--- loncom/interface/domainprefs.pm	2021/12/30 03:45:13	1.160.6.118.2.1
+++ loncom/interface/domainprefs.pm	2022/02/21 13:56:22	1.160.6.118.2.6
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.160.6.118.2.1 2021/12/30 03:45:13 raeburn Exp $
+# $Id: domainprefs.pm,v 1.160.6.118.2.6 2022/02/21 13:56:22 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -218,10 +218,10 @@ sub handler {
                 'serverstatuses','requestcourses','helpsettings',
                 'coursedefaults','usersessions','loadbalancing',
                 'requestauthor','selfenrollment','inststatus',
-                'passwords','ltitools','wafproxy','ipaccess'],$dom);
+                'passwords','ltitools','ltisec','wafproxy','ipaccess'],$dom);
+    my %encconfig =
+        &Apache::lonnet::get_dom('encconfig',['ltitools','linkprot'],$dom,undef,1);
     if (ref($domconfig{'ltitools'}) eq 'HASH') {
-        my %encconfig =
-            &Apache::lonnet::get_dom('encconfig',['ltitools'],$dom,undef,1);
         if (ref($encconfig{'ltitools'}) eq 'HASH') {
             foreach my $id (keys(%{$domconfig{'ltitools'}})) {
                 if (ref($domconfig{'ltitools'}{$id}) eq 'HASH') {
@@ -232,12 +232,29 @@ sub handler {
             }
         }
     }
+    if (ref($domconfig{'ltisec'}) eq 'HASH') {
+        if (ref($domconfig{'ltisec'}{'linkprot'}) eq 'HASH') {
+            if (ref($encconfig{'linkprot'}) eq 'HASH') {
+                foreach my $id (keys(%{$domconfig{'ltisec'}{'linkprot'}})) {
+                    unless ($id =~ /^\d+$/) {
+                        delete($domconfig{'ltisec'}{'linkprot'}{$id});
+                    }
+                    if ((ref($domconfig{'ltisec'}{'linkprot'}{$id}) eq 'HASH') &&
+                        (ref($encconfig{'linkprot'}{$id}) eq 'HASH')) {
+                        foreach my $item ('key','secret') {
+                            $domconfig{'ltisec'}{'linkprot'}{$id}{$item} = $encconfig{'linkprot'}{$id}{$item};
+                        }
+                    }
+                }
+            }
+        }
+    }
     my @prefs_order = ('rolecolors','login','ipaccess','defaults','wafproxy','passwords',
                        'quotas','autoenroll','autoupdate','autocreate','directorysrch',
                        'contacts','usercreation','selfcreation','usermodification',
                        'scantron','requestcourses','requestauthor','coursecategories',
                        'serverstatuses','helpsettings','coursedefaults',
-                       'ltitools','selfenrollment','usersessions');
+                       'ltitools','selfenrollment','usersessions','lti');
     my %existing;
     if (ref($domconfig{'loadbalancing'}) eq 'HASH') {
         %existing = %{$domconfig{'loadbalancing'}};
@@ -527,6 +544,18 @@ sub handler {
                   print => \&print_ltitools,
                   modify => \&modify_ltitools,
                  },
+          'lti' =>
+                 {text => 'LTI Link Protection and LTI Consumers',
+                  help => 'Domain_Configuration_LTI_Provider',
+                  header => [{col1 => 'Encryption of shared secrets',
+                              col2 => 'Settings'},
+                             {col1 => 'Rules for shared secrets',
+                              col2 => 'Settings'},
+                             {col1 => 'Link Protectors',
+                              col2 => 'Settings'},],
+                  print => \&print_lti,
+                  modify => \&modify_lti,
+                 },
          'ipaccess' =>
                        {text => 'IP-based access control',
                         help => 'Domain_Configuration_IP_Access',
@@ -542,7 +571,7 @@ sub handler {
                             header => [{col1 => 'Log-in Service',
                                         col2 => 'Server Setting',},
                                        {col1 => 'Log-in Page Items',
-                                        col2 => ''},
+                                        col2 => 'Settings'},
                                        {col1 => 'Log-in Help',
                                         col2 => 'Value'},
                                        {col1 => 'Custom HTML in document head',
@@ -722,6 +751,8 @@ sub process_changes {
         $output = &modify_usersessions($dom,$lastactref,%domconfig);
     } elsif ($action eq 'loadbalancing') {
         $output = &modify_loadbalancing($dom,%domconfig);
+    } elsif ($action eq 'lti') {
+        $output = &modify_lti($r,$dom,$action,$lastactref,%domconfig);
     } elsif ($action eq 'passwords') {
         $output = &modify_passwords($r,$dom,$confname,$lastactref,%domconfig);
     } elsif ($action eq 'ltitools') {
@@ -743,7 +774,7 @@ sub print_config_box {
     } elsif ($action eq 'defaults') {
         $output = &defaults_javascript($settings); 
     } elsif ($action eq 'passwords') {
-        $output = &passwords_javascript();
+        $output = &passwords_javascript($action);
     } elsif ($action eq 'helpsettings') {
         my (%privs,%levelscurrent);
         my %full=();
@@ -762,6 +793,9 @@ sub print_config_box {
                                                       \@templateroles);
     } elsif ($action eq 'ltitools') {
         $output .= &ltitools_javascript($settings);
+    } elsif ($action eq 'lti') {
+        $output .= &passwords_javascript('secrets')."\n".
+                   &lti_javascript($dom,$settings);
     } elsif ($action eq 'wafproxy') {
         $output .= &wafproxy_javascript($dom);
     } elsif ($action eq 'autoupdate') {
@@ -812,7 +846,7 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') || ($action eq 'selfcreation') ||
             ($action eq 'usermodification') || ($action eq 'defaults') || ($action eq 'coursedefaults') ||
             ($action eq 'selfenrollment') || ($action eq 'usersessions') || ($action eq 'directorysrch') ||
-            ($action eq 'helpsettings') || ($action eq 'contacts') || ($action eq 'wafproxy')) {
+            ($action eq 'helpsettings') || ($action eq 'contacts') || ($action eq 'wafproxy') || ($action eq 'lti')) {
             $output .= $item->{'print'}->('top',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'passwords') {
             $output .= $item->{'print'}->('top',$dom,$confname,$settings,\$rowtotal);
@@ -847,7 +881,7 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') ||
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') ||
-            ($action eq 'contacts') || ($action eq 'passwords')) {
+            ($action eq 'contacts') || ($action eq 'passwords') || ($action eq 'lti')) {
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
@@ -1190,6 +1224,7 @@ sub print_login {
             }
         }
         my @images = ('img','logo','domlogo','login');
+        my @alttext = ('img','logo','domlogo');
         my @logintext = ('textcol','bgcol');
         my @bgs = ('pgbg','mainbg','sidebg');
         my @links = ('link','alink','vlink');
@@ -1231,6 +1266,13 @@ sub print_login {
                     $designs{'showlogo'}{$item} = $settings->{'showlogo'}{$item};
                 }
             }
+            foreach my $item (@alttext) {
+                if (ref($settings->{'alttext'}) eq 'HASH') {
+                    if ($settings->{'alttext'}->{$item} ne '') {
+                        $designs{'alttext'}{$item} = $settings->{'alttext'}{$item};
+                    }
+                }
+            }
             foreach my $item (@logintext) {
                 if ($settings->{$item} ne '') {
                     $designs{'logintext'}{$item} = $settings->{$item};
@@ -1540,6 +1582,7 @@ sub login_choices {
             current       => "Current",
             samllanding   => "Dual login?",
             samloptions   => "Options",
+            alttext       => "Alt text",
         );
     return %choices;
 }
@@ -1885,7 +1928,7 @@ sub display_color_options {
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'>'.
