--- loncom/interface/createaccount.pm	2014/01/30 12:15:06	1.57
+++ loncom/interface/createaccount.pm	2014/02/12 20:47:40	1.58
@@ -1,9 +1,10 @@
 # The LearningOnline Network
 # Allow visitors to create a user account with the username being either an 
-# institutional log-in ID (institutional authentication required - localauth
-#  or kerberos) or an e-mail address.
+# institutional log-in ID (institutional authentication required - localauth,
+# kerberos, or SSO) or an e-mail address. Requests to use an e-mail address as
+# username may be processed automatically, or may be queued for approval.
 #
-# $Id: createaccount.pm,v 1.57 2014/01/30 12:15:06 raeburn Exp $
+# $Id: createaccount.pm,v 1.58 2014/02/12 20:47:40 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -44,8 +45,6 @@ use Crypt::DES;
 use LONCAPA qw(:DEFAULT :match);
 use HTML::Entities;
 
-#TODO this module needs documentation
-
 sub handler {
     my $r = shift;
     &Apache::loncommon::content_type($r,'text/html');
@@ -103,7 +102,8 @@ sub handler {
         my $end_page =
             &Apache::loncommon::end_page();
         $r->print($start_page."\n".'<h2>'.&mt('You are already logged in').'</h2>'.
-                  '<p>'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4].','<a href="/adm/roles">','</a>','<a href="/adm/logout">','</a>').
+                  '<p>'.&mt('Please either [_1]continue the current session[_2] or [_3]log out[_4].',
+                            '<a href="/adm/roles">','</a>','<a href="/adm/logout">','</a>').
                   '</p><p><a href="/adm/loginproblems.html">'.&mt('Login problems?').'</a></p>'.$end_page);
         return OK;
     }
@@ -124,14 +124,17 @@ sub handler {
 
         my %domconfig = 
             &Apache::lonnet::get_dom('configuration',['usercreation'],$domain);
-        my ($cancreate,$statustocreate) = 
+        my ($cancreate,$statustocreate,$emailusername) = 
             &get_creation_controls($domain,$domconfig{'usercreation'});
 
         my ($result,$output) =
             &username_validation($r,$env{'form.uname'},$domain,$domdesc,
                                  $contact_name,$contact_email,$courseid,
                                  $lonhost,$statustocreate);
-        if ($result eq 'existingaccount') {
+        if ($result eq 'redirect') {
+            $r->internal_redirect('/adm/switchserver');
+            return OK;
+        } elsif ($result eq 'existingaccount') {
             $r->print($output);
             &print_footer($r);
             return OK;
@@ -147,12 +150,14 @@ sub handler {
 
     my %domconfig = 
         &Apache::lonnet::get_dom('configuration',['usercreation'],$domain);
-    my ($cancreate,$statustocreate) = &get_creation_controls($domain,$domconfig{'usercreation'});
+    my ($cancreate,$statustocreate,$emailusername) = 
+        &get_creation_controls($domain,$domconfig{'usercreation'});
     if (@{$cancreate} == 0) {
         &print_header($r,$start_page,$courseid);
         my $output = '<h3>'.&mt('Account creation unavailable').'</h3>'.
                      '<span class="LC_warning">'.
-                     &mt('Creation of a new user account using an e-mail address or an institutional log-in ID as username is not permitted at this institution ([_1]).',$domdesc).'</span><br /><br />';
+                     &mt('Creation of a new user account using an e-mail address or an institutional log-in ID as username is not permitted at this institution ([_1]).',$domdesc).
+                     '</span><br /><br />';
         $r->print($output);
         &print_footer($r);
         return OK;
@@ -179,13 +184,17 @@ sub handler {
         return OK;
     }
 
-    my ($output,$nostart,$noend);
+    my ($output,$nostart,$noend,$redirect);
     my $token = $env{'form.token'};
     if ($token) {
-        ($output,$nostart,$noend) = 
+        ($output,$nostart,$noend,$redirect) = 
             &process_mailtoken($r,$token,$contact_name,$contact_email,$domain,
-                               $domdesc,$lonhost,$include,$start_page);
-        if ($nostart) {
+                               $domdesc,$lonhost,$include,$start_page,$cancreate,
+                               $domconfig{'usercreation'});
+        if ($redirect) {
+            $r->internal_redirect('/adm/switchserver');
+            return OK;
+        } elsif ($nostart) {
             if ($noend) {
                 return OK;
             } else {
@@ -205,7 +214,10 @@ sub handler {
         (my $result,$output,$nostart) = 
             &username_activation($r,$env{'form.uname'},$domain,$domdesc,
                                  $courseid);
-        if ($result eq 'ok') {
+        if ($result eq 'redirect') {
+            $r->internal_redirect('/adm/switchserver');
+            return OK; 
+        } elsif ($result eq 'ok') {
             if ($nostart) {
                 return OK;
             }
@@ -228,23 +240,29 @@ sub handler {
         }
     } elsif ($env{'form.create_with_email'}) {
         &print_header($r,$start_page,$courseid);
-        $output = &process_email_request($env{'form.useremail'},$domain,$domdesc,
+        $output = &process_email_request($env{'form.uname'},$domain,$domdesc,
                                          $contact_name,$contact_email,$cancreate,
                                          $lonhost,$domconfig{'usercreation'},
-                                         $courseid);
+                                         $emailusername,$courseid);
     } elsif (!$token) {
         &print_header($r,$start_page,$courseid);
         my $now=time;
+        my $gotlondes;
         if (grep(/^login$/,@{$cancreate})) {
-            my $jsh=Apache::File->new($include."/londes.js");
-            $r->print(<$jsh>);
-            $r->print(&javascript_setforms($now));
+            if (open(my $jsh,"<$include/londes.js")) {
+                while(my $line = <$jsh>) {
+                    $r->print($line);
+                }
+                close($jsh);
+                $r->print(&javascript_setforms($now));
+                $gotlondes = 1;
+            }
         }
-        if (grep(/^email$/,@{$cancreate})) {
+        if (grep(/^email(|approval)$/,@{$cancreate})) {
             $r->print(&javascript_validmail());
         }
-        $output = &print_username_form($domain,$domdesc,$cancreate,$now,$lonhost,
-                                       $courseid);
+        $output = &print_username_form($r,$domain,$domdesc,$cancreate,$now,$lonhost,
+                                       $include,$courseid,$gotlondes,$emailusername);
     }
     $r->print($output);
     &print_footer($r);
@@ -272,7 +290,7 @@ sub print_footer {
         $r->print('<form name="backupcrumbs" method="post" action="">'.
                   &Apache::lonhtmlcommon::echo_form_input(['backto','logtoken',
                       'token','serverid','uname','upass','phase','create_with_email',
-                      'code','useremail','crypt','cfirstname','clastname',
+                      'code','crypt','cfirstname','clastname',
                       'cmiddlename','cgeneration','cpermanentemail','cid']).
                   '</form>');
     }
@@ -303,53 +321,84 @@ sub selfenroll_crumbs {
 }
 
