--- loncom/interface/domainprefs.pm	2017/01/28 23:26:46	1.292
+++ loncom/interface/domainprefs.pm	2017/02/25 20:30:52	1.293
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.292 2017/01/28 23:26:46 raeburn Exp $
+# $Id: domainprefs.pm,v 1.293 2017/02/25 20:30:52 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -499,6 +499,8 @@ sub handler {
                               col2 => 'Certificate Status'},
                              {col1 => 'Connections to other servers',
                               col2 => 'Rules'},
+                             {col1 => 'Connections from other servers',
+                              col2 => 'Rules'},
                              {col1 => "Replicating domain's published content",
                               col2 => 'Rules'}],
                   print => \&print_ssl,
@@ -806,7 +808,7 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') ||
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') || 
-            ($action eq 'ssl') || ($action eq 'trust') || ($action eq 'contacts')) {
+            ($action eq 'trust') || ($action eq 'contacts')) {
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
@@ -866,6 +868,28 @@ sub print_config_box {
                  ($action eq 'defaults') || ($action eq 'directorysrch') ||
                  ($action eq 'helpsettings')) {
             $output .= $item->{'print'}->('bottom',$dom,$settings,\$rowtotal);
+        } elsif ($action eq 'ssl') {
+            $output .= $item->{'print'}->('connto',$dom,$settings,\$rowtotal).'
+            </table>
+          </td>
+         </tr>
+         <tr>
+           <td>
+            <table class="LC_nested">
+             <tr class="LC_info_row">
+              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[2]->{'col1'}).'</td>
+              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[2]->{'col2'}).'</td></tr>'.
+                           $item->{'print'}->('connfrom',$dom,$settings,\$rowtotal).'
+            </table>
+          </td>
+         </tr>
+         <tr>
+           <td>
+            <table class="LC_nested">
+             <tr class="LC_info_row">
+              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
+              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td></tr>'.
+                           $item->{'print'}->('bottom',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'login') {
             if ($numheaders == 4) {
                 $output .= &print_login('page',$dom,$confname,$phase,$settings,\$rowtotal).'
@@ -3468,7 +3492,7 @@ function helpdeskAccess(num) {
                 shown = Array('notinc');
                 hidden = Array('notexc','bystatus');
             }
-            if ((curraccess == 'all') || (curraccess == 'dh') || (curraccess == 'da'))  {
+            if ((curraccess == 'all') || (curraccess == 'dh') || (curraccess == 'da')) {
                 hidden = Array('notinc','notexc','bystatus');
             }
         }
@@ -4657,7 +4681,32 @@ sub print_ssl {
         my @domservers = &Apache::lonnet::get_servers($dom);
         my %servers = &Apache::lonnet::internet_dom_servers($dom);
         my %altids = &id_for_thisdom(%servers);
-        if ($position eq 'middle') {
+        if (($position eq 'connto') || ($position eq 'connfrom')) {
+            my $legacy;
+            unless (ref($settings) eq 'HASH') {
+                my $name;
+                if ($position eq 'connto') {
+                    $name = 'loncAllowInsecure';
+                } else {
+                    $name = 'londAllowInsecure';
+                }
+                my $primarylibserv = &Apache::lonnet::domain($dom,'primary');
+                my @ids=&Apache::lonnet::current_machine_ids();
+                if (($primarylibserv ne '') && (!grep(/^\Q$primarylibserv\E$/,@ids))) {
+                    my %what = (
+                                   $name => 1,
+                               );
+                    my ($result,$returnhash) =
+                        &Apache::lonnet::get_remote_globals($primarylibserv,\%what);
+                    if ($result eq 'ok') {
+                        if (ref($returnhash) eq 'HASH') {
+                            $legacy = $returnhash->{$name};
+                        }
+                    }
+                } else {
+                    $legacy = $Apache::lonnet::perlvar{$name};
+                }
+            }
             foreach my $type ('dom','intdom','other') {
                 my %checked;
                 $css_class = $itemcount%2?' class="LC_odd_row"':'';
@@ -4684,16 +4733,21 @@ sub print_ssl {
                 unless ($skip) {
                     $checked{'yes'} = ' checked="checked"'; 
                     if (ref($settings) eq 'HASH') {
-                        if (ref($settings->{'connect'}) eq 'HASH') {
-                            if ($settings->{'connect'}->{$type} =~ /^(no|req)$/) {
+                        if (ref($settings->{$position}) eq 'HASH') {
+                            if ($settings->{$position}->{$type} =~ /^(no|req)$/) {
                                 $checked{$1} = $checked{'yes'};
                                 delete($checked{'yes'}); 
                             }
                         }
+                    } else {
+                        if ($legacy == 0) {
+                            $checked{'req'} = $checked{'yes'};
+                            delete($checked{'yes'});    
+                        }
                     }
                     foreach my $option ('no','yes','req') {
                         $datatable .= '<span class="LC_nobreak"><label>'.
