--- loncom/interface/domainprefs.pm	2019/04/22 01:55:17	1.354
+++ loncom/interface/domainprefs.pm	2019/07/23 01:30:35	1.364
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.354 2019/04/22 01:55:17 raeburn Exp $
+# $Id: domainprefs.pm,v 1.364 2019/07/23 01:30:35 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -219,7 +219,7 @@ sub handler {
                 'serverstatuses','requestcourses','helpsettings',
                 'coursedefaults','usersessions','loadbalancing',
                 'requestauthor','selfenrollment','inststatus',
-                'ltitools','ssl','trust','lti','passwords'],$dom);
+                'ltitools','ssl','trust','lti','privacy','passwords'],$dom);
     my %encconfig =
         &Apache::lonnet::get_dom('encconfig',['ltitools','lti'],$dom);
     if (ref($domconfig{'ltitools'}) eq 'HASH') {
@@ -247,7 +247,7 @@ sub handler {
         }
     }
     my @prefs_order = ('rolecolors','login','defaults','passwords','quotas','autoenroll',
-                       'autoupdate','autocreate','directorysrch','contacts',
+                       'autoupdate','autocreate','directorysrch','contacts','privacy',
                        'usercreation','selfcreation','usermodification','scantron',
                        'requestcourses','requestauthor','coursecategories',
                        'serverstatuses','helpsettings','coursedefaults',
@@ -497,10 +497,16 @@ sub handler {
                   modify => \&modify_selfenrollment,
                  },
         'privacy' => 
-                 {text   => 'User Privacy',
+                 {text   => 'Availability of User Information',
                   help   => 'Domain_Configuration_User_Privacy',
-                  header => [{col1 => 'Setting',
-                              col2 => 'Value',}],
+                  header => [{col1 => 'Role assigned in different domain',
+                              col2 => 'Approval options'},
+                             {col1 => 'Role assigned in different domain to user of type',
+                              col2 => 'User information available in that domain'},
+                             {col1 => "Role assigned in user's domain",
+                              col2 => 'Information viewable by privileged user'},
+                             {col1 => "Role assigned in user's domain",
+                              col2 => 'Information viewable by unprivileged user'}],
                   print => \&print_privacy,
                   modify => \&modify_privacy,
                  },
@@ -771,6 +777,8 @@ sub process_changes {
         $output = &modify_trust($dom,$lastactref,%domconfig);
     } elsif ($action eq 'lti') {
         $output = &modify_lti($r,$dom,$action,$lastactref,%domconfig);
+    } elsif ($action eq 'privacy') {
+        $output = &modify_privacy($dom,%domconfig);
     } elsif ($action eq 'passwords') {
         $output = &modify_passwords($r,$dom,$confname,$lastactref,%domconfig);
     }
@@ -844,7 +852,7 @@ sub print_config_box {
             ($action eq 'usermodification') || ($action eq 'defaults') || ($action eq 'coursedefaults') ||
             ($action eq 'selfenrollment') || ($action eq 'usersessions') || ($action eq 'ssl') ||
             ($action eq 'directorysrch') || ($action eq 'trust') || ($action eq 'helpsettings') ||
-            ($action eq 'contacts')) {
+            ($action eq 'contacts') || ($action eq 'privacy')) {
             $output .= $item->{'print'}->('top',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'passwords') {
             $output .= $item->{'print'}->('top',$dom,$confname,$settings,\$rowtotal);
@@ -879,7 +887,8 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') ||
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') || 
-            ($action eq 'trust') || ($action eq 'contacts') || ($action eq 'passwords')) {
+            ($action eq 'trust') || ($action eq 'contacts') ||
+            ($action eq 'privacy') || ($action eq 'passwords')) {
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
@@ -932,7 +941,7 @@ sub print_config_box {
              </tr>'."\n";
                 if ($action eq 'coursecategories') {