 sub javascript_setforms {
-    my ($now) =  @_;
+    my ($now,$emailusername) =  @_;
+    my $setuserinfo; 
+    if (ref($emailusername) eq 'HASH') {
+        foreach my $key (sort(keys(%{$emailusername}))) {
+            $setuserinfo .= '      server.elements.'.$key.'.value=client.elements.'.$key.'.value;'."\n";
+        }
+    }
     my $js = <<ENDSCRIPT;
- <script type="text/javascript" language="JavaScript">
-    function send() {
-        this.document.server.elements.uname.value = this.document.client.elements.uname.value;
-        this.document.server.elements.udom.value = this.document.client.elements.udom.value;
-        uextkey=this.document.client.elements.uextkey.value;
-        lextkey=this.document.client.elements.lextkey.value;
-        initkeys();
-
-        this.document.server.elements.upass.value
-            = crypted(this.document.client.elements.upass$now.value);
-
-        this.document.client.elements.uname.value='';
-        this.document.client.elements.upass$now.value='';
+<script type="text/javascript">
+// <![CDATA[
+    function send(one,two,context) {
+        var server;
+        var client;
+        if (document.forms[one]) {
+            server = document.forms[one];
+            if (document.forms[two]) {
+                client = document.forms[two];
+                server.elements.uname.value = client.elements.uname.value;
+                server.elements.udom.value = client.elements.udom.value;
+                if (context == 'email') {
+                    $setuserinfo
+                }
+                server.elements.code.value=client.elements.code.value;
+                server.elements.crypt.value=client.elements.crypt.value;
 
-        this.document.server.submit();
+                uextkey=client.elements.uextkey.value;
+                lextkey=client.elements.lextkey.value;
+                initkeys();
+
+                server.elements.upass.value
+                    = crypted(client.elements.upass$now.value);
+
+                client.elements.uname.value='';
+                client.elements.upass$now.value='';
+                client.elements.upasscheck$now.value='';
+                server.submit();
+            }
+        }
         return false;
     }
- </script>
+// ]]>
+</script>
 ENDSCRIPT
     return $js;
 }
 
 sub javascript_checkpass {
-    my ($now) = @_;
+    my ($now,$context) = @_;
     my $nopass = &mt('You must enter a password.');
     my $mismatchpass = &mt('The passwords you entered did not match.').'\\n'.
                        &mt('Please try again.'); 
     my $js = <<"ENDSCRIPT";
-<script type="text/javascript" language="JavaScript">
-    function checkpass() {
-        var upass = this.document.client.elements.upass$now.value;
-        var upasscheck = this.document.client.elements.upasscheck$now.value;
-        if (upass == '') {
-            alert("$nopass");
-            return false;
-        }
-        if (upass == upasscheck) {
-            this.document.client.elements.upasscheck$now.value='';
-            send();
-            return false;
-        } else {
-            alert("$mismatchpass");
-            return false;
+<script type="text/javascript">
+// <![CDATA[
+    function checkpass(one,two) {
+        var client;
+        if (document.forms[two]) {
+            client = document.forms[two]; 
+            var upass = client.elements.upass$now.value;
+            var upasscheck = client.elements.upasscheck$now.value;
+            if (upass == '') {
+                alert("$nopass");
+                return false;
+            }
+            if (upass == upasscheck) {
+                client.elements.upasscheck$now.value='';
+                if (validate_email(client)) {
+                    send(one,two,'$context');
+                } 
+                return false;
+            } else {
+                alert("$mismatchpass");
+                return false;
+            }
         }
+        return false; 
     }
+// ]]>
 </script>
 ENDSCRIPT
     return $js;
@@ -361,10 +410,11 @@ sub javascript_validmail {
                notv  => 'is not a valid e-mail address',
     );
     my $output =  "\n".'<script type="text/javascript">'."\n".
+                  '// <![CDATA['."\n".
                   &Apache::lonhtmlcommon::javascript_valid_email()."\n";
     $output .= <<"ENDSCRIPT";
-function validate_email() {
-    field = document.createaccount.useremail;
+function validate_email(client) {
+    field = client.uname;
     if (validmail(field) == false) {
         alert("$lt{'email'}: "+field.value+" $lt{'notv'}.");
         return false;
@@ -372,12 +422,12 @@ function validate_email() {
     return true;
 }
 ENDSCRIPT
-    $output .= "\n".'</script>'."\n";
+    $output .= "\n".'// ]]>'."\n".'</script>'."\n";
     return $output;
 }
 
 sub print_username_form {
-    my ($domain,$domdesc,$cancreate,$now,$lonhost,$courseid) = @_;
+    my ($r,$domain,$domdesc,$cancreate,$now,$lonhost,$include,$courseid,$gotlondes,$emailusername) = @_;
     my %lt = &Apache::lonlocal::texthash(
                                          unam => 'username',
                                          udom => 'domain',
@@ -390,12 +440,15 @@ sub print_username_form {
             if ((($domdefaults{'auth_def'} =~/^krb/) && ($domdefaults{'auth_arg_def'} ne '')) || ($domdefaults{'auth_def'} eq 'localauth')) {
                 $output = '<div class="LC_left_float"><h3>'.&mt('Create account with a username provided by this institution').'</h3>';
                 my $submit_text = &mt('Create LON-CAPA account');
-                $output .= &mt('If you already have a log-in ID at this institution,[_1] you may be able to use it for LON-CAPA.','<br />').'<br /><br />'.&mt('Type in your log-in ID and password to find out.').'<br /><br />';
+                $output .= &mt('If you already have a log-in ID at this institution,[_1] you may be able to use it for LON-CAPA.','<br />').
+                           '<br /><br />'.
+                           &mt('Type in your log-in ID and password to find out.').
+                           '<br /><br />';
                 $output .= &login_box($now,$lonhost,$courseid,$submit_text,
                                       $domain,'createaccount').'</div>';
             }
         }
-        if (grep(/^email$/,@{$cancreate})) {
+        if (grep(/^email(|approval)$/,@{$cancreate})) {
             $output .= '<div class="LC_left_float"><h3>'.&mt('Create account with an e-mail address as your username').'</h3>';
             my ($captchaform,$error) = &Apache::loncommon::captcha_display('usercreation',$lonhost);
             if ($error) {
@@ -403,39 +456,30 @@ sub print_username_form {
                 if ($courseid ne '') {
                     $helpdesk .= '&courseid='.$courseid;
                 }
-                $output .= '<span class="LC_error">'.&mt('An error occurred generating the validation code[_1] required for an e-mail address to be used as username.','<br />').'</span><br /><br />'.&mt('[_1]Contact the helpdesk[_2] or [_3]reload[_2] the page and try again.','<a href="'.$helpdesk.'">','</a>','<a href="javascript:window.location.reload()">');
+                $output .= '<span class="LC_error">'.
+                           &mt('An error occurred generating the validation code[_1] required for an e-mail address to be used as username.','<br />').
+                           '</span><br /><br />'.
+                           &mt('[_1]Contact the helpdesk[_2] or [_3]reload[_2] the page and try again.',
+                               '<a href="'.$helpdesk.'">','</a>','<a href="javascript:window.location.reload()">');
             } else {
-                my $submit_text = &mt('Request LON-CAPA account');
-                my $emailform = '<input type="text" name="useremail" size="25" value="" />';
                 if (grep(/^login$/,@{$cancreate})) {
                     $output .= &mt('Provide your e-mail address to request a LON-CAPA account,[_1] if you do not have a log-in ID at your institution.','<br />').'<br /><br />';
                 } else {
                     $output .= '<br />';
                 }
-                $output .=  '<form name="createaccount" method="post" onsubmit="return validate_email()" action="/adm/createaccount">'.
-                            &Apache::lonhtmlcommon::start_pick_box()."\n".
-                            &Apache::lonhtmlcommon::row_title(&mt('E-mail address'),
-                                                              'LC_pick_box_title')."\n".
-                            $emailform."\n";
-                if ($captchaform) {
-                    $output .= &Apache::lonhtmlcommon::row_closure(1).
-                               &Apache::lonhtmlcommon::row_title(&mt('Validation'),
-                                                                 'LC_pick_box_title')."\n".
-                               $captchaform."\n".'<br /><br />';
-                }
-                if ($courseid ne '') {
-                    $output .= '<input type="hidden" name="courseid" value="'.$courseid.'"/>'."\n"; 
+                $output .= &mt('Please provide user information and a password for your new account.').'<br />'.
+                           &mt('Your password, which must contain at least seven characters, will be sent to the LON-CAPA server in an encrypted form.').'<br />';
+                if (grep(/^login$/,@{$cancreate})) {
+                    $output .= &mt('Provide your e-mail address to request a LON-CAPA account,[_1] if you do not have a log-in ID at your institution.','<br />').'<br /><br />';
+                } else {
+                    $output .= '<br />';
                 }
-                $output .=  &Apache::lonhtmlcommon::row_closure(1).
-                            &Apache::lonhtmlcommon::row_title().'<br />'.
-                            '<input type="submit" name="create_with_email" value="'. 
-                            $submit_text.'" />'.
-                            &Apache::lonhtmlcommon::row_closure(1).
-                            &Apache::lonhtmlcommon::end_pick_box().'<br /><br />';
-                if ($courseid ne '') {
-                    $output .= &Apache::lonhtmlcommon::echo_form_input(['courseid']);
+                $output .= &print_dataentry_form($r,$domain,$lonhost,$include,$now,$captchaform,$courseid,$gotlondes,$emailusername);
+                if (grep(/^login$/,@{$cancreate})) {
+                    $output .= &mt('Provide your e-mail address to request a LON-CAPA account,[_1] if you do not have a log-in ID at your institution.','<br />').'<br /><br />';
+                } else {
+                    $output .= '<br />';
                 }
-                $output .= '</form>';
             }
             $output .= '</div>';
         }
@@ -455,14 +499,14 @@ sub login_box {
                                               createaccount => 'Log-in ID',
                                               selfenroll    => 'Username',
                                             );
-    my ($lkey,$ukey) = &Apache::lonpreferences::des_keys();
+    my ($lkey,$ukey) = &Apache::loncommon::des_keys();
     my ($lextkey,$uextkey) = &getkeys($lkey,$ukey);
     my $logtoken=Apache::lonnet::reply('tmpput:'.$ukey.$lkey.'&createaccount:createaccount',
                                        $lonhost);
     $output = &serverform($logtoken,$lonhost,undef,$courseid,$context);
     my $unameform = '<input type="text" name="uname" size="20" value="" />';
     my $upassform = '<input type="password" name="upass'.$now.'" size="20" />';
-    $output .= '<form name="client" method="post" action="" onsubmit="return(send());">'."\n".
+    $output .= '<form name="client" method="post" action="" onsubmit="return(send('."'server','client'".'));">'."\n".
                &Apache::lonhtmlcommon::start_pick_box()."\n".
                &Apache::lonhtmlcommon::row_title($titles{$context},
                                                  'LC_pick_box_title')."\n".
@@ -501,11 +545,10 @@ sub login_box {
 