                       '<td>'.$choices->{$img};
-        my ($imgfile,$img_import,$login_hdr_pick,$logincolors);
+        my ($imgfile,$img_import,$login_hdr_pick,$logincolors,$alttext);
         if ($role eq 'login') {
             if ($img eq 'login') {
                 $login_hdr_pick =
@@ -1893,8 +1936,13 @@ sub display_color_options {
                 $logincolors =
                     &login_text_colors($img,$role,$logintext,$phase,$choices,
                                        $designs,$defaults);
-            } elsif ($img ne 'domlogo') {
-                $datatable.= &logo_display_options($img,$defaults,$designs);
+            } else {
+                if ($img ne 'domlogo') {
+                    $datatable.= &logo_display_options($img,$defaults,$designs);
+                }
+                if (ref($designs->{'alttext'}) eq 'HASH') {
+                    $alttext = $designs->{'alttext'}{$img};
+                }
             }
         }
         $datatable .= '</td>';
@@ -1986,6 +2034,11 @@ sub display_color_options {
                 $datatable .='&nbsp;<input type="file" name="'.$role.'_'.$img.'" />';
             }
         }
+        if (($role eq 'login') && ($img ne 'login')) {
+            $datatable .= ('&nbsp;' x2).' <span class="LC_nobreak"><label>'.$choices->{'alttext'}.':'.
+                          '<input type="text" name="'.$role.'_alt_'.$img.'" size="10" value="'.$alttext.'" />'.
+                          '</label></span>';
+        }
         $datatable .= '</td></tr>';
     }
     $itemcount ++;
@@ -3079,6 +3132,140 @@ function toggleWAF() {
 ENDSCRIPT
 }
 
+sub lti_javascript {
+    my ($dom,$settings) = @_;
+    my $togglejs = &lti_toggle_js($dom);
+    my $linkprot_js = &Apache::courseprefs::linkprot_javascript();
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+
+$linkprot_js
+
+// ]]>
+</script>
+
+$togglejs
+
+ENDSCRIPT
+}
+
+sub lti_toggle_js {
+    my ($dom) = @_;
+    my %servers = &Apache::lonnet::get_servers($dom,'library');
+    my $primary = &Apache::lonnet::domain($dom,'primary');
+    my $course_servers = "'".join("','",keys(%servers))."'";
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function toggleLTIEncKey(form) {
+    var shownhosts = new Array();
+    var hiddenhosts = new Array();
+    var forcourse = new Array($course_servers);
+    var fromdomain = '$primary';
+    var crsradio = form.elements['ltisec_crslinkprot'];
+    if (crsradio.length) {
+        for (var i=0; i<crsradio.length; i++) {
+            if (crsradio[i].checked) {
+                if (crsradio[i].value == 1) {
+                    if (forcourse.length > 0) {
+                        for (var j=0; j<forcourse.length; j++) {
+                            if (!shownhosts.includes(forcourse[j])) {
+                                shownhosts.push(forcourse[j]);
+                            }
+                        }
+                    }
+                } else {
+                    if (forcourse.length > 0) {
+                        for (var j=0; j<forcourse.length; j++) {
+                            if (!hiddenhosts.includes(forcourse[j])) {
+                                hiddenhosts.push(forcourse[j]);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    var domradio = form.elements['ltisec_domlinkprot'];
+    if (domradio.length) {
+        for (var i=0; i<domradio.length; i++) {
+            if (domradio[i].checked) {
+                if (domradio[i].value == 1) {
+                    if (!shownhosts.includes(fromdomain)) {
+                        shownhosts.push(fromdomain);
+                    }
+                } else {
+                    if (!hiddenhosts.includes(fromdomain)) {
+                        hiddenhosts.push(fromdomain);
+                    }
+                }
+            }
+        }
+    }
+    if (shownhosts.length > 0) {
+        for (var i=0; i<shownhosts.length; i++) {
+            if (document.getElementById('ltisec_info_'+shownhosts[i])) {
+                document.getElementById('ltisec_info_'+shownhosts[i]).style.display = 'block';
+            }
+        }
+        if (document.getElementById('ltisec_noprivkey')) {
+            document.getElementById('ltisec_noprivkey').style.display = 'none';
+        }
+    } else {
+        if (document.getElementById('ltisec_noprivkey')) {
+            document.getElementById('ltisec_noprivkey').style.display = 'inline-block';
+        }
+    }
+    if (hiddenhosts.length > 0) {
+        for (var i=0; i<hiddenhosts.length; i++) {
+            if (!shownhosts.includes(hiddenhosts[i])) {
+                if (document.getElementById('ltisec_info_'+hiddenhosts[i])) {
+                    document.getElementById('ltisec_info_'+hiddenhosts[i]).style.display = 'none';
+                }
+            }
+        }
+    }
+    return;
+}
+
+function togglePrivKey(form,hostid) {
+    var radioname = '';
+    var currdivid = '';
+    var newdivid = '';
+    if ((document.getElementById('ltisec_divcurrprivkey_'+hostid)) &&
+        (document.getElementById('ltisec_divchgprivkey_'+hostid))) {
+        currdivid = document.getElementById('ltisec_divcurrprivkey_'+hostid);
+        newdivid = document.getElementById('ltisec_divchgprivkey_'+hostid);
+        radioname = form.elements['ltisec_changeprivkey_'+hostid];
+        if (radioname) {
+            if (radioname.length > 0) {
+                var setvis;
+                for (var i=0; i<radioname.length; i++) {
+                    if (radioname[i].checked == true) {
+                        if (radioname[i].value == 1) {
+                            newdivid.style.display = 'inline-block';
+                            currdivid.style.display = 'none';
+                            setvis = 1;
+                        }
+                        break;
+                    }
+                }
+                if (!setvis) {
+                    newdivid.style.display = 'none';
+                    currdivid.style.display = 'inline-block';
+                }
+            }
+        }
+    }
+}
+
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
 sub autoupdate_javascript {
     return <<"ENDSCRIPT";
 <script type="text/javascript">
@@ -5029,6 +5216,146 @@ sub ltitools_names {
     return %lt;
 }
 
+sub print_lti {
+    my ($position,$dom,$settings,$rowtotal) = @_;
+    my $itemcount = 1;
+    my ($datatable,$css_class);
+    my (%rules,%encrypt,%privkeys,%linkprot);
+    if (ref($settings) eq 'HASH') {
+        if ($position eq 'top') {
+            if (exists($settings->{'encrypt'})) {
+                if (ref($settings->{'encrypt'}) eq 'HASH') {
+                    foreach my $key (keys(%{$settings->{'encrypt'}})) {
+                        $encrypt{'ltisec_'.$key.'linkprot'} = $settings->{'encrypt'}{$key};
+                    }
+                }
+            }
+            if (exists($settings->{'private'})) {
+                if (ref($settings->{'private'}) eq 'HASH') {
