You're looking at an older version of Totara Learn.

Please see Totara 13 help for the latest version.

Network Settings

  • You are here: Home > Administration > Network > Settings

Networking  is a feature in Totara enabling resources to be shared between Totara sites using a single sign-on. If you want to setup networking with other Totara sites contact Totara support.

Your server must have Curl and OpenSSL PHP extensions installed in order to use Totara Networking.

Networking with MNET

  • You are here: Home > Administration > Network >

The network feature allows a Totara administrator to establish a link with another Totara, and to share some resources with the users of that Totara.

The initial release of MNet is bundled with a Authentication Plugin, which makes single-sign-on between multiple Totara possible. A user with the username jody logs in to her Totara server as normal, and clicks on a link that takes her to a page on another Totara server. Normally, she would have only the privileges of a guest on the remote Totara, but behind the scenes, single-sign-on has established a fully authenticated session for Jody on the remote site.

WARNING: MNet requires the use of xmlrpc. Please go to your phpinfo page if you are interested in using this and search for --with-xmlrpc. If your php has not been compiled with xmlrpc then you need to address that first! At present it appears that PEAR xmlrpc will not work.

Security

The MNet feature requires that your server has the Curl and OpenSSL extensions installed. When you install Totara, your system will generate a new OpenSSL certificate for encrypted communication with other Totaras, and will thereafter rotate encryption keys on a monthly basis (approx).

Communication takes place over an XML-RPC transport, and the XML-RPC documents are wrapped first in an XMLDSIG (XML digital signature) envelope, and then in an XMLENC (XML encryption) envelope. The encryption all happens within PHP, and does not require an https (Apache SSL) server.

References:

A special mode can be enabled which would allow a machine with a specified IP address to make calls to the XML-RPC layer without using either encryption or signature envelopes. This mode is provided to enable Totara to communicate with other software systems in which the integration of signatures and encryption might be prohibitively difficult. It is not envisioned that unencrypted inter-Moodle networking will ever be enabled.

Peer to peer network

This is the basic layout of the system. It can be very useful to run one Totara per faculty or departments, each with its own user management, and yet permit users to roam across the Totara installs... subject to permissions of course.

Setup

The instructions will cover 2 Totara installations: TotaraA and TotaraB. Both are installed correctly and have never had a Totara Network configuration.

Note: If you experience problems, ensure debugging is turned on in Site Administration > Server > Debugging. Extra diagnostic messages may be displayed

  1. Get them to talk to each other
    1. Ensure Admin > Server > Environment indicates you have curl installed
    2. If TotaraA and TotaraB are hosted in the same domain, ensure they have a different cookie prefix. Note that changing the cookie prefix will log you out! You can change the cookie prefix via Admin > Server > Session Handling.
    3. On both, go to Admin > Network > Settings and turn Networking ON.
    4. On TotaraA go to Admin > Network > Peers - put the URL of TotaraB under "Add New Host" and click Add. The URL should include the directory where your Totara code is located, for example www.mytotara.org/totara.
    5. Do the equivalent on TotaraB.
  2. Get user roaming going
    1. On both, go to Administration > Plugins > Authentication > Manage authentication in 2.0 onwards or Administration > Users > Authentication > Manage authentication in 1.9 and enable Moodle Network authentication plugin. Click on 'Settings' and enable auto_add_remote_users.
    2. On TotaraA go to Admin > Network > Peers, click on 'TotaraB', and click on 'Services'. Enable SSO-IDP publish and subscribe, and SSO-SP publish and subscribe.
    3. Do the equivalent on TotaraB.
    4. On both, go to Admin > Users > Permissions > Define Roles, only roles that have "Roam to a remote Totara moodle/site:mnetlogintoremote" will be allowed to roam. Grant the privilege as appropriate.
    5. On both, go to the homepage, and add the 'Network Servers' block.
    6. To test, it is recommended to use a different browser (even on a different machine) that is logged in to neither. Login to TotaraA with a non-administrator account that has the permissions to roam. You should see the Network Servers block, and clicking on it you should go to TotaraB with a newly autocreated account.

Get remote enrolments going -- this is optional. It allows administrator of TotaraB can enrol users that are "native" to TotaraB in courses in TotaraA, and viceversa.