 sub process_email_request {
     my ($useremail,$domain,$domdesc,$contact_name,$contact_email,$cancreate,
-        $server,$settings,$courseid) = @_;
-    $useremail = $env{'form.useremail'};
+        $server,$settings,$emailusername,$courseid) = @_;
     my $output;
     if (ref($cancreate) eq 'ARRAY') {
-        if (!grep(/^email$/,@{$cancreate})) {
+        if (!grep(/^email(|approval)$/,@{$cancreate})) {
             $output = &invalid_state('noemails',$domdesc,
                                      $contact_name,$contact_email);
             return $output;
@@ -514,6 +557,13 @@ sub process_email_request {
                                      $contact_name,$contact_email);
             return $output;
         } else {
+            $useremail =~ s/^\s+|\s+$//g;
+            my $uname=&LONCAPA::clean_username($useremail);
+            if ($useremail ne $uname) {
+                $output = &invalid_state('badusername',$domdesc,
+                                         $contact_name,$contact_email);
+                return $output;
+            }
             my $uhome = &Apache::lonnet::homeserver($useremail,$domain);
             if ($uhome ne 'no_host') {
                 $output = &invalid_state('existinguser',$domdesc,
@@ -526,33 +576,30 @@ sub process_email_request {
                                              $contact_email,$captcha_error);
                     return $output;
                 }
-                my $uhome=&Apache::lonnet::homeserver($useremail,$domain);
-                if ($uhome eq 'no_host') {
-                    my (%rulematch,%inst_results,%curr_rules,%got_rules,%alerts);
-                    &call_rulecheck($useremail,$domain,\%alerts,\%rulematch,
-                                    \%inst_results,\%curr_rules,\%got_rules,'username');
-                    if (ref($alerts{'username'}) eq 'HASH') {
-                        if (ref($alerts{'username'}{$domain}) eq 'HASH') {
-                            if ($alerts{'username'}{$domain}{$useremail}) {
-                                $output = &invalid_state('userrules',$domdesc,
-                                                         $contact_name,$contact_email);
-                                return $output;
-                            }
+                my (%rulematch,%inst_results,%curr_rules,%got_rules,%alerts);
+                &call_rulecheck($useremail,$domain,\%alerts,\%rulematch,
+                                \%inst_results,\%curr_rules,\%got_rules,'username');
+                if (ref($alerts{'username'}) eq 'HASH') {
+                    if (ref($alerts{'username'}{$domain}) eq 'HASH') {
+                        if ($alerts{'username'}{$domain}{$useremail}) {
+                            $output = &invalid_state('userrules',$domdesc,
+                                                     $contact_name,$contact_email);
+                            return $output;
                         }
                     }
-                    my $format_msg = 
-                        &guest_format_check($useremail,$domain,$cancreate,
-                                            $settings);
-                    if ($format_msg) {
-                        $output = &invalid_state('userformat',$domdesc,$contact_name,
-                                                 $contact_email,$format_msg);
-                        return $output;
-                    }
+                }
+                my $format_msg = 
+                    &guest_format_check($useremail,$domain,$cancreate,
+                                        $settings);
+                if ($format_msg) {
+                    $output = &invalid_state('userformat',$domdesc,$contact_name,
+                                             $contact_email,$format_msg);
+                    return $output;
                 }
             }
         }
         $output = &send_token($domain,$useremail,$server,$domdesc,$contact_name,
-                          $contact_email,$courseid);
+                              $contact_email,$courseid,$emailusername);
     }
     return $output;
 }
@@ -572,86 +619,124 @@ sub call_rulecheck {
 }
 