+                    if (ref($settings->{'private'}) eq 'HASH') {
+                        if (ref($settings->{'private'}{'keys'}) eq 'ARRAY') {
+                            map { $privkeys{$_} = 1; } (@{$settings->{'private'}{'keys'}});
+                        }
+                    }
+                }
+            }
+        } elsif ($position eq 'middle') {
+            if (exists($settings->{'rules'})) {
+                if (ref($settings->{'rules'}) eq 'HASH') {
+                    %rules = %{$settings->{'rules'}};
+                }
+            }
+        } elsif ($position eq 'bottom') {
+            if (exists($settings->{'linkprot'})) {
+                if (ref($settings->{'linkprot'}) eq 'HASH') {
+                    %linkprot = %{$settings->{'linkprot'}};
+                    if ($linkprot{'lock'}) {
+                        delete($linkprot{'lock'});
+                    }
+                }
+            }
+        }
+    }
+    if ($position eq 'top') {
+        my @ids=&Apache::lonnet::current_machine_ids();
+        my %servers = &Apache::lonnet::get_servers($dom,'library');
+        my $primary = &Apache::lonnet::domain($dom,'primary');
+        my ($extra,$numshown);
+        foreach my $hostid (sort(keys(%servers))) {
+            my ($showextra,$divsty,$switch);
+            if ($hostid eq $primary) {
+                if ($encrypt{'ltisec_domlinkprot'}) {
+                    $showextra = 1;
+                }
+            }
+            if ($encrypt{'ltisec_crslinkprot'}) {
+                $showextra = 1;
+            }
+            unless (grep(/^\Q$hostid\E$/,@ids)) {
+                $switch = 1;
+            }
+            if ($showextra) {
+                $numshown ++;
+                $divsty = 'display:inline-block';
+            } else {
+                $divsty = 'display:none';
+            }
+            $extra .= '<fieldset id="ltisec_info_'.$hostid.'" style="'.$divsty.'">'.
+                      '<legend>'.$hostid.'</legend>';
+            if ($switch) {
+                my $switchserver = '<a href="/adm/switchserver?otherserver='.$hostid.'&amp;role='.
+                                   &HTML::Entities::encode($env{'request.role'},'\'<>"&').
+                                   '&amp;destinationurl=/adm/domainprefs">'.&mt('Switch Server').'</a>';
+                if (exists($privkeys{$hostid})) {
+                    $extra .= '<div id="ltisec_divcurrprivkey_'.$hostid.'" style="display:inline-block" />'.
+                              '<span class="LC_nobreak">'.
+                              &mt('Encryption Key').': ['.&mt('not shown').'] '.('&nbsp;'x2).'</span></div>'.
+                              '<span class="LC_nobreak">'.&mt('Change?').
+                              '<label><input type="radio" value="0" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" checked="checked" />'.&mt('No').'</label>'.
+                              ('&nbsp;'x2).
+                              '<label><input type="radio" value="1" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" />'.&mt('Yes').
+                              '</label>&nbsp;&nbsp;</span><div id="ltisec_divchgprivkey_'.$hostid.'" style="display:none" />'.
+                              '<span class="LC_nobreak"> - '.&mt('submit from server ([_1]): [_2].',$hostid,$switchserver).
+                              '</span></div>';
+                } else {
+                    $extra .= '<span class="LC_nobreak">'.
+                              &mt('Key required').' - '.&mt('submit from server ([_1]): [_2].',$hostid,$switchserver).
+                              '</span>'."\n";
+                }
+            } elsif (exists($privkeys{$hostid})) {
+                $extra .= '<div id="ltisec_divcurrprivkey_'.$hostid.'" style="display:inline-block" /><span class="LC_nobreak">'.
+                          &mt('Encryption Key').': ['.&mt('not shown').'] '.('&nbsp;'x2).'</span></div>'.
+                          '<span class="LC_nobreak">'.&mt('Change?').
+                          '<label><input type="radio" value="0" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" checked="checked" />'.&mt('No').'</label>'.
+                          ('&nbsp;'x2).
+                          '<label><input type="radio" value="1" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" />'.&mt('Yes').
+                          '</label>&nbsp;&nbsp;</span><div id="ltisec_divchgprivkey_'.$hostid.'" style="display:none" />'.
+                          '<span class="LC_nobreak">'.&mt('New Key').':'.
+                          '<input type="password" size="20" name="ltisec_privkey_'.$hostid.'" value="" autocomplete="off" />'.
+                          '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.ltisec_privkey_'.$hostid.'.type='."'text'".' } else { this.form.ltisec_privkey_'.$hostid.'.type='."'password'".' }" />'.&mt('Visible input').'</label>'.
+                          '</span></div>';
+            } else {
+                $extra .= '<span class="LC_nobreak">'.&mt('Encryption Key').':'.
+                          '<input type="password" size="20" name="ltisec_privkey_'.$hostid.'" value="" autocomplete="off" />'.
+                          '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.ltisec_privkey_'.$hostid.'.type='."'text'".' } else { this.form.ltisec_privkey_'.$hostid.'.type='."'password'".' }" />'.&mt('Visible input').'</label>';
+            }
+            $extra .= '</fieldset>';
+        }
+        my %choices = &Apache::lonlocal::texthash (
+                                                      ltisec_crslinkprot => 'Encrypt stored link protection secrets defined in courses',
+                                                      ltisec_domlinkprot => 'Encrypt stored link protection secrets defined in domain',
+                                                  );
+        my @toggles = qw(ltisec_crslinkprot ltisec_domlinkprot);
+        my %defaultchecked = (
+                               'ltisec_crslinkprot' => 'off',
+                               'ltisec_domlinkprot' => 'off',
+                             );
+        my ($onclick,$itemcount);
+        $onclick = 'javascript:toggleLTIEncKey(this.form);';
+        ($datatable,$itemcount) = &radiobutton_prefs(\%encrypt,\@toggles,\%defaultchecked,
+                                                     \%choices,$itemcount,$onclick,'','left','no');
+
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        my $noprivkeysty = 'display:inline-block';
+        if ($numshown) {
+            $noprivkeysty = 'display:none';
+        }
+        $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'.&mt('Encryption Key(s)').'</td>'.
+                      '<td><div id="ltisec_noprivkey" style="'.$noprivkeysty.'" >'.
+                      '<span class="LC_nobreak">'.&mt('Not in use').'</span></div>'.
+                      $extra.