                     $output .= &print_coursecategories('bottom',$dom,$item,$settings,\$rowtotal);
-                } elsif (($action eq 'contacts') || ($action eq 'passwords')) {
+                } elsif (($action eq 'contacts') || ($action eq 'privacy') || ($action eq 'passwords')) {
                     if ($action eq 'passwords') {
                         $output .= $item->{'print'}->('lower',$dom,$confname,$settings,\$rowtotal);
                     } else {
@@ -2896,7 +2905,7 @@ function toggleLTI(form,setting,item) {
                 }
             }
         }
-    } else if ((setting == 'user') || (setting == 'crs') || (setting == 'passback')) {
+    } else if ((setting == 'user') || (setting == 'crs') || (setting == 'passback') || (setting == 'callback')) {
         var radioname = '';
         var divid = '';
         if (setting == 'user') {
@@ -2905,6 +2914,9 @@ function toggleLTI(form,setting,item) {
         } else if (setting == 'crs') {
             radioname = 'lti_mapcrs_'+item;
             divid = 'lti_crsfield_'+item;
+        } else if (setting == 'callback') {
+            radioname = 'lti_callback_'+item;
+            divid = 'lti_callbackfield_'+item;
         } else {
             radioname = 'lti_passback_'+item;
             divid =  'lti_passback_'+item;
@@ -2914,7 +2926,7 @@ function toggleLTI(form,setting,item) {
             var setvis = '';
             for (var i=0; i<num; i++) {
                if (form.elements[radioname][i].checked) {
-                   if (setting == 'passback') {
+                   if ((setting == 'passback') || (setting == 'callback')) {
                        if (form.elements[radioname][i].value == '1') {
                            if (document.getElementById(divid)) {
                                document.getElementById(divid).style.display = 'inline-block';
@@ -4948,7 +4960,7 @@ sub lti_names {
 
 sub lti_options {
     my ($num,$current,$itemcount,%lt) = @_;
-    my (%checked,%rolemaps,$crssecsrc,$userfield,$cidfield);
+    my (%checked,%rolemaps,$crssecsrc,$userfield,$cidfield,$callback);
     $checked{'mapuser'}{'sourcedid'} = ' checked="checked"';
     $checked{'mapcrs'}{'course_offering_sourcedid'} = ' checked="checked"';
     $checked{'makecrs'}{'N'} = '  checked="checked"';
@@ -4966,6 +4978,7 @@ sub lti_options {
     my $crsfieldsty = 'none';
     my $crssecfieldsty = 'none';
     my $secsrcfieldsty = 'none';
+    my $callbacksty = 'none';
     my $passbacksty = 'none';
     my $optionsty = 'block';
     my $lcauthparm;
@@ -5045,6 +5058,13 @@ sub lti_options {
         } else {
             $checked{'crssec'}{'N'} = ' checked="checked"';
         }
+        if ($current->{'callback'} ne '') {
+            $callback = $current->{'callback'};
+            $checked{'callback'}{'Y'} = ' checked="checked"';
+            $callbacksty = 'inline-block';
+        } else {
+            $checked{'callback'}{'N'} = ' checked="checked"';
+        }
         if ($current->{'topmenu'}) {
             $checked{'topmenu'}{'Y'} = ' checked="checked"';
         } else {
@@ -5070,6 +5090,7 @@ sub lti_options {
     } else {
         $checked{'makecrs'}{'N'} = ' checked="checked"';
         $checked{'crssec'}{'N'} = ' checked="checked"';
+        $checked{'callback'}{'N'} = ' checked="checked"';
         $checked{'topmenu'}{'N'} = ' checked="checked"';
         $checked{'inlinemenu'}{'Y'} = ' checked="checked"'; 
         $checked{'menuitem'}{'grades'} = ' checked="checked"';
@@ -5098,6 +5119,7 @@ sub lti_options {
     my $onclickuser = ' onclick="toggleLTI(this.form,'."'user','$num'".');"';
     my $onclickcrs = ' onclick="toggleLTI(this.form,'."'crs','$num'".');"';
     my $onclicksec = ' onclick="toggleLTI(this.form,'."'sec','$num'".');"';
+    my $onclickcallback = ' onclick="toggleLTI(this.form,'."'callback','$num'".');"';
     my $onclicksecsrc = ' onclick="toggleLTI(this.form,'."'secsrc','$num'".')"';
     my $onclicklcauth = ' onclick="toggleLTI(this.form,'."'lcauth','$num'".')"';
     my $onclickmenu = ' onclick="toggleLTI(this.form,'."'lcmenu','$num'".');"';
@@ -5247,7 +5269,17 @@ sub lti_options {
                '<label><input type="radio" name="lti_passbackformat_'.$num.'" value="1.1"'.$pb1p1chk.' />'.