 sub send_token {
-    my ($domain,$email,$server,$domdesc,$contact_name,$contact_email,$courseid) = @_;
+    my ($domain,$email,$server,$domdesc,$contact_name,$contact_email,$courseid,$emailusername) = @_;
     my $msg = '<h3>'.&mt('Account creation status').'</h3>'.
               &mt('Thank you for your request to create a new LON-CAPA account.').
               '<br /><br />';
     my $now = time;
-    my %info = ('ip'         => $ENV{'REMOTE_ADDR'},
-                'time'       => $now,
-                'domain'     => $domain,
-                'username'   => $email,
-                'courseid'   => $courseid);
-    my $token = &Apache::lonnet::tmpput(\%info,$server,'createaccount');
-    if ($token !~ /^error/ && $token ne 'no_such_host') {
-        my $esc_token = &escape($token);
-        my $showtime = localtime(time);
-        my $mailmsg = &mt('A request was submitted on [_1] for creation of a LON-CAPA account at the following institution: [_2].',$showtime,$domdesc).' '.
-             &mt('To complete this process please open a web browser and enter the following URL in the address/location box: [_1]',
-                 &Apache::lonnet::absolute_url().'/adm/createaccount?token='.$esc_token);
-        my $result = &Apache::resetpw::send_mail($domdesc,$email,$mailmsg,$contact_name,
-                                                 $contact_email);
-        if ($result eq 'ok') {
-            $msg .= &mt('A message has been sent to the e-mail address you provided.').'<br />'.&mt('The message includes the web address for the link you will use to complete the account creation process.').'<br />'.&mt("The link included in the message will be valid for the next [_1]two[_2] hours.",'<b>','</b>');
+    $env{'form.logtoken'} =~ s/(`)//g;
+    if ($env{'form.logtoken'}) {
+        my $logtoken = $env{'form.logtoken'};
+        my $tmpinfo=Apache::lonnet::reply('tmpget:'.$logtoken,$server);
+        if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) {
+            $msg = &mt('Information needed to process your request is missing, inaccessible or expired.')
+                  .'<br />'.&mt('Return to the previous page to try again.');
+        } else {
+            my $reply = &Apache::lonnet::reply('tmpdel:'.$logtoken,$server);
+            unless ($reply eq 'ok') {
+                $msg .= &mt('Request could not be processed.');
+            }
+        }
+        my %info = ('ip'         => $ENV{'REMOTE_ADDR'},
+                    'time'       => $now,
+                    'domain'     => $domain,
+                    'username'   => $email,
+                    'courseid'   => $courseid,
+                    'upass'      => $env{'form.upass'},
+                    'serverid'   => $env{'form.serverid'},
+                    'tmpinfo'    => $tmpinfo);
+
+        if (ref($emailusername) eq 'HASH') {
+            foreach my $item (keys(%{$emailusername})) {
+                $info{$item} = $env{'form.'.$item};
+                $info{$item} =~ s/(`)//g;
+            }
+        }
+        my $token = &Apache::lonnet::tmpput(\%info,$server,'createaccount');
+        if ($token !~ /^error/ && $token ne 'no_such_host') {
+            my $esc_token = &escape($token);
+            my $showtime = localtime(time);
+            my $mailmsg = &mt('A request was submitted on [_1] for creation of a LON-CAPA account at the following institution: [_2].',$showtime,$domdesc).' '.
+                          &mt('To complete this process please open a web browser and enter the following URL in the address/location box: [_1]',
+                          &Apache::lonnet::absolute_url().'/adm/createaccount?token='.$esc_token);
+            my $result = &Apache::resetpw::send_mail($domdesc,$email,$mailmsg,$contact_name,
+                                                     $contact_email);
+            if ($result eq 'ok') {
+                $msg .= &mt('A message has been sent to the e-mail address you provided.').'<br />'.
+                        &mt('The message includes the web address for the link you will use to complete the account creation process.').'<br />'.
+                        &mt("The link included in the message will be valid for the next [_1]two[_2] hours.",'<b>','</b>');
+            } else {
+                $msg .= '<span class="LC_error">'.
+                        &mt('An error occurred when sending a message to the e-mail address you provided.').'</span><br />'.
+                        ' '.&mt('Please contact the [_1] ([_2]) for assistance.',$contact_name,$contact_email);
+            }
         } else {
             $msg .= '<span class="LC_error">'.
-                    &mt('An error occurred when sending a message to the e-mail address you provided.').'</span><br />'.
+                    &mt('An error occurred creating a token required for the account creation process.').'</span><br />'.
                     ' '.&mt('Please contact the [_1] ([_2]) for assistance.',$contact_name,$contact_email);
         }
     } else {
-        $msg .= '<span class="LC_error">'.
-                &mt('An error occurred creating a token required for the account creation process.').'</span><br />'.
-                ' '.&mt('Please contact the [_1] ([_2]) for assistance.',$contact_name,$contact_email);
+        $msg .=  $msg = &mt('Information needed to process your request is missing, inaccessible or expired.')
+                .'<br />'.&mt('Return to the previous page to try again.');
+
     }
     return $msg;
 }
 
