they
fulfill my needs of accessing those variables.

I would like to support you by contributing a patch to the development
plan of yours concerning the mapping of the Shibboleth data to the
LON-CAPA data fields.
Somehow I have doubts that it'll be of great success if I try. If you
want me too, I'd give it a shot. Whatever you'll say I'll probably try
this on my own here to get into understanding and developing LON-CAPA
(in such a manner as the actual code is written) someday...

As always I've to thank you for everything.

Greetings
Christian

> Christian,
> 
> Thanks for following up on the earlier thread in the lon-capa-admin list
> (e.g.,
> TransHandler (lontrans.pm) AccesHandler (publiccheck.pm), AuthenHandler
> (lonshibauth.pm) and AuthzHandler (lonshibacc.pm, lonacc.pm) phases.
> 
> That is not correct. However, some changes were needed to lonacc.pm and
> createaccount.pm (see below) to make the Shibboleth environment
> As it turns out, I am currently doing some work on createaccount.pm (for
> bug 6646), so I will be able to fold the minor changes needed to support
> retrieval of Shibboleth environment variables containing user
> I will be including an additional domain configuration to allow domains
> to specify which Shibboleth-supplied variables in %ENV map to which
> LON-CAPA user data fields.  These changes are of sufficiently limited
> scope that I can also roll them into the forthcoming 2.11.0
> 
> http://mail.lon-capa.org/pipermail/lon-capa-cvs/Week-of-Mon-20140127/025691.html
> ) to provide access to the Shibboleth environment variables when
> creating a new LON-CAPA user account.
> 
> 
> Stuart Raeburn