+                      '</td></tr>';
+        $itemcount ++;
+        $$rowtotal += $itemcount;
+    } elsif ($position eq 'middle') {
+        $datatable = &password_rules('secrets',\$itemcount,\%rules);
+        $$rowtotal += $itemcount;
+    } elsif ($position eq 'bottom') {
+         $datatable .= &Apache::courseprefs::print_linkprotection($dom,'',$settings,$rowtotal,'','','domain');
+    }
+    return $datatable;
+}
+
 sub print_coursedefaults {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my ($css_class,$datatable,%checkedon,%checkedoff,%defaultchecked,@toggles);
@@ -5045,6 +5372,7 @@ sub print_coursedefaults {
         canclone             => "People who may clone a course (besides course's owner and coordinators)",
         mysqltables          => 'Lifetime (s) of "Temporary" MySQL tables (student performance data) on homeserver',
     );
+        ltiauth              => 'Student username in LTI launch of deep-linked URL can be accepted without re-authentication',
     my %staticdefaults = (
                            anonsurvey_threshold => 10,
                            uploadquota          => 500,
@@ -5165,8 +5493,12 @@ sub print_coursedefaults {
         my ($currdefresponder,%defcredits,%curruploadquota,%deftimeout,%currmysql);
         my $currusecredits = 0;
         my $postsubmitclient = 1;
+        my $ltiauth = 0;
         my @types = ('official','unofficial','community','textbook');
         if (ref($settings) eq 'HASH') {
+            if ($settings->{'ltiauth'}) {
+                $ltiauth = 1;
+            }
             $currdefresponder = $settings->{'anonsurvey_threshold'};
             if (ref($settings->{'uploadquota'}) eq 'HASH') {
                 foreach my $type (keys(%{$settings->{'uploadquota'}})) {
@@ -5312,7 +5644,16 @@ sub print_coursedefaults {
         }
         $datatable .= '</tr></table></td></tr>'."\n";
         $itemcount ++;
-
+        %defaultchecked = ('ltiauth' => 'off');
+        @toggles = ('ltiauth');
+        $current = {
+                       'ltiauth' => $ltiauth,
+                   };
+        ($table,$itemcount) =
+            &radiobutton_prefs($current,\@toggles,\%defaultchecked,
+                               \%choices,$itemcount,undef,undef,'left');
+        $datatable .= $table;
+        $itemcount ++;
     }
     $$rowtotal += $itemcount;
     return $datatable;
@@ -5828,84 +6169,7 @@ sub print_passwords {
             $itemcount ++;
         }
     } elsif ($position eq 'lower') {
-        my ($min,$max,%chars,$numsaved);
-        $min = $Apache::lonnet::passwdmin;
-        if (ref($settings) eq 'HASH') {
-            if ($settings->{min}) {
-                $min = $settings->{min};
-            }
-            if ($settings->{max}) {
-                $max = $settings->{max};
-            }
-            if (ref($settings->{chars}) eq 'ARRAY') {
-                map { $chars{$_} = 1; } (@{$settings->{chars}});
-            }
-            if ($settings->{numsaved}) {
-                $numsaved = $settings->{numsaved};
-            }
-        }
-        my %rulenames = &Apache::lonlocal::texthash(
-                                                     uc => 'At least one upper case letter',
-                                                     lc => 'At least one lower case letter',
-                                                     num => 'At least one number',
-                                                     spec => 'At least one non-alphanumeric',
-                                                   );
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
-                      '</span></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
-                      '</span></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'chars'}.'<br />'.
-                      '<span class="LC_nobreak LC_fontsize_small">'.&mt('(Leave unchecked if not required)').
-                      '</span></td>';
-        my $numinrow = 2;
-        my @possrules = ('uc','lc','num','spec');
-        $datatable .= '<td class="LC_left_item"><table>';
-        for (my $i=0; $i<@possrules; $i++) {
-            my ($rem,$checked);
-            if ($chars{$possrules[$i]}) {
-                $checked = ' checked="checked"';
-            }
-            $rem = $i%($numinrow);
-            if ($rem == 0) {
-                if ($i > 0) {
-                    $datatable .= '</tr>';
-                }
-                $datatable .= '<tr>';
-            }
-            $datatable .= '<td><span class="LC_nobreak"><label>'.
-                          '<input type="checkbox" name="passwords_chars" value="'.$possrules[$i].'"'.$checked.' />'.
-                          $rulenames{$possrules[$i]}.'</label></span></td>';
-        }
-        my $rem = @possrules%($numinrow);
-        my $colsleft = $numinrow - $rem;
-        if ($colsleft > 1 ) {
-            $datatable .= '<td colspan="'.$colsleft.'" class="LC_left_item">'.
-                          '&nbsp;</td>';
-        } elsif ($colsleft == 1) {
-            $datatable .= '<td class="LC_left_item">&nbsp;</td>';
-        }
-        $datatable .='</table></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
-                      '</span></td></tr>';
+        $datatable .= &password_rules('passwords',\$itemcount,$settings);
     } else {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
         my %ownerchg = (
@@ -5965,6 +6229,117 @@ sub print_passwords {
     return $datatable;
 }
 
+sub password_rules {
+    my ($prefix,$itemcountref,$settings) = @_;
+    my ($min,$max,%chars,$numsaved,$numinrow);
+    my %titles;
+    if ($prefix eq 'passwords') {
+        %titles = &Apache::lonlocal::texthash (
+            min            => 'Minimum password length',
+            max            => 'Maximum password length',
+            chars          => 'Required characters',
+        );
+    } elsif ($prefix eq 'secrets') {
+        %titles = &Apache::lonlocal::texthash (
+            min            => 'Minimum secret length',
+            max            => 'Maximum secret length',
+            chars          => 'Required characters',
+        );
+    }
+    $min = $Apache::lonnet::passwdmin;
+    my $datatable;
+    my $itemcount;
+    if (ref($itemcountref)) {
+        $itemcount = $$itemcountref;
+    }
+    if (ref($settings) eq 'HASH') {
+        if ($settings->{min}) {
+            $min = $settings->{min};
+        }
+        if ($settings->{max}) {
+            $max = $settings->{max};
+        }
+        if (ref($settings->{chars}) eq 'ARRAY') {
+            map { $chars{$_} = 1; } (@{$settings->{chars}});
+        }
+        if ($prefix eq 'passwords') {
+            if ($settings->{numsaved}) {
+                $numsaved = $settings->{numsaved};
+            }
+        }
+    }
+    my %rulenames = &Apache::lonlocal::texthash(
+                                                 uc => 'At least one upper case letter',
+                                                 lc => 'At least one lower case letter',
+                                                 num => 'At least one number',
+                                                 spec => 'At least one non-alphanumeric',
+                                               );
+    my $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
+                  '<td class="LC_left_item"><span class="LC_nobreak">'.
+                  '<input type="text" name="'.$prefix.'_min" value="'.$min.'" size="3" '.
+                  'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                  '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
+                  '</span></td></tr>';
+    $itemcount ++;
+    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
+                  '<td class="LC_left_item"><span class="LC_nobreak">'.
+                  '<input type="text" name="'.$prefix.'_max" value="'.$max.'" size="3" '.