                &mt('Outcomes Service (1.1)').'</label>'.('&nbsp;'x2).
                '<label><input type="radio" name="lti_passbackformat_'.$num.'" value="1.0"'.$pb1p0chk.'/>'.
-               &mt('Outcomes Extension (1.0)').'</label></span></div></fieldset>'.
+               &mt('Outcomes Extension (1.0)').'</label></span></div>'.
+               '<div style="padding:0;clear:both;margin:0;border:0"></div>'.
+               '<div class="LC_floatleft"><span class="LC_nobreak">'.&mt('Callback on logout').':&nbsp;'.
+               '<label><input type="radio" name="lti_callback_'.$num.'" value="0"'.
+               $checked{'callback'}{'N'}.$onclickcallback.' />'.&mt('No').'</label>'.('&nbsp;'x2).
+               '<label><input type="radio" name="lti_callback_'.$num.'" value="1"'.
+               $checked{'callback'}{'Y'}.$onclickcallback.' />'.&mt('Yes').'</label></span></div>'.
+               '<div class="LC_floatleft" style="display:'.$callbacksty.';" id="lti_callbackfield_'.$num.'">'.
+               '<span class="LC_nobreak">'.&mt('Parameter').': '.
+               '<input type="text" name="lti_callbackparam_'.$num.'" value="'.$callback.'" /></span>'.
+               '</div><div style="padding:0;clear:both;margin:0;border:0"></div></fieldset>'.
                '<fieldset class="ltioption_'.$num.'" style="display:'.$optionsty.'"><legend>'.&mt('Course defaults (Course Coordinator can override)').'</legend>'.
                '<div class="LC_floatleft"><span class="LC_nobreak">'.$lt{'topmenu'}.':&nbsp;'.
                '<label><input type="radio" name="lti_topmenu_'.$num.'" value="0"'.
@@ -5800,6 +5832,143 @@ sub print_validation_rows {
     return $datatable;
 }
 
+sub print_privacy {
+    my ($position,$dom,$settings,$rowtotal) = @_;
+    my ($datatable,$css_class,$numinrow,@items,%names,$othertitle,$usertypes,$types);
+    my $itemcount = 0;
+    unless ($position eq 'top') {
+        @items = ('domain','author','course','community');
+        %names = &Apache::lonlocal::texthash (
+                     domain => 'Assigned domain role(s)',
+                     author => 'Assigned co-author role(s)',
+                     course => 'Assigned course role(s)',
+                     community => 'Assigned community role',
+                 );
+        $numinrow = 4;
+        ($othertitle,$usertypes,$types) =
+            &Apache::loncommon::sorted_inst_types($dom);
+    }
+    if (($position eq 'top') || ($position eq 'middle')) {
+        my (%by_ip,%by_location,@intdoms,@instdoms);
+        &build_location_hashes(\@intdoms,\%by_ip,\%by_location,\@instdoms);
+        if ($position eq 'top') {
+            my %curr;
+            my @options = ('none','user','domain','auto');
+            my %titles = &Apache::lonlocal::texthash (
+                none   => 'Not allowed',
+                user   => 'User authorizes',
+                domain => 'DC authorizes',
+                auto   => 'Unrestricted',
+                instdom => 'Other domain shares institution/provider',
+                extdom => 'Other domain has different institution/provider',
+            );
+            my %names = &Apache::lonlocal::texthash (
+                domain => 'Domain role',
+                author => 'Co-author role',
+                course => 'Course role',
+                community => 'Community role',
+            );
+            my $primary_id = &Apache::lonnet::domain($dom,'primary');
+            my $intdom = &Apache::lonnet::internet_dom($primary_id);
+            foreach my $domtype ('instdom','extdom') {
+                my (%checked,$skip);
+                $css_class = $itemcount%2?' class="LC_odd_row"':'';
+                $datatable .= '<tr'.$css_class.'><td>'.$titles{$domtype}.'</td>'.