 sub process_mailtoken {
     my ($r,$token,$contact_name,$contact_email,$domain,$domdesc,$lonhost,
-        $include,$start_page) = @_;
-    my ($msg,$nostart,$noend);
+        $include,$start_page,$cancreate,$settings) = @_;
+    my ($msg,$nostart,$noend,$redirect);
     my %data = &Apache::lonnet::tmpget($token);
     my $now = time;
     if (keys(%data) == 0) {
         $msg = &mt('Sorry, the URL you provided to complete creation of a new LON-CAPA account was invalid.')
                .' '.&mt('Either the token included in the URL has been deleted or the URL you provided was invalid.')
-               .' '.&mt('Please submit a [_1]new request[_2] for account creation and follow the new link page included in the e-mail that will be sent to you.','<a href="/adm/createaccount">','</a>');
+               .' '.&mt('Please submit a [_1]new request[_2] for account creation and follow the new link page included in the e-mail that will be sent to you.',
+                        '<a href="/adm/createaccount">','</a>');
         return $msg;
     }
     if (($data{'time'} =~ /^\d+$/) &&
         ($data{'domain'} ne '') &&
         ($data{'username'}  =~ /^[^\@]+\@[^\@]+\.[^\@\.]+$/)) {
         if ($now - $data{'time'} < 7200) {
-            if ($env{'form.phase'} eq 'createaccount') {
-                my ($result,$output,$uhome) = 
-                    &create_account($r,$domain,$data{'username'},$domdesc);
-                if ($result eq 'ok') {
-                    $msg = $output; 
-                    my $shownow = &Apache::lonlocal::locallocaltime($now);
-                    my $mailmsg = &mt('A LON-CAPA account for the institution: [_1] has been created [_2] from IP address: [_3]. If you did not perform this action or authorize it, please contact the [_4] ([_5]).',$domdesc,$shownow,$ENV{'REMOTE_ADDR'},$contact_name,$contact_email)."\n";
-                    my $mailresult = &Apache::resetpw::send_mail($domdesc,$data{'email'},
-                                                                 $mailmsg,$contact_name,
-                                                                 $contact_email);
-                    if ($mailresult eq 'ok') {
-                        $msg .= &mt('An e-mail confirming creation of your new LON-CAPA account has been sent to [_1].',$data{'username'});
+# Check if request should be queued.
+            if (ref($cancreate) eq 'ARRAY') {
+                if (grep(/^email$/,@{$cancreate})) {
+                    my ($result,$output,$uhome) = 
+                        &create_account($r,$domain,$domdesc,\%data);
+                    if ($result eq 'ok') {
+                        $msg = $output;
+                        my $shownow = &Apache::lonlocal::locallocaltime($now);
+                        my $mailmsg = &mt('A LON-CAPA account for the institution: [_1] has been created [_2] from IP address: [_3]. If you did not perform this action or authorize it, please contact the [_4] ([_5]).',$domdesc,$shownow,$ENV{'REMOTE_ADDR'},$contact_name,$contact_email)."\n";
+                        my $mailresult = &Apache::resetpw::send_mail($domdesc,$data{'email'},
+                                                                     $mailmsg,$contact_name,
+                                                                     $contact_email);
+                        if ($mailresult eq 'ok') {
+                            $msg .= &mt('An e-mail confirming creation of your new LON-CAPA account has been sent to [_1].',$data{'username'});
+                        } else {
+                            $msg .= &mt('An error occurred when sending e-mail to [_1] confirming creation of your LON-CAPA account.',$data{'username'});
+                        }
+                        $redirect = &start_session($r,$data{'username'},$domain,$uhome,
+                                                   $data{'courseid'},$token);
+                        $nostart = 1;
+                        $noend = 1;
                     } else {
-                        $msg .= &mt('An error occurred when sending e-mail to [_1] confirming creation of your LON-CAPA account.',$data{'username'});
+                        $msg .= &mt('A problem occurred when attempting to create your new LON-CAPA account.')
+                               .'<br />'.$output;
+                        if (($contact_name ne '') && ($contact_email ne '')) {
+                            $msg .= &mt('Please contact the [_1] ([_2]) for assistance.',$contact_name,$contact_email);
+                        }
                     }
-                    &start_session($r,$data{'username'},$domain,$uhome,
-                                   $data{'courseid'},$token);
-                    $nostart = 1;
-                    $noend = 1;
+                    my $delete = &Apache::lonnet::tmpdel($token);
+                } elsif (grep(/^emailapproval$/,@{$cancreate})) {
+                    $msg = &store_request($domain,$data{'username'},'approval',\%data,$settings);
+                    my $delete = &Apache::lonnet::tmpdel($token);
                 } else {
-                    $msg .= &mt('A problem occurred when attempting to create your new LON-CAPA account.')
-                           .'<br />'.$output
-#                           .&mt('Please contact the [_1] ([_2]) for assistance.',$contact_name,'<a href="mailto:'.$contact_email.'">'.$contact_email.'</a>');
-                           .&mt('Please contact the [_1] ([_2]) for assistance.',$contact_name,$contact_email);
+                    $msg = &invalid_state('noemails',$domdesc,$contact_name,$contact_email);
                 }
-                my $delete = &Apache::lonnet::tmpdel($token);
             } else {
-                $msg .= &mt('Please provide user information and a password for your new account.').'<br />'.&mt('Your password, which must contain at least seven characters, will be sent to the LON-CAPA server in an encrypted form.').'<br />';
-                $msg .= &print_dataentry_form($r,$domain,$lonhost,$include,$token,$now,$data{'username'},$start_page);
-                $nostart = 1;
+                $msg = &invalid_state('noemails',$domdesc,$contact_name,$contact_email);
             }
         } else {
             $msg = &mt('Sorry, the token generated when you requested creation of an account has expired.')
@@ -661,7 +746,7 @@ sub process_mailtoken {
         $msg .= &mt('Sorry, the URL generated when you requested creation of an account contained incomplete information.')
                .' '.&mt('Please submit a [_1]new request[_2] for account creation and follow the new link included in the e-mail that will be sent to you.','<a href="/adm/createaccount">','</a>');
     }
-    return ($msg,$nostart,$noend);
+    return ($msg,$nostart,$noend,$redirect);
 }
 
 sub start_session {
@@ -673,7 +758,7 @@ sub start_session {
 
         Apache::lonnet::tmpdel($token) if $token;
 
-        $r->internal_redirect('/adm/switchserver');
+        return 'redirect';
     } else {
         $courseid = Apache::lonnet::is_course($courseid); 
 
@@ -691,74 +776,61 @@ sub start_session {
 # Stores token to store DES-key and stage during creation session
 #
 sub print_dataentry_form {
-    my ($r,$domain,$lonhost,$include,$mailtoken,$now,$username,$start_page) = @_;
+    my ($r,$domain,$lonhost,$include,$now,$captchaform,$courseid,$gotlondes,$emailusername) = @_;
     my ($error,$output);
-    &print_header($r,$start_page);
-    if (open(my $jsh,"<$include/londes.js")) {
-        while(my $line = <$jsh>) {
-            $r->print($line);
-        }
-        close($jsh);
-        $output .= &javascript_setforms($now)."\n".&javascript_checkpass($now);
-        my ($lkey,$ukey) = &Apache::lonpreferences::des_keys();
+    unless ($gotlondes) {
+        if (open(my $jsh,"<$include/londes.js")) {
+            while(my $line = <$jsh>) {
+                $r->print($line);
+            }
+            close($jsh);
+            $output = &javascript_setforms($now,$emailusername)."\n";
+            $gotlondes = 1;
+        }
+    }
+    if ($gotlondes) {
+        $output .= &javascript_checkpass($now,'email');
+        my ($lkey,$ukey) = &Apache::loncommon::des_keys();
         my ($lextkey,$uextkey) = &getkeys($lkey,$ukey);
         my $logtoken=Apache::lonnet::reply('tmpput:'.$ukey.$lkey.'&createaccount:createaccount',
                                            $lonhost);
-        my $formtag = '<form name="server" method="post" target="_top" action="/adm/createaccount">';
-        my ($datatable,$rowcount) =
-            &Apache::loncreateuser::personal_data_display($username,$domain,
-                                                          'email','selfcreate');
-        if ($rowcount) {
-            $output .= '<div class="LC_left_float">'.$formtag.$datatable;
-        } else {
-            $output .= $formtag;
+        $output .=
+            '<form name="createaccount" method="post" target="_top" action="/adm/createaccount">';
+        if ($courseid ne '') {
+            $output .= '<input type="hidden" name="courseid" value="'.$courseid.'"/>'."\n";
+        }
+        if (ref($emailusername) eq 'HASH') {
+            foreach my $field (sort(keys(%{$emailusername}))) {
+                $output .= '<input type="hidden" name="'.$field.'" value="" />'."\n";
+            }
         }
         $output .= <<"ENDSERVERFORM";
    <input type="hidden" name="logtoken" value="$logtoken" />
-   <input type="hidden" name="token" value="$mailtoken" />
    <input type="hidden" name="serverid" value="$lonhost" />
    <input type="hidden" name="uname" value="" />
    <input type="hidden" name="upass" value="" />
    <input type="hidden" name="udom" value="" />
+   <input type="hidden" name="crypt" value="" />
+   <input type="hidden" name="code" value="" />
    <input type="hidden" name="phase" value="createaccount" />
+   <input type="hidden" name="create_with_email" value="1" />
   </form>
 ENDSERVERFORM
+        my $beginclientform = '<form name="newemail" method="post" action="" '.
+                              'onsubmit="return checkpass('."'createaccount','newemail'".');">'."\n";
+        my $endclientform = '<input type="hidden" name="udom" value="'.$domain.'" />'."\n".
+                            '<input type="hidden" name="lextkey" value="'.$lextkey.'" />'."\n".
+                            '<input type="hidden" name="uextkey" value="'.$uextkey.'" />'."\n".
+                            '</form>';
+        my ($datatable,$rowcount) =
+            &Apache::loncreateuser::personal_data_display('',$domain,'email','selfcreate',
+                                                          '','',$now,$captchaform,
+                                                          $emailusername);
         if ($rowcount) {
-            $output .= '</div>'.
-                       '<div class="LC_left_float">';
+            $output .= '<div class="LC_left_float">'.$beginclientform.$datatable.$endclientform;
+        } else {
+            $output .= $beginclientform.$endclientform;
         }
-        my $upassone = '<input type="password" name="upass'.$now.'" size="10" />';
-        my $upasstwo = '<input type="password" name="upasscheck'.$now.'" size="10" />';
-        my $submit_text = &mt('Create LON-CAPA account');
-        $output .= '<h3>'.&mt('Login Data').'</h3>'."\n".
-                   '<form name="client" method="post" action="" '.
-                   'onsubmit="return checkpass();">'."\n".
-                   &Apache::lonhtmlcommon::start_pick_box()."\n".
-                   &Apache::lonhtmlcommon::row_title(&mt('Username'),
-                                                     'LC_pick_box_title',
-                                                     'LC_oddrow_value')."\n".
-                   $username."\n".
-                   &Apache::lonhtmlcommon::row_closure(1)."\n".
-                   &Apache::lonhtmlcommon::row_title(&mt('Password'),
-                                                    'LC_pick_box_title',
-                                                    'LC_oddrow_value')."\n".
-                   $upassone."\n".
-                   &Apache::lonhtmlcommon::row_closure(1)."\n".
-                   &Apache::lonhtmlcommon::row_title(&mt('Confirm password'),
-                                                     'LC_pick_box_title',
-                                                     'LC_oddrow_value')."\n".
-                   $upasstwo.
-                   &Apache::lonhtmlcommon::row_closure(1)."\n".
-                   &Apache::lonhtmlcommon::row_title()."\n".
-                   '<br /><input type="submit" name="createaccount" value="'.
-                   $submit_text.'" />'.
-                   &Apache::lonhtmlcommon::row_closure(1)."\n".
-                   &Apache::lonhtmlcommon::end_pick_box()."\n".
-                   '<input type="hidden" name="uname" value="'.$username.'" />'."\n".
-                   '<input type="hidden" name="udom" value="'.$domain.'" />'."\n".
-                   '<input type="hidden" name="lextkey" value="'.$lextkey.'" />'."\n".
-                   '<input type="hidden" name="uextkey" value="'.$uextkey.'" />'."\n".
-                   '</form>';
         if ($rowcount) {
             $output .= '</div>'."\n".
                        '<div class="LC_clear_float_footer"></div>'."\n";
@@ -775,7 +847,7 @@ ENDSERVERFORM
 