+                  'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                  '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
+                  '</span></td></tr>';
+    $itemcount ++;
+    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'chars'}.'<br />'.
+                  '<span class="LC_nobreak LC_fontsize_small">'.&mt('(Leave unchecked if not required)').
+                  '</span></td>';
+    my $numinrow = 2;
+    my @possrules = ('uc','lc','num','spec');
+    $datatable .= '<td class="LC_left_item"><table>';
+    for (my $i=0; $i<@possrules; $i++) {
+        my ($rem,$checked);
+        if ($chars{$possrules[$i]}) {
+            $checked = ' checked="checked"';
+        }
+        $rem = $i%($numinrow);
+        if ($rem == 0) {
+            if ($i > 0) {
+                $datatable .= '</tr>';
+            }
+            $datatable .= '<tr>';
+        }
+        $datatable .= '<td><span class="LC_nobreak"><label>'.
+                      '<input type="checkbox" name="'.$prefix.'_chars" value="'.$possrules[$i].'"'.$checked.' />'.
+                      $rulenames{$possrules[$i]}.'</label></span></td>';
+    }
+    my $rem = @possrules%($numinrow);
+    my $colsleft = $numinrow - $rem;
+    if ($colsleft > 1 ) {
+        $datatable .= '<td colspan="'.$colsleft.'" class="LC_left_item">'.
+                      '&nbsp;</td>';
+    } elsif ($colsleft == 1) {
+        $datatable .= '<td class="LC_left_item">&nbsp;</td>';
+    }
+    $datatable .='</table></td></tr>';
+    $itemcount ++;
+    if ($prefix eq 'passwords') {
+        $titles{'numsaved'} = &mt('Number of previous passwords to save and disallow reuse');
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="'.$prefix.'_numsaved" value="'.$numsaved.'" size="3" '.
+                      'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+    }
+    if (ref($itemcountref)) {
+        $$itemcountref += $itemcount;
+    }
+    return $datatable;
+}
+
 sub print_wafproxy {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my $css_class;
@@ -8954,17 +9329,26 @@ ENDSCRIPT
 }
 
 sub passwords_javascript {
-    my %intalert = &Apache::lonlocal::texthash (
-        authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
-        authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
-        passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
-        passmax => 'Warning: maximum password length must be a positive integer (or blank).',
-        passexp => 'Warning: days before password expiration must be a positive integer (or blank).',
-        passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
-    );
+    my ($prefix) = @_;
+    my %intalert;
+    if ($prefix eq 'passwords') {
+        %intalert = &Apache::lonlocal::texthash (
+            authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
+            authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
+            passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
+            passmax => 'Warning: maximum password length must be a positive integer (or blank).',
+            passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
+        );
+    } elsif ($prefix eq 'secrets') {
+        %intalert = &Apache::lonlocal::texthash (
+            passmin => 'Warning: minimum secret length must be a positive integer greater than 6.',
+            passmax => 'Warning: maximum secret length must be a positive integer (or blank).',
+        );
+    }
     &js_escape(\%intalert);
     my $defmin = $Apache::lonnet::passwdmin;
-    my $intauthjs = <<"ENDSCRIPT";
+    my $intauthjs;
+    if ($prefix eq 'passwords') { $intauthjs = <<"ENDSCRIPT";
 
 function warnIntAuth(field) {
     if (field.name == 'intauth_check') {
@@ -8984,11 +9368,17 @@ function warnIntAuth(field) {
     return;
 }
 
-function warnIntPass(field) {
+ENDSCRIPT
+
+     }
+
+     $intauthjs .= <<"ENDSCRIPT";
+
+function warnInt$prefix(field) {
     field.value.replace(/^\s+/,'');
     field.value.replace(/\s+\$/,'');
     var regexdigit=/^\\d+\$/;
-    if (field.name == 'passwords_min') {
+    if (field.name == '${prefix}_min') {
         if (field.value == '') {
             alert('$intalert{passmin}');
             field.value = '$defmin';
@@ -9008,29 +9398,15 @@ function warnIntPass(field) {
             field.value = '';
         }
         if (field.value != '') {
-            if (field.name == 'passwords_expire') {
-                var regexpposnum=/^\\d+(|\\.\\d*)\$/;
-                if (!regexpposnum.test(field.value)) {
-                    alert('$intalert{passexp}');
-                    field.value = '';
+            if (!regexdigit.test(field.value)) {
+                if (field.name == '${prefix}_max') {
+                    alert('$intalert{passmax}');
                 } else {
-                    var expval = parseFloat(field.value);
-                    if (expval == 0) {
-                        alert('$intalert{passexp}');
-                        field.value = '';
+                    if (field.name == '${prefix}_numsaved') {
+                        alert('$intalert{passnum}');
                     }
                 }
-            } else {
-                if (!regexdigit.test(field.value)) {
-                    if (field.name == 'passwords_max') {
-                        alert('$intalert{passmax}');
-                    } else {
-                        if (field.name == 'passwords_numsaved') {
-                            alert('$intalert{passnum}');
-                        }
-                    }
-                    field.value = '';
-                }
+                field.value = '';
             }
         }
     }
@@ -10628,13 +11004,18 @@ sub modify_colors {
             $domconfig->{$role} = {};
         }
         foreach my $img (@images) {
-            if (($role eq 'login') && (($img eq 'img') || ($img eq 'logo'))) {  
-                if (defined($env{'form.login_showlogo_'.$img})) {
-                    $confhash->{$role}{'showlogo'}{$img} = 1;
-                } else { 
-                    $confhash->{$role}{'showlogo'}{$img} = 0;
+            if ($role eq 'login') {
+                if (($img eq 'img') || ($img eq 'logo')) {  
+                    if (defined($env{'form.login_showlogo_'.$img})) {
+                        $confhash->{$role}{'showlogo'}{$img} = 1;
+                    } else { 
+                        $confhash->{$role}{'showlogo'}{$img} = 0;
+                    }
                 }
-            } 
+                if ($env{'form.login_alt_'.$img} ne '') {
+                    $confhash->{$role}{'alttext'}{$img} = $env{'form.login_alt_'.$img};
+                }
+            }
 	    if ( ! $env{'form.'.$role.'_'.$img.'.filename'} 
 		 && !defined($domconfig->{$role}{$img})
 		 && !$env{'form.'.$role.'_del_'.$img}
@@ -10709,15 +11090,29 @@ sub modify_colors {
                             $changes{$role}{'images'}{$img} = 1;
                         } 
                     }
-                    if (($role eq 'login') && (($img eq 'logo') || ($img eq 'img'))) {
-                        if (ref($domconfig->{'login'}{'showlogo'}) eq 'HASH') {
-                            if ($confhash->{$role}{'showlogo'}{$img} ne 