+                              '<td class="LC_left_item">';
+                if ($domtype eq 'instdom') {
+                    unless (@instdoms > 1) {
+                        $datatable .= &mt('Nothing to set, as no domains besides [_1] are hosted by [_2]',$dom,$intdom);
+                        $skip = 1;
+                    }
+                } elsif ($domtype eq 'extdom') {
+                    if (keys(%by_location) == 0) {
+                        $datatable .= &mt('Nothing to set, as no other hosts besides [_1]',$intdom);
+                        $skip = 1;
+                    }
+                }
+                unless ($skip) {
+                    foreach my $roletype ('domain','author','course','community') {
+                        $checked{'auto'} = ' checked="checked"';
+                        if (ref($settings) eq 'HASH') {
+                            if (ref($settings->{approval}) eq 'HASH') {
+                                if (ref($settings->{approval}->{$domtype}) eq 'HASH') {
+                                    if ($settings->{approval}->{$domtype}->{$roletype}=~ /^(none|user|domain)$/) {
+                                        $checked{$1} = ' checked="checked"';
+                                        $checked{'auto'} = '';
+                                    }
+                                }
+                            }
+                        }
+                        $datatable .= '<fieldset><legend>'.$names{$roletype}.'</legend>';
+                        foreach my $option (@options) {
+                            $datatable .= '<span class="LC_nobreak"><label>'.
+                                          '<input type="radio" name="privacy_approval_'.$domtype.'_'.$roletype.'" '.
+                                          'value="'.$option.'"'.$checked{$option}.' />'.$titles{$option}.
+                                          '</label></span>&nbsp; ';
+                        }
+                        $datatable .= '</fieldset>';
+                    }
+                }
+                $datatable .= '</td></tr>';
+                $itemcount ++;
+            }
+        } elsif ($position eq 'middle') {
+            if ((@instdoms > 1) || (keys(%by_location) > 0)) {
+                if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                    foreach my $item (@{$types}) {
+                        $datatable .= &modifiable_userdata_row('privacy','othdom_'.$item,$settings,
+                                                               $numinrow,$itemcount,'','','','','',
+                                                               '',$usertypes->{$item});
+                        $itemcount ++;
+                    }
+                }
+                $datatable .= &modifiable_userdata_row('privacy','othdom_default',$settings,
+                                                       $numinrow,$itemcount,'','','','','',
+                                                       '',$othertitle);
+                $itemcount ++;
+            } else {
+                my (@insttypes,%insttitles);
+                if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                    @insttypes = @{$types};
+                    %insttitles = %{$usertypes};
+                }
+                foreach my $item (@insttypes,'default') {
+                    my $title;
+                    if ($item eq 'default') {
+                        $title = $othertitle;
+                    } else {
+                        $title = $insttitles{$item};
+                    }
+                    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+                    $datatable .= '<tr'.$css_class.'>'.
+                                  '<td class="LC_left_item">'.$title.'</td>'.
+                                  '<td class="LC_left_item">'.
+                                  &mt('Nothing to set here, as there are no other domains').
+                                  '</td></tr>';
+                    $itemcount ++;
+                }
+            }
+        }
+    } else {
+        my $prefix;
+        if ($position eq 'lower') {
+            $prefix = 'priv';
+        } else {
+            $prefix = 'unpriv';
+        }
+        foreach my $item (@items) {
+            $datatable .= &modifiable_userdata_row('privacy',$prefix.'_'.$item,$settings,
+                                                   $numinrow,$itemcount,'','','','','',
+                                                   '',$names{$item});
+            $itemcount ++;
+        }
+    }
+    if (ref($rowtotal)) {
+        $$rowtotal += $itemcount;
+    }
+    return $datatable;
+}
+
 sub print_passwords {
     my ($position,$dom,$confname,$settings,$rowtotal) = @_;
     my ($datatable,$css_class);
@@ -5822,6 +5991,7 @@ sub print_passwords {
         max            => 'Maximum password length',
         chars          => 'Required characters',
         expire         => 'Password expiration (days)',
+        numsaved       => 'Number of previous passwords to save and disallow reuse',
     );
     if ($position eq 'top') {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
@@ -6085,7 +6255,7 @@ sub print_passwords {
             $itemcount ++;
         }
     } elsif ($position eq 'lower') {
-        my ($min,$max,%chars,$expire);
+        my ($min,$max,%chars,$expire,$numsaved);
         if (ref($settings) eq 'HASH') {
             if ($settings->{min}) {
                 $min = $settings->{min};
@@ -6099,6 +6269,9 @@ sub print_passwords {
             if ($settings->{expire}) {
                 $expire = $settings->{expire};
             }
+            if ($settings->{numsaved}) {
+                $numsaved = $settings->{numsaved};
+            }
         } else {
             $min = '7';
         }
@@ -6161,30 +6334,68 @@ sub print_passwords {
                       '<input type="text" name="passwords_expire" value="'.$expire.'" size="4" />'.