 sub get_creation_controls {
     my ($domain,$usercreation) = @_;
-    my (@cancreate,@statustocreate);
+    my (@cancreate,@statustocreate,$emailusername);
     if (ref($usercreation) eq 'HASH') {
         if (ref($usercreation->{'cancreate'}) eq 'HASH') {
             if (ref($usercreation->{'cancreate'}{'statustocreate'}) eq 'ARRAY') {
@@ -805,80 +877,147 @@ sub get_creation_controls {
                      ($usercreation->{'cancreate'}{'selfcreate'} ne '')) {
                 @cancreate = ($usercreation->{'cancreate'}{'selfcreate'});
             }
+            if (ref($usercreation->{'cancreate'}{'emailusername'}) eq 'HASH') {
+                $emailusername = $usercreation->{'cancreate'}{'emailusername'};
+            }
         }
     }
-    return (\@cancreate,\@statustocreate);
+    return (\@cancreate,\@statustocreate,$emailusername);
 }
 
 sub create_account {
-    my ($r,$domain,$username,$domdesc) = @_;
-# Get the token info
-    my ($retrieved,$output,$upass) = &process_credentials($env{'form.logtoken'},
-                                                          $env{'form.serverid'}); 
-# $retrieved is 'ok' if things worked
-# $output is user error output
-# $upass is the decrypted password
-    # Error messages
-    my $error     = '<span class="LC_error">'.&mt('Error:').' ';
-    my $end       = '</span><br /><br />';
-    my $rtnlink   = '<a href="javascript:history.back();">'.
+    my ($r,$domain,$domdesc,$dataref) = @_;
+    my $error    = '<span class="LC_error">'.&mt('Error:').' ';
+    my $end      = '</span><br /><br />';
+    my $rtnlink  = '<a href="javascript:history.back();">'.
                     &mt('Return to previous page').'</a>'.
                     &Apache::loncommon::end_page();
-    if ($retrieved eq 'ok') {
-        if ($env{'form.courseid'} ne '') {
-# See if we are allowed to use this username per domain rules (number of characters, etc)
-            my ($result,$userchkmsg) = &check_id($username,$domain,$domdesc);
-            if ($result eq 'fail') {
-                $output = $error.&mt('Invalid ID format').$end.
-                          $userchkmsg.$rtnlink;
-                return ('fail',$output);
+    my $output;
+    if (ref($dataref) eq 'HASH') {
+        my ($username,$encpass,$serverid,$courseid,$id,$firstname,$middlename,$lastname,
+            $generation);
+        $username   = $dataref->{'username'};
+        $encpass    = $dataref->{'upass'};
+        $serverid   = $dataref->{'serverid'};
+        $courseid   = $dataref->{'courseid'};
+        $id         = $dataref->{'id'};
+        $firstname  = $dataref->{'firstname'};
+        $middlename = $dataref->{'middlename'};
+        $lastname   = $dataref->{'lastname'};
+        $generation = $dataref->{'generation'};
+       
+        my $currhome = &Apache::lonnet::homeserver($username,$domain);
+        unless ($currhome eq 'no_host') {
+            $output = &mt('User account requested for username: [_1] in domain: [_2] already exists.',$username,$domain);
+            return ('fail',$error.$output.$end.$rtnlink);
+        }
+
+# Split the logtoken to retrieve the DES key and decrypt the encypted password
+
+        my ($key,$caller)=split(/&/,$dataref->{'tmpinfo'});
+        if ($caller eq 'createaccount') {
+            my $upass = &Apache::loncommon::des_decrypt($key,$encpass);
+
+# See if we are allowed to use the proposed student/employee ID,
+# as per domain rules; if not, student/employee will be left blank.
+
+            if ($id ne '') {
+                my ($result,$userchkmsg) = &check_id($username,$domain,$id,$domdesc,'email');
+                if ($result eq 'fail') {
+                    $output = $error.&mt('Invalid ID format').$end.
+                              $userchkmsg;
+                    undef($id);
+                }
             }
+
+# Create an internally authenticated account with password $upass
+# if the user account does not already exist.
+# Assign student/employee id, first name, last name, etc.
+
+            my $result =
+                &Apache::lonnet::modifyuser($domain,$username,$id,
+                                            'internal',$upass,$firstname,$middlename,
+                                            $lastname,$generation,undef,undef,$username);
+            $output = &mt('Generating user: [_1]',$result);
+
+# Now that the user account exists, retrieve the homeserver, and include it in the output.
+
+            my $uhome = &Apache::lonnet::homeserver($username,$domain);
+            $output .= '<br />'.&mt('Home server: [_1]',$uhome).' '.
+                       &Apache::lonnet::hostname($uhome).'<br /><br />';
+            return ('ok',$output,$uhome);
+        } else {
+            $output = &mt('Unable to retrieve your account creation information - unexpected context');
+            undef($encpass);
+            return ('fail',$error.$output.$end.$rtnlink);
         }
     } else {
+        $output = &mt('Unable to retrieve information for your account request.');
         return ('fail',$error.$output.$end.$rtnlink);
     }
-    # Yes! We can do this. Valid token, valid username format
-    # Create an internally authenticated account with password $upass 
-    # if the account does not exist yet
-    # Assign student/staff number $env{'form.cid'}, first name, last name, etc
-    my $result = 
-        &Apache::lonnet::modifyuser($domain,$username,$env{'form.cid'},
-                                    'internal',$upass,$env{'form.cfirstname'},
-                                    $env{'form.cmiddlename'},$env{'form.clastname'},
-                                    $env{'form.cgeneration'},undef,undef,$username);
-    $output = &mt('Generating user: [_1]',$result);
-    # Now that the user exists, we can have a homeserver
-    my $uhome = &Apache::lonnet::homeserver($username,$domain);
-    $output .= '<br />'.&mt('Home server: [_1]',$uhome).' '.
-              &Apache::lonnet::hostname($uhome).'<br /><br />';
-    return ('ok',$output,$uhome);
 }
 