-                                $domconfig->{$role}{'showlogo'}{$img}) {
-                                $changes{$role}{'showlogo'}{$img} = 1; 
+                    if ($role eq 'login') {
+                        if (($img eq 'logo') || ($img eq 'img')) {
+                            if (ref($domconfig->{'login'}{'showlogo'}) eq 'HASH') {
+                                if ($confhash->{$role}{'showlogo'}{$img} ne 
+                                    $domconfig->{$role}{'showlogo'}{$img}) {
+                                    $changes{$role}{'showlogo'}{$img} = 1; 
+                                }
+                            } else {
+                                if ($confhash->{$role}{'showlogo'}{$img} == 0) {
+                                    $changes{$role}{'showlogo'}{$img} = 1;
+                                }
                             }
-                        } else {
-                            if ($confhash->{$role}{'showlogo'}{$img} == 0) {
-                                $changes{$role}{'showlogo'}{$img} = 1;
+                        }
+                        if ($img ne 'login') {
+                            if (ref($domconfig->{$role}{'alttext'}) eq 'HASH') {
+                                if ($confhash->{$role}{'alttext'}{$img} ne
+                                    $domconfig->{$role}{'alttext'}{$img}) {
+                                    $changes{$role}{'alttext'}{$img} = 1;
+                                }
+                            } else {
+                                if ($confhash->{$role}{'alttext'}{$img} ne '') {
+                                    $changes{$role}{'alttext'}{$img} = 1;
+                                }
                             }
                         }
                     }
@@ -10828,6 +11223,11 @@ sub default_change_checker {
             if ($confhash->{$role}{'showlogo'}{$img} == 0) {
                 $changes->{$role}{'showlogo'}{$img} = 1;
             }
+            if (ref($confhash->{$role}{'alttext'}) eq 'HASH') {
+                if ($confhash->{$role}{'alttext'}{$img} ne '') {
+                    $changes->{$role}{'alttext'}{$img} = 1;
+                }
+            }
         }
     }
     if ($confhash->{$role}{'font'}) {
@@ -10866,6 +11266,13 @@ sub display_colorchgs {
                             } else {
                                 $resulttext .= '<li>'.&mt("$choices{$item} set to not be displayed").'</li>';
                             }
+                        } elsif (($role eq 'login') && ($key eq 'alttext')) {
+                            if ($confhash->{$role}{$key}{$item} ne '') {
+                                $resulttext .= '<li>'.&mt("$choices{$key} for $choices{$item} set to [_1].",
+                                               $confhash->{$role}{$key}{$item}).'</li>';
+                            } else {
+                                $resulttext .= '<li>'.&mt("$choices{$key} for $choices{$item} deleted.").'</li>';
+                            }
                         } elsif ($confhash->{$role}{$item} eq '') {
                             $resulttext .= '<li>'.&mt("$choices{$item} set to default").'</li>';
                         } else {
@@ -12577,6 +12984,255 @@ sub get_ltitools_id {
     return ($id,$error);
 }
 
+sub modify_lti {
+    my ($r,$dom,$action,$lastactref,%domconfig) = @_;
+    my %domdefaults = &Apache::lonnet::get_domain_defaults($dom,1);
+    my (%encconfig,$errors,$resulttext);
+
+    my (%currltisec,%secchanges,%newltisec,%newltienc,%keyset,%newkeyset);
+    $newltisec{'private'}{'keys'} = [];
+    $newltisec{'encrypt'} = {};
+    $newltisec{'rules'} = {};
+    $newltisec{'linkprot'} = {};
+    if (ref($domconfig{'ltisec'}) eq 'HASH') {
+        %currltisec = %{$domconfig{'ltisec'}};
+        if (ref($currltisec{'linkprot'}) eq 'HASH') {
+            foreach my $id (keys(%{$currltisec{'linkprot'}})) {
+                unless ($id =~ /^\d+$/) {
+                    delete($currltisec{'linkprot'}{$id});
+                }
+            }
+        }
+        if (ref($currltisec{'private'}) eq 'HASH') {
+            if (ref($currltisec{'private'}{'keys'}) eq 'ARRAY') {
+                $newltisec{'private'}{'keys'} = $currltisec{'private'}{'keys'};
+                map { $keyset{$_} = 1; } @{$currltisec{'private'}{'keys'}};
+            }
+        }
+    }
+    foreach my $item ('crs','dom') {
+        my $formelement = 'form.ltisec_'.$item.'linkprot';
+        if ($env{$formelement}) {
+            $newltisec{'encrypt'}{$item} = 1;
+            if (ref($currltisec{'encrypt'}) eq 'HASH') {
+                unless ($currltisec{'encrypt'}{$item}) {
+                    $secchanges{'encrypt'} = 1;
+                }
+            } else {
+                $secchanges{'encrypt'} = 1;
+            }
+        } elsif (ref($currltisec{'encrypt'}) eq 'HASH') {
+            if ($currltisec{'encrypt'}{$item}) {
+                $secchanges{'encrypt'} = 1;
+            }
+        }
+    }
+    unless (exists($currltisec{'rules'})) {
+        $currltisec{'rules'} = {};
+    }
+    &password_rule_changes('secrets',$newltisec{'rules'},$currltisec{'rules'},\%secchanges);
+
+    my @ids=&Apache::lonnet::current_machine_ids();
+    my %servers = &Apache::lonnet::get_servers($dom,'library');
+
+    foreach my $hostid (keys(%servers)) {
+        if (($hostid ne '') && (grep(/^\Q$hostid\E$/,@ids))) {
+            my $newkey;
+            my $keyitem = 'form.ltisec_privkey_'.$hostid;
+            if (exists($env{$keyitem})) {
+                $env{$keyitem} =~ s/(`)/'/g;
+                if ($keyset{$hostid}) {
+                    if ($env{'form.ltisec_changeprivkey_'.$hostid}) {
+                        if ($env{$keyitem} ne '') {
+                            $secchanges{'private'} = 1;
+                            $newkeyset{$hostid} = $env{$keyitem};
+                        }
+                    }
+                } elsif ($env{$keyitem} ne '') {
+                    unless (grep(/^\Q$hostid\E$/,@{$newltisec{'private'}{'keys'}})) {
+                        push(@{$newltisec{'private'}{'keys'}},$hostid);
+                    }
+                    $secchanges{'private'} = 1;
+                    $newkeyset{$hostid} = $env{$keyitem};
+                }
+            }
+        }
+    }
+
+    my (%linkprotchg,$linkprotoutput,$is_home);
+    my $proterror = &Apache::courseprefs::process_linkprot($dom,'',$currltisec{'linkprot'},
+                                                           \%linkprotchg,'domain');
+    my $home = &Apache::lonnet::domain($dom,'primary');
+    unless (($home eq 'no_host') || ($home eq '')) {
+        my @ids=&Apache::lonnet::current_machine_ids();
+        foreach my $id (@ids) { if ($id eq $home) { $is_home=1; } }
+    }
+
+    if (keys(%linkprotchg)) {
+        $secchanges{'linkprot'} = 1;
+        my %oldlinkprot;
+        if (ref($currltisec{'linkprot'}) eq 'HASH') {
+            %oldlinkprot = %{$currltisec{'linkprot'}};
+        }
+        foreach my $id (keys(%linkprotchg)) {
+            if (ref($linkprotchg{$id}) eq 'HASH') {
+                foreach my $inner (keys(%{$linkprotchg{$id}})) {
+                    if (($inner eq 'secret') || ($inner eq 'key')) {
+                        if ($is_home) {