  1. On both, go to Admin > Courses > Enrolment and enable Moodle Network enrolment plugin (click Save). Click on 'Edit' and enable 'allow_allcourses' or select some courses or categories to be remotely enrolled.
  2. On TotaraA go to Admin > Network > Peers, click on 'TotaraB', and click on 'Services'. Enable Enrolment publish and subscribe.
  3. Do the equivalent on TotaraB.
  4. To use, in TotaraA go to Admin > Networking > Enrolments. You will see TotaraB listed. Click on TotaraB and you will see a list of courses that TotaraB offers for remote enrolment. Select the course you want, and then enroll the users you want to that course.

Connecting to a Mnet hub

A Mnet hub (do not confuse it with the Community hub project of Moodle 2.0) is a Totara server that is configured to accept connections from other Totara servers, and to provide a set of services to users of these other servers. This guideline will direct you to connect to a Mnet hub, assess the services it has to offer, and enable those services for your users.

Setup

  1. Get talking to the Hub
    1. Ensure that the Admin > Server > Environment page indicates you have curl and openssl installed
    2. Go to Admin > Network > Settings and turn Networking on
    3. Go to Admin > Network > Peers and enter the URL of Mnet Hub under "Add New Host". Click Add
    4. The host details for the Mnet Hub should appear with the Site Name field already populated. Click Save changes
    5. The details will be written to your database and two new tabs will appear in this window: 'Services' and 'Logs'. ClickServices
    6. A list of services will appear, each with a checkbox for 'publish' and 'subscribe'. Check the checkboxes for any services you want to publish or subscribe to

Using it

If the Mnet Hub has already enabled a service for you, there will be a tick alongside the appropriate checkbox, for example: if the Hub is publishing Moodle Networked Enrolment, then a tick will appear alongside the subscribe checkbox for this service. Note that in order to enable some functionality, prominently single-sign-on, you may have to publish a service, e.g. the Identity Providerservice. The Mnet Hub will access this service on your Totara, asking it to authenticate your users.

  1. Enable Roaming
    1. Subscribe to SSO (Service Provider) by checking the box
    2. Publish SSO (Identity Provider) by checking the box
    3. Click Save changes
    4. Go to Admin > Users > Permissions > Define Roles, and grant the capability Roam to a remote Moodle moodle/site:mnetlogintoremote to an appropriate role
    5. Go to Administration > Plugins > Authentication > Manage authentication
    6. Go to your homepage, turn on editing, and add the 'Network Servers' block
    7. Using a different web-browser, log on as a non-admin user who inhabits the role you granted the roaming capability to
    8. Note that the Mnet Hub is listed in the Network Servers block on the homepage. Click on the link to that server
    9. Some of your user details will be transferred to the Mnet Hub server, and a browsing session will be started for you as if you had logged on there directly
  2. Enable Networked Enrolment
    1. Return to the web browser you've been using as the site administrator
    2. Go to Admin > Network > Peers and click on the entry for the Mnet Hub.
    3. Click on the Services tab
    4. Subscribe to Moodle Networked Enrolment
    5. Go to Admin > Courses > Enrolment and enable the Moodle Network enrolment plugin. Click Save changes
    6. Click on edit to view the details for networked enrolments.
    7. Go to Admin > Networking > Enrolments to see a list of Totara servers that offer this service to you
    8. Click on a server name to view a list of courses that the server offers to your users
    9. Click on a course name, to view a list users that you can enrol in this course
    10. Enrol users
    11. Profit!

Running a Mnet hub

A Mnet hub is a regular Totara site that runs in a special mode. As a Totara Administrator, when you add another Totara site to your list of network peers, your Totara will contact that site to find out what it is called, and to request its public key for encrypted communication. Normally, the remote server will simply provide this information without making any record of the transaction.

A Mnet hub is different. As soon as you add an entry for a Mnet hub to your system, the Mnet hub will create an entry for your server in its list of hosts, and may immediately begin to offer services to the users of your site.

This section will guide you to set up a Mnet hub, and select services to offer to all comers.

Setup

  1. Enable Networking
    1. Ensure that the Admin > Server > Environment page indicates you have curl and openssl installed
    2. Go to Admin > Network > Settings and turn Networking on
    3. Go to Admin > Network > Peers and tick the checkbox for Register all hosts. Click on Save Changes
    4. On the same page, the first entry in your list of hosts should be All hosts. Click this link
    5. Click on Services and enable any services you want to offer to all comers

 

 

Still have questions? Why not post them in the forums of the Totara Community.

  • No labels