                       '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no expiration)').'</span>'.
                       '</span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
+                      '</span></td></tr>';
     } else {
-        my $checkedon;
-        my $checkedoff = ' checked="checked"';
+        my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
+        my %ownerchg = (
+                          by  => {},
+                          for => {},
+                       );
+        my %ownertitles = &Apache::lonlocal::texthash (
+                            by  => 'Course owner status(es) allowed',
+                            for => 'Student status(es) allowed',
+                          );
         if (ref($settings) eq 'HASH') {
-            if ($settings->{crsownerchg}) {
-                $checkedon = $checkedoff;
-                $checkedoff = '';
+            if (ref($settings->{crsownerchg}) eq 'HASH') {
+                if (ref($settings->{crsownerchg}{'by'}) eq 'ARRAY') {
+                    map { $ownerchg{by}{$_} = 1; } (@{$settings->{crsownerchg}{'by'}});
+                }
+                if (ref($settings->{crsownerchg}{'for'}) eq 'ARRAY') {
+                    map { $ownerchg{for}{$_} = 1; } (@{$settings->{crsownerchg}{'for'}});
+                }
             }
         }
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr '.$css_class.'>'.
                       '<td>'.
                       &mt('Requirements').'<ul>'.
-                      '<li>'.&mt("Course 'type' is not a Community").'</li>'.
+                      '<li>'.&mt("Course 'type' is not a Community or Placement Test").'</li>'.
                       '<li>'.&mt('User is Course Coordinator and also course owner').'</li>'.
                       '<li>'.&mt("Student's only active roles are student role(s) in course(s) owned by this user").'</li>'.
+                      '<li>'.&mt('User, course, and student share same domain').'</li>'.
                       '</ul>'.
                       '</td>'.
-                      '<td class="LC_left_item" colspan="2"><span class="LC_nobreak">'.
-                      '<label><input type="radio" name="passwords_crsowner" value="1"'.$checkedon.' />'.&mt('Yes').'</label></span> &nbsp;&nbsp;'.
-                      '<span class="LC_nobreak"><label><input type="radio" name="passwords_crsowner" value="0"'.$checkedoff.' />'.
-                      &mt('No').'</label></span>'.
-                      '</td></tr>';
-
+                      '<td class="LC_left_item">';
+        foreach my $item ('by','for') {
+            $datatable .= '<fieldset style="display: inline-block;">'.
+                          '<legend>'.$ownertitles{$item}.'</legend>';
+            if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                foreach my $type (@{$types}) {
+                    my $checked;
+                    if ($ownerchg{$item}{$type}) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<span class="LC_nobreak"><label>'.
+                                  '<input type="checkbox" name="passwords_crsowner_'.$item.'" value="'.
+                                  $type.'"'.$checked.' />'.$usertypes->{$type}.'</label>'.
+                                  '<span>&nbsp;&nbsp; ';
+                }
+            }
+            my $checked;
+            if ($ownerchg{$item}{'default'}) {
+                $checked = ' checked="checked"';
+            }
+            $datatable .= '<span class="LC_nobreak"><label><input type="checkbox" '.
+                          'name="passwords_crsowner_'.$item.'" value="default"'.$checked.' />'.