+                            $newltienc{$id}{$inner} = $linkprotchg{$id}{$inner};
+                        }
+                    }
+                }
+            } else {
+                $newltisec{'linkprot'}{$id} = $linkprotchg{$id};
+            }
+        }
+        $linkprotoutput = &Apache::courseprefs::store_linkprot($dom,'','domain',\%linkprotchg,\%oldlinkprot);
+        if (keys(%linkprotchg)) {
+            %{$newltisec{'linkprot'}} = %linkprotchg;
+        }
+    }
+    if (ref($currltisec{'linkprot'}) eq 'HASH') {
+        foreach my $id (%{$currltisec{'linkprot'}}) {
+            next if ($id !~ /^\d+$/);
+            unless (exists($linkprotchg{$id})) {
+                if (ref($currltisec{'linkprot'}{$id}) eq 'HASH') {
+                    foreach my $inner (keys(%{$currltisec{'linkprot'}{$id}})) {
+                        if (($inner eq 'secret') || ($inner eq 'key')) {
+                            if ($is_home) {
+                                $newltienc{$id}{$inner} = $currltisec{'linkprot'}{$id}{$inner};
+                            }
+                        } else {
+                            $newltisec{'linkprot'}{$id}{$inner} = $currltisec{'linkprot'}{$id}{$inner};
+                        }
+                    }
+                } else {
+                    $newltisec{'linkprot'}{$id} = $currltisec{'linkprot'}{$id};
+                }
+            }
+        }
+    }
+    if ($proterror) {
+        $errors .= '<li>'.$proterror.'</li>';
+    }
+
+    my ($putresult,%keystore);
+    if (keys(%secchanges)) {
+        my %ltienchash;
+        my %ltihash = (
+                          'ltisec' => { %newltisec }
+                      );
+        $putresult = &Apache::lonnet::put_dom('configuration',\%ltihash,$dom);
+        if ($putresult eq 'ok') {
+            if ($secchanges{'private'}) {
+                my $who = &escape($env{'user.name'}.':'.$env{'user.domain'});
+                foreach my $hostid (keys(%newkeyset)) {
+                    my $storehash = {
+                                       key => $newkeyset{$hostid},
+                                       who => $env{'user.name'}.':'.$env{'user.domain'},
+                                    };
+                    $keystore{$hostid} = &Apache::lonnet::store_dom($storehash,'lti','private',
+                                                                    $dom,$hostid);
+                }
+            }
+            if (ref($lastactref) eq 'HASH') {
+                if (($secchanges{'encrypt'}) || ($secchanges{'private'})) {
+                    $lastactref->{'domdefaults'} = 1;
+                }
+            }
+            if (($secchanges{'linkprot'}) && ($is_home)) {
+                my %ltienchash = (
+                                     'linkprot' =>  { %newltienc }
+                                 );
+                &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom,undef,1);
+            }
+        }
+    } else {
+        return &mt('No changes made.');
+    }
+    if ($putresult eq 'ok') {
+        $resulttext = &mt('Changes made:').'<ul>';
+        foreach my $item (keys(%secchanges)) {
+            if ($item eq 'encrypt') {
+                my %encrypted = (
+                          crs  => {
+                                    on => &mt('Encryption of stored link protection secrets defined in courses enabled'),
+                                    off => &mt('Encryption of stored link protection secrets defined in courses disabled'),
+                                  },
+                          dom => {
+                                   on => &mt('Encryption of stored link protection secrets defined in domain enabled'),
+                                   off => &mt('Encryption of stored link protection secrets defined in domain disabled'),
+                                 },
+                );
+                foreach my $type ('crs','dom') {
+                    my $shown = $encrypted{$type}{'off'};
+                    if (ref($newltisec{$item}) eq 'HASH') {
+                        if ($newltisec{$item}{$type}) {
+                            $shown = $encrypted{$type}{'on'};
+                        }
+                    }
+                    $resulttext .= '<li>'.$shown.'</li>';
+                }
+            } elsif ($item eq 'rules') {
+                my %titles = &Apache::lonlocal::texthash(
+                                  min   => 'Minimum password length',
+                                  max   => 'Maximum password length',
+                                  chars => 'Required characters',
+                );
+                foreach my $rule ('min','max') {
+                    if ($newltisec{rules}{$rule} eq '') {
+                        if ($rule eq 'min') {
+                            $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
+                                           ' '.&mt('Default of [_1] will be used',
+                                                       $Apache::lonnet::passwdmin).'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
+                        }
+                    } else {
+                        $resulttext .= '<li>'.&mt('[_1] set to [_2]',$titles{$rule},$newltisec{rules}{$rule}).'</li>';
+                    }
+                }
+                if (ref($newltisec{'rules'}{'chars'}) eq 'ARRAY') {
+                    if (@{$newltisec{'rules'}{'chars'}} > 0) {
+                        my %rulenames = &Apache::lonlocal::texthash(
+                                            uc => 'At least one upper case letter',
+                                            lc => 'At least one lower case letter',
+                                            num => 'At least one number',
+                                            spec => 'At least one non-alphanumeric',
+                                            );
+                        my $needed = '<ul><li>'.
+                                     join('</li><li>',map {$rulenames{$_} } @{$newltisec{'rules'}{'chars'}}).
+                                     '</li></ul>';
+                        $resulttext .= '<li>'.&mt('[_1] set to: [_2]',$titles{'chars'},$needed).'</li>';
+                    } else {
+                        $resulttext .= '<li>'.&mt('[_1] set to none',$titles{'chars'}).'</li>';
+                    }
+                } else {
+                    $resulttext .= '<li>'.&mt('[_1] set to none',$titles{'chars'}).'</li>';
+                }
+            } elsif ($item eq 'private') {
+                if (keys(%newkeyset)) {
+                    foreach my $hostid (sort(keys(%newkeyset))) {
+                        if ($keystore{$hostid} eq 'ok') {
+                            $resulttext .= '<li>'.&mt('Encryption key for storage of shared secrets saved for [_1]',$hostid).'</li>';
+                        }
+                    }
+                }
+            } elsif ($item eq 'linkprot') {
+                $resulttext .= $linkprotoutput;
+            }
+        }
+        $resulttext .= '</ul>';
+    } else {
+        $errors .= '<li><span class="LC_error">'.&mt('Failed to save changes').'</span></li>';
+    }
+    if ($errors) {
+        $resulttext .= &mt('The following errors occurred: ').'<ul>'.