 sub username_validation {
     my ($r,$username,$domain,$domdesc,$contact_name,$contact_email,$courseid,
         $lonhost,$statustocreate) = @_;
+# $r: request object
 # $username,$domain: for the user who needs to be validated
 # $domdesc: full name of the domain (for error messages)
-# $contact_name, $contact_email: name and email for user assistance (for error messages in &username_check
-# $courseid: ID of the course that the user should be validated for, goes into start_session
+# $contact_name, $contact_email: name and email for user assistance (for error messages in &username_check)
+# $courseid: ID of the course if user came to username_validation via self-enroll link,
+#             passed to start_session()
+# $lonhost: LON-CAPA lonHostID
 # $statustocreate: -> inststatus in username_check ('faculty', 'staff', 'student', ...)
  
-    my ($retrieved,$output,$upass);
-
+#
+# Sanitize incoming username and domain
+#
     $username= &LONCAPA::clean_username($username);
     $domain = &LONCAPA::clean_domain($domain);
+
+#
+# Check if LON-CAPA account already exists for $username:$domain
+#
     my $uhome = &Apache::lonnet::homeserver($username,$domain);
 
-    ($retrieved,$output,$upass) = &process_credentials($env{'form.logtoken'},
-                                                       $env{'form.serverid'});
-    if ($retrieved ne 'ok') {
+    my $output;
+
+# Retrieve DES key from server using logtoken
+ 
+    my $tmpinfo=Apache::lonnet::reply('tmpget:'.$env{'form.logtoken'},$env{'form.serverid'});
+    if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) {
+        $output = &mt('Information needed to verify your login information is missing, inaccessible or expired.')
+                 .'<br />'.&mt('You may need to reload the previous page to obtain a new token.');
+        return ('fail',$output);
+    } else {
+        my $reply = &Apache::lonnet::reply('tmpdel:'.$env{'form.logtoken'},$env{'form.serverid'});
+        unless ($reply eq 'ok') {
+            $output = &mt('Session could not be opened.');
+            return ('fail',$output); 
+        }
+    }
+
+# Split the logtoken to retrieve the DES key and decrypt the encypted password
+
+    my ($key,$caller)=split(/&/,$tmpinfo);
+    my $upass;
+    if ($caller eq 'createaccount') {
+        $upass = &Apache::loncommon::des_decrypt($key,$env{'form.upass'});
+    } else {
+        $output = &mt('Unable to retrieve your log-in information - unexpected context');
         return ('fail',$output);
     }
     if ($uhome ne 'no_host') {
         my $result = &Apache::lonnet::authenticate($username,$upass,$domain);
         if ($result ne 'no_host') { 
-            &start_session($r,$username,$domain,$uhome,$courseid);
-            $output = '<br /><br />'.&mt('A LON-CAPA account already exists for username [_1] at this institution ([_2]).','<tt>'.$username.'</tt>',$domdesc).'<br />'.&mt('The password entered was also correct so you have been logged in.');
+            my $redirect = &start_session($r,$username,$domain,$uhome,$courseid);
+            if ($redirect) {
+                return ($redirect);
+            }
+            $output = '<br /><br />'.
+                      &mt('A LON-CAPA account already exists for username [_1] at this institution ([_2]).',
+                          '<tt>'.$username.'</tt>',$domdesc).'<br />'.
+                      &mt('The password entered was also correct so you have been logged in.');
             return ('existingaccount',$output);
         } else {
             $output = &login_failure_msg($courseid);
@@ -887,7 +1026,8 @@ sub username_validation {
         my $primlibserv = &Apache::lonnet::domain($domain,'primary');
         my $authok;
         my %domdefaults = &Apache::lonnet::get_domain_defaults($domain);
-        if ((($domdefaults{'auth_def'} =~/^krb(4|5)$/) && ($domdefaults{'auth_arg_def'} ne '')) || ($domdefaults{'auth_def'} eq 'localauth')) {
+        if ((($domdefaults{'auth_def'} =~/^krb(4|5)$/) && ($domdefaults{'auth_arg_def'} ne '')) || 
+             ($domdefaults{'auth_def'} eq 'localauth')) {
             my $checkdefauth = 1;
             $authok = 
                 &Apache::lonnet::reply("encrypt:auth:$domain:$username:$upass:$checkdefauth",$primlibserv);
@@ -1069,7 +1209,8 @@ sub username_activation {
          ($domdefaults{'auth_arg_def'} ne '')) || 
         ($domdefaults{'auth_def'} eq 'localauth')) {
         if ($env{'form.courseid'} ne '') {
-            my ($result,$userchkmsg) = &check_id($username,$domain,$domdesc);
+            my $id = $env{'form.cid'}; 
+            my ($result,$userchkmsg) = &check_id($username,$domain,$id,$domdesc,'institutional');
             if ($result eq 'fail') {
                 $output = $error.&mt('Invalid ID format').$end.
                           $userchkmsg.$rtnlink;
@@ -1107,9 +1248,13 @@ sub username_activation {
             my $delete = &Apache::lonnet::tmpdel($env{'form.authtoken'});
             $output = &mt('A LON-CAPA account has been created for username: [_1] in domain: [_2].',$username,$domain);
             my $uhome=&Apache::lonnet::homeserver($username,$domain,'true');
-            &start_session($r,$username,$domain,$uhome,$courseid);
             my $nostart = 1;
-            return ('ok',$output,$nostart);
+            my $response = 'ok';
+            my $redirect = &start_session($r,$username,$domain,$uhome,$courseid);
+            if ($redirect) {
+                $response = $redirect;
+            }
+            return ($response,$output,$nostart);
         } else {
             $output = &mt('Account creation failed for username: [_1] in domain: [_2].',$username,$domain).'<br /><span class="LC_error">'.&mt('Error: [_1]',$result).'</span>';
             return ('fail',$output);
@@ -1121,16 +1266,15 @@ sub username_activation {
 }
 