+                          $othertitle.'</label></span></fieldset>';
+        }
+        $datatable .= '</td></tr>';
     }
     return $datatable;
 }
@@ -9355,7 +9566,7 @@ sub build_category_rows {
 
 sub modifiable_userdata_row {
     my ($context,$item,$settings,$numinrow,$rowcount,$usertypes,$fieldsref,$titlesref,
-        $rowid,$customcss,$rowstyle) = @_;
+        $rowid,$customcss,$rowstyle,$itemdesc) = @_;
     my ($role,$rolename,$statustype);
     $role = $item;
     if ($context eq 'cancreate') {
@@ -9378,6 +9589,8 @@ sub modifiable_userdata_row {
         }
     } elsif ($context eq 'lti') {
         $rolename = &mt('Institutional data used (if available)');
+    } elsif ($context eq 'privacy') {
+        $rolename = $itemdesc;
     } else {
         if ($role eq 'cr') {
             $rolename = &mt('Custom role');
@@ -9427,6 +9640,13 @@ sub modifiable_userdata_row {
             if (ref($settings) eq 'HASH') {
                 $hashref = $settings->{'instdata'};
             }
+        } elsif ($context eq 'privacy') {
+            my ($key,$inner) = split(/_/,$role);
+            if (ref($settings) eq 'HASH') {
+                if (ref($settings->{$key}) eq 'HASH') {
+                    $hashref = $settings->{$key}->{$inner};
+                }
+            }
         } elsif (ref($settings->{$context}) eq 'HASH') {
             if (ref($settings->{$context}->{$role}) eq 'HASH') {
                 $hashref = $settings->{'lti_instdata'};
@@ -9465,6 +9685,24 @@ sub modifiable_userdata_row {
         unless ($role eq 'emailusername') {
             if (exists($checks{$fields[$i]})) {
                 $check = $checks{$fields[$i]};
+            } elsif ($context eq 'privacy') {
+                if ($role =~ /^priv_(domain|course)$/) {
+                    if (ref($settings) ne 'HASH') {
+                        $check = ' checked="checked" ';
+                    }
+                } elsif ($role =~ /^priv_(author|community)$/) {
+                    if (ref($settings) ne 'HASH') {
+                        unless ($fields[$i] eq 'id') {
+                            $check = ' checked="checked" ';
+                        }
+                    }
+                } elsif ($role =~ /^(unpriv|othdom)_/) {
+                    if (ref($settings) ne 'HASH') {
+                        if (($fields[$i] eq 'lastname') || ($fields[$i] eq 'firstname')) {
+                            $check = ' checked="checked" ';
+                        }
+                    }
+                }
             } elsif ($context ne 'lti') {
                 if ($role eq 'st') {
                     if (ref($settings) ne 'HASH') {
@@ -9493,6 +9731,8 @@ sub modifiable_userdata_row {
         } else {
             if ($context eq 'lti') {
                 $prefix = 'lti';
+            } elsif ($context eq 'privacy') {
+                $prefix = 'privacy';
             }
             $output .= '<label>'.
                        '<input type="checkbox" name="'.$prefix.'_'.$role.'" '.
@@ -10580,7 +10820,7 @@ sub check_configuser {
     my ($configuserok,%currroles);
     if ($uhome eq 'no_host') {
         srand( time() ^ ($$ + ($$ << 15))  ); # Seed rand.