+                       $errors.'</ul>';
+    }
+    return $resulttext;
+}
+
 sub modify_autoenroll {
     my ($dom,$lastactref,%domconfig) = @_;
     my ($resulttext,%changes);
@@ -14025,56 +14681,7 @@ sub modify_passwords {
             $updatedefaults = 1;
         }
     }
-    foreach my $rule ('min','max','numsaved') {
-        $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
-        my $ruleok;
-        if ($rule eq 'min') {
-            if ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
-                if ($env{'form.passwords_'.$rule} >= $Apache::lonnet::passwdmin) {
-                    $ruleok = 1;
-                }
-            }
-        } elsif (($env{'form.passwords_'.$rule} =~ /^\d+$/) &&
-                 ($env{'form.passwords_'.$rule} ne '0')) {
-            $ruleok = 1;
-        }
-        if ($ruleok) {
-            $newvalues{$rule} = $env{'form.passwords_'.$rule};
-            if (exists($current{$rule})) {
-                if ($newvalues{$rule} ne $current{$rule}) {
-                    $changes{'rules'} = 1;
-                }
-            } elsif ($rule eq 'min') {
-                if ($staticdefaults{$rule} ne $newvalues{$rule}) {
-                    $changes{'rules'} = 1;
-                }
-            } else {
-                $changes{'rules'} = 1;
-            }
-        } elsif (exists($current{$rule})) {
-            $changes{'rules'} = 1;
-        }
-    }
-    my @posschars = &Apache::loncommon::get_env_multiple('form.passwords_chars');
-    my @chars;
-    foreach my $item (sort(@posschars)) {
-        if ($item =~ /^(uc|lc|num|spec)$/) {
-            push(@chars,$item);
-        }
-    }
-    $newvalues{'chars'} = \@chars;
-    unless ($changes{'rules'}) {
-        if (ref($current{'chars'}) eq 'ARRAY') {
-            my @diffs = &Apache::loncommon::compare_arrays($current{'chars'},\@chars);
-            if (@diffs > 0) {
-                $changes{'rules'} = 1;
-            }
-        } else {
-            if (@chars > 0) {
-                $changes{'rules'} = 1;
-            }
-        }
-    }
+    &password_rule_changes('passwords',\%newvalues,\%current,\%changes);
     my %crsownerchg = (
                         by => [],
                         for => [],
@@ -14334,6 +14941,71 @@ sub modify_passwords {
     return $resulttext;
 }
 
+sub password_rule_changes {
+    my ($prefix,$newvalues,$current,$changes) = @_;
+    return unless ((ref($newvalues) eq 'HASH') &&
+                   (ref($current) eq 'HASH') &&
+                   (ref($changes) eq 'HASH'));
+    my (@rules,%staticdefaults);
+    if ($prefix eq 'passwords') {
+        @rules = ('min','max','numsaved');
+    } elsif ($prefix eq 'secrets') {
+        @rules = ('min','max');
+    }
+    $staticdefaults{'min'} = $Apache::lonnet::passwdmin;
+    foreach my $rule (@rules) {
+        $env{'form.'.$prefix.'_'.$rule} =~ s/^\s+|\s+$//g;
+        my $ruleok;
+        if ($rule eq 'min') {
+            if ($env{'form.'.$prefix.'_'.$rule} =~ /^\d+$/) {
+                if ($env{'form.'.$prefix.'_'.$rule} >= $staticdefaults{$rule}) {
+                    $ruleok = 1;
+                }
+            }
+        } elsif (($env{'form.'.$prefix.'_'.$rule} =~ /^\d+$/) &&
+                 ($env{'form.'.$prefix.'_'.$rule} ne '0')) {
+            $ruleok = 1;
+        }
+        if ($ruleok) {
+            $newvalues->{$rule} = $env{'form.'.$prefix.'_'.$rule};
+            if (exists($current->{$rule})) {
+                if ($newvalues->{$rule} ne $current->{$rule}) {
+                    $changes->{'rules'} = 1;
+                }
+            } elsif ($rule eq 'min') {
+                if ($staticdefaults{$rule} ne $newvalues->{$rule}) {
+                    $changes->{'rules'} = 1;
+                }
+            } else {
+                $changes->{'rules'} = 1;
+            }
+        } elsif (exists($current->{$rule})) {
+            $changes->{'rules'} = 1;
+        }
+    }
+    my @posschars = &Apache::loncommon::get_env_multiple('form.'.$prefix.'_chars');
+    my @chars;
+    foreach my $item (sort(@posschars)) {
+        if ($item =~ /^(uc|lc|num|spec)$/) {
+            push(@chars,$item);
+        }
+    }
+    $newvalues->{'chars'} = \@chars;
+    unless ($changes->{'rules'}) {
+        if (ref($current->{'chars'}) eq 'ARRAY') {
+            my @diffs = &Apache::loncommon::compare_arrays($current->{'chars'},\@chars);
+            if (@diffs > 0) {
+                $changes->{'rules'} = 1;
+            }
+        } else {
+            if (@chars > 0) {
+                $changes->{'rules'} = 1;
+            }
+        }
+    }
+    return;
+}
+
 sub modify_usercreation {
     my ($dom,%domconfig) = @_;
     my ($resulttext,%curr_usercreation,%changes,%authallowed,%cancreate,%save_usercreate);
@@ -16747,8 +17419,9 @@ sub modify_coursedefaults {
                            'uselcmath'       => 'on',
                            'usejsme'         => 'on',
                            'inline_chem'     => 'on',
+                           'ltiauth'         => 'off',
                          );
-    my @toggles = ('uselcmath','usejsme','inline_chem');
+    my @toggles = ('uselcmath','usejsme','inline_chem','ltiauth');
     my @numbers = ('anonsurvey_threshold','uploadquota_official','uploadquota_unofficial',
                    'uploadquota_community','uploadquota_textbook','mysqltables_official',
                    'mysqltables_unofficial','mysqltables_community','mysqltables_textbook');
@@ -16958,8 +17631,8 @@ sub modify_coursedefaults {
             if (($changes{'uploadquota'}) || ($changes{'postsubmit'}) ||
                 ($changes{'coursecredits'}) || ($changes{'uselcmath'}) || ($changes{'usejsme'}) ||
                 ($changes{'canclone'}) || ($changes{'mysqltables'}) || ($changes{'texengine'}) ||
-                ($changes{'inline_chem'})) {
-                foreach my $item ('uselcmath','usejsme','inline_chem','texengine') {
+                ($changes{'inline_chem'}) || ($changes{'ltiauth'})) {
+                foreach my $item ('uselcmath','usejsme','inline_chem','texengine','ltiauth') {
                     if ($changes{$item}) {
                         $domdefaults{$item}=$defaultshash{'coursedefaults'}{$item};
                     }
@@ -17124,6 +17797,12 @@ sub modify_coursedefaults {
                     } else {
                         $resulttext .= '<li>'.&mt('By default, only course owner and coordinators may clone a course.').'</li>';
                     }
+                } elsif ($item eq 'ltiauth') {
+                    if ($env{'form.'.$item} eq '1') {
+                        $resulttext .= '<li>'.&mt('LTI launch of deep-linked URL need not require re-authentication').'</li>';
+                    } else {
+                        $resulttext .= '<li>'.&mt('LTI launch of deep-linked URL will require re-authentication').'</li>';
+                    }
                 }
             }
             $resulttext .= '</ul>';