 sub check_id {
-    my ($username,$domain,$domdesc) = @_;
-    # Check ID format
-    # Is $username in an okay format for $domain 
-    # (right number of characters, special characters, etc - follow domain rules)?
+    my ($username,$domain,$id,$domdesc,$usernametype) = @_;
+    # Check student/employee ID format
+    # Is proposed student/employee ID acceptable according to domain's rules.  
     # $domdesc is just used for user error messages
     my (%alerts,%rulematch,%inst_results,%curr_rules,%checkhash);
     my %checks = ('id' => 1);
     %{$checkhash{$username.':'.$domain}} = (
                                             'newuser' => 1,
-                                            'id' => $env{'form.cid'},
+                                            'id' => $id,
                                            );
     &Apache::loncommon::user_rule_check(\%checkhash,\%checks,\%alerts,
                                         \%rulematch,\%inst_results,\%curr_rules);
@@ -1139,11 +1283,15 @@ sub check_id {
             if ($alerts{'id'}{$domain}{$env{'form.cid'}}) {
                 my $userchkmsg;
                 if (ref($curr_rules{$domain}) eq 'HASH') {
-                    $userchkmsg  =
-                        &Apache::loncommon::instrule_disallow_msg('id',
-                                                           $domdesc,1).
-                        &Apache::loncommon::user_rule_formats($domain,
-                              $domdesc,$curr_rules{$domain}{'id'},'id');
+                    if ($usernametype eq 'email') {
+                        $userchkmsg = &mt('A student/employee ID has not been set because the value suggested matched the format used for institutional users in the domain, and you are using an e-mail address as username, not an institutional username.');
+                    } else {
+                        $userchkmsg =
+                            &Apache::loncommon::instrule_disallow_msg('id',
+                                                                      $domdesc,1).
+                            &Apache::loncommon::user_rule_formats($domain,
+                                $domdesc,$curr_rules{$domain}{'id'},'id');
+                    }
                 }
                 return ('fail',$userchkmsg);
             }
@@ -1157,6 +1305,8 @@ sub invalid_state {
     my $msg = '<h3>'.&mt('Account creation unavailable').'</h3><span class="LC_error">';
     if ($error eq 'baduseremail') {
         $msg .= &mt('The e-mail address you provided does not appear to be a valid address.');
+    } elsif ($error eq 'badusername') {
+        $msg .= &mt('The e-mail address you provided contains characters which prevent its use as a username in LON-CAPA.');
     } elsif ($error eq 'existinguser') {
         $msg .= &mt('The e-mail address you provided is already in use as a username in LON-CAPA at this institution.');
     } elsif ($error eq 'userrules') {
@@ -1230,39 +1380,72 @@ ENDSERVERFORM
     return $output;
 }
 
-sub process_credentials {
-#
-# Fetches the information from the logtoken via tmpget
-# Token contains the DES-key and the stage of the process (would only be "createaccount")
-# $lonhost in this routine is *not* necessarily the machine that this runs on,
-# but $env{'form.serverid'}, the machine that issued the token. 
-#
-    my ($logtoken,$lonhost) = @_;
-    my $tmpinfo=Apache::lonnet::reply('tmpget:'.$logtoken,$lonhost);
-    my ($retrieved,$output,$upass);
-    if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) {
-        $output = &mt('Information needed to verify your login information is missing, inaccessible or expired.')
-                 .'<br />'.&mt('You may need to reload the previous page to obtain a new token.');
-        return ($retrieved,$output,$upass); 
-    } else {
-        my $reply = &Apache::lonnet::reply('tmpdel:'.$logtoken,$lonhost);
-        if ($reply eq 'ok') {
-            $retrieved = 'ok';
-        } else {
-            $output = &mt('Session could not be opened.');
+sub store_request {
+    my ($dom,$username,$val,$dataref,$settings) = @_;
+    my $output;
+    my $domconfiguser = &Apache::lonnet::get_domainconfiguser($dom);
+    my $key = &escape($username);
+    my $now = time();
+    if (&Apache::lonnet::put('usernamequeue', { $key.'_'.$val => $now },
+                             $dom,$domconfiguser) eq 'ok') {
+        if (ref($dataref) eq 'HASH') {
+            my $logtoken = $dataref->{'tmpinfo'};
+            my $serverid = $dataref->{'serverid'}; 
+            if ($logtoken && $serverid) {
+                my $tmpinfo=Apache::lonnet::reply('tmpget:'.$logtoken,$serverid);
+                unless (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) {
+                    my $reply = &Apache::lonnet::reply('tmpdel:'.$logtoken,$serverid);
+                    if ($reply eq 'ok') {
+                        my ($key,$caller)=split(/&/,$tmpinfo);
+                        $dataref->{'key'} = $key;
+                        undef($dataref->{'tmpinfo'});
+                        undef($dataref->{'serverid'});
+                    }
+                }
+            }
         }
-    }
-    my ($key,$caller)=split(/&/,$tmpinfo);
-    if ($caller eq 'createaccount') {
-        $upass = &Apache::lonpreferences::des_decrypt($key,$env{'form.upass'});
+        my %userrequest = ( $username => $dataref );
+        $userrequest{$username}{timestamp} = $now;
+        $userrequest{$username}{status} = $val;
+        my $notifylist;
+        if (ref($settings) eq 'HASH') {
+            if (ref($settings->{'cancreate'}) eq 'HASH') {
+                if (ref($settings->{'cancreate'}{'notify'}) eq 'HASH') {
+                    my $notifylist = $settings->{'cancreate'}{'notify'}{'approval'};
+                    if ($notifylist) {
+                        my $sender = $domconfiguser.':'.$dom;
+                        my $domdesc = &Apache::lonnet::domain($dom,'description');
+                        my $fullname;
+                        if (ref($dataref) eq 'HASH') {
+                            if ($dataref->{'firstname'}) {
+                                $fullname = $dataref->{'firstname'};
+                            }
+                            if ($dataref->{'lastname'}) {
+                                $fullname .= ' '.$dataref->{'lastname'};
+                            }
+                            $fullname =~ s/^\s+|\s+$//g; 
+                        }
+                        &Apache::loncoursequeueadmin::send_selfserve_notification($notifylist,
+                                                     "$fullname ($username)",
+                                                     undef,$domdesc,$now,'usernamereq',$sender);
+                    }
+                }
+            }
+        }
+        my $userresult =
+            &Apache::lonnet::put('nohist_requestedusernames',\%userrequest,$dom,$domconfiguser);
+        $output = '<p class="LC_info">'.
+                  &mt('Your request for a LON-CAPA account has been submitted for approval.').
+                  '</p>'.
+                  '<p class="LC_info">'.
+                  &mt('An e-mail will be sent to [_1] when your request has been reviewed by an administrator and action has been taken.',$username).
+                  '</p>';
     } else {
-        $output = &mt('Unable to retrieve your log-in information - unexpected context');
+        $output = '<span class="LC_error">'.
+                  &mt('An error occurred when attempting to save your request for a LON-CAPA account.');
+                  '</span>';
     }
-# $retrieved is 'ok' if retrieved okay
-# $output is screen output for the user
-# $upass is $env{'form.upass'}, decrypted with the DES-key, if stage was 'createaccount'
-
-    return ($retrieved,$output,$upass);
+    return $output;
 }
 
 sub guest_format_check {
@@ -1288,7 +1471,9 @@ sub guest_format_check {
     }
     if ($format_match) {
         ($login) = ($useremail =~ /^([^\@]+)\@/);
-        $format_msg = '<br />'.&mt("Your e-mail address uses the same internet domain as your institution's LON-CAPA service.").'<br />'.&mt('Creation of a LON-CAPA account with this type of e-mail address as username is not permitted.').'<br />';
+        $format_msg = '<br />'.
+                      &mt("Your e-mail address uses the same internet domain as your institution's LON-CAPA service.").'<br />'.
+                      &mt('Creation of a LON-CAPA account with this type of e-mail address as username is not permitted.').'<br />';
         if (ref($cancreate) eq 'ARRAY') {
             if (grep(/^login$/,@{$cancreate})) {
                 $format_msg .= &mt('You should request creation of a LON-CAPA account for a log-in ID of "[_1]" at your institution instead.',$login).'<br />';