-                                      '<input type="radio" name="connect_'.$type.'" '.
+                                      '<input type="radio" name="'.$position.'_'.$type.'" '.
                                       'value="'.$option.'"'.$checked{$option}.' />'.$titles{$option}.
                                       '</label></span>'.('&nbsp;'x2);
                     }
@@ -4724,7 +4778,8 @@ sub ssl_titles {
                dom           => 'LON-CAPA servers/VMs from same domain',
                intdom        => 'LON-CAPA servers/VMs from same "internet" domain',
                other         => 'External LON-CAPA servers/VMs',
-               connect       => 'Connections to other servers',
+               connto        => 'Connections to other servers',
+               connfrom      => 'Connections from other servers',
                replication   => 'Replicating content to other institutions',
                certreq       => 'Client certificate required, but specific domains exempt',
                nocertreq     => 'No client certificate required, except for specific domains',
@@ -13694,7 +13749,7 @@ sub modify_ssl {
     my %servers = &Apache::lonnet::internet_dom_servers($dom);
     my (%defaultshash,%changes);
     my $action = 'ssl';
-    my @prefixes = ('connect','replication');
+    my @prefixes = ('connto','connfrom','replication');
     foreach my $prefix (@prefixes) {
         $defaultshash{$action}{$prefix} = {};
     }
@@ -13704,12 +13759,13 @@ sub modify_ssl {
     my @reptypes = ('certreq','nocertreq');
     my @connecttypes = ('dom','intdom','other');
     my %types = (
-                  connect      => \@connecttypes,
-                  replication  => \@reptypes,
+                  connto      => \@connecttypes,
+                  connfrom    => \@connecttypes,
+                  replication => \@reptypes,
                 );
     foreach my $prefix (sort(keys(%types))) {
         foreach my $type (@{$types{$prefix}}) {
-            if ($prefix eq 'connect') {
+            if (($prefix eq 'connto') || ($prefix eq 'connfrom')) {
                 my $value = 'yes';
                 if ($env{'form.'.$prefix.'_'.$type} =~ /^(no|req)$/) {
                     $value = $env{'form.'.$prefix.'_'.$type};
@@ -13798,8 +13854,11 @@ sub modify_ssl {
                 if (ref($defaultshash{$action}{'replication'}) eq 'HASH') {
                     $domdefaults{'replication'} = $defaultshash{$action}{'replication'};
                 }
-                if (ref($defaultshash{$action}{'connect'}) eq 'HASH') {
-                    $domdefaults{'connect'} = $domconfig{$action}{'connect'};
+                if (ref($defaultshash{$action}{'connto'}) eq 'HASH') {
+                    $domdefaults{'connto'} = $domconfig{$action}{'connto'};
+                }
+                if (ref($defaultshash{$action}{'connfrom'}) eq 'HASH') {
+                    $domdefaults{'connfrom'} = $domconfig{$action}{'connfrom'};
                 }
             }
             my $cachetime = 24*60*60;
@@ -13818,7 +13877,7 @@ sub modify_ssl {
                                 my $newvalue;
                                 if (ref($defaultshash{$action}) eq 'HASH') {
                                     if (ref($defaultshash{$action}{$prefix})) {
-                                        if ($prefix eq 'connect') {
+                                        if (($prefix eq 'connto') || ($prefix eq 'connfrom')) {
                                             $newvalue = $titles{$defaultshash{$action}{$prefix}{$type}};
                                         } elsif (ref($defaultshash{$action}{$prefix}{$type}) eq 'ARRAY') {
                                             if (@{$defaultshash{$action}{$prefix}{$type}} > 0) {