-        my $configpass = &LONCAPA::Enrollment::create_password();
+        my $configpass = &LONCAPA::Enrollment::create_password($dom);
         $configuserok = 
             &Apache::lonnet::modifyuser($dom,$confname,'','internal',
                              $configpass,'','','','','',undef,$servadm);
@@ -12458,6 +12698,13 @@ sub modify_lti {
                     }
                 }
             }
+            if ($env{'form.lti_callback_'.$idx}) {
+                if ($env{'form.lti_callbackparam_'.$idx}) {
+                    my $callback = $env{'form.lti_callbackparam_'.$idx};
+                    $callback =~ s/^\s+|\s+$//g;
+                    $confhash{$itemid}{'callback'} = $callback;
+                }
+            }
             foreach my $field ('passback','roster','topmenu','inlinemenu') {
                 if ($env{'form.lti_'.$field.'_'.$idx}) {
                     $confhash{$itemid}{$field} = 1;
@@ -12483,7 +12730,7 @@ sub modify_lti {
                 }
             }
             unless (($idx eq 'add') || ($changes{$itemid})) {
-                foreach my $field ('mapuser','mapcrs','makecrs','section','passback','roster','lcauth','lcauthparm','topmenu','inlinemenu') {
+                foreach my $field ('mapuser','mapcrs','makecrs','section','passback','roster','lcauth','lcauthparm','topmenu','inlinemenu','callback') {
                     if ($domconfig{$action}{$itemid}{$field} ne $confhash{$itemid}{$field}) {
                         $changes{$itemid} = 1;
                     }
@@ -12709,6 +12956,11 @@ sub modify_lti {
                         } else {
                             $resulttext .= '<li>'.&mt('No section assignment').'</li>';
                         }
+                        if ($confhash{$itemid}{'callback'}) {
+                            $resulttext .= '<li>'.&mt('Callback setting').': '.$confhash{$itemid}{'callback'}.'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('No callback to logout LON-CAPA session when user logs out of Comsumer');
+                        }
                         foreach my $item ('passback','roster','topmenu','inlinemenu') {
                             $resulttext .= '<li>'.$lt{$item}.':&nbsp;';
                             if ($confhash{$itemid}{$item}) {
@@ -13958,9 +14210,234 @@ sub modify_contacts {
     return $resulttext;
 }
 
+sub modify_privacy {
+    my ($dom,%domconfig) = @_;
+    my ($resulttext,%current,%changes);
+    if (ref($domconfig{'privacy'}) eq 'HASH') {
+        %current = %{$domconfig{'privacy'}};
+    }
+    my @fields = ('lastname','firstname','middlename','generation','permanentemail','id');
+    my @items = ('domain','author','course','community');
+    my %names = &Apache::lonlocal::texthash (
+                   domain => 'Assigned domain role(s)',
+                   author => 'Assigned co-author role(s)',
+                   course => 'Assigned course role(s)',
+                   community => 'Assigned community role',
+                );
+    my %roles = &Apache::lonlocal::texthash (
+                   domain => 'Domain role',
+                   author => 'Co-author role',
+                   course => 'Course role',
+                   community => 'Community role',
+                );
+    my %titles = &Apache::lonlocal::texthash (
+                  approval => 'Approval for role in different domain',
+                  othdom   => 'User information available in other domain',
+                  priv     => 'Information viewable by privileged user in same domain',
+                  unpriv   => 'Information viewable by unprivileged user in same domain',
+                  instdom  => 'Other domain shares institution/provider',
+                  extdom   => 'Other domain has different institution/provider',
+                  none     => 'Not allowed',
+                  user     => 'User authorizes',
+                  domain   => 'Domain Coordinator authorizes',
+                  auto     => 'Unrestricted',
+    );
+    my %fieldnames = &Apache::lonlocal::texthash (
+                        id => 'Student/Employee ID',
+                        permanentemail => 'E-mail address',
+                        lastname => 'Last Name',
+                        firstname => 'First Name',
+                        middlename => 'Middle Name',
+                        generation => 'Generation',
+    );
+    my ($othertitle,$usertypes,$types) =
+        &Apache::loncommon::sorted_inst_types($dom);
+    my (%by_ip,%by_location,@intdoms,@instdoms);
+    &build_location_hashes(\@intdoms,\%by_ip,\%by_location,\@instdoms);
+
+    my %privacyhash = (
+                       'approval' => {
+                                       instdom => {},
+                                       extdom  => {},
+                                     },
+                       'othdom'   => {},
+                       'priv'     => {},
+                       'unpriv'   => {},
+                      );
+    foreach my $item (@items) {
+        if (@instdoms > 1) {
+            if ($env{'form.privacy_approval_instdom'.$item} =~ /^(none|user|domain|auto)$/) {
+                $privacyhash{'approval'}{'instdom'}{$item} = $env{'form.privacy_approval_instdom_'.$item};
+            }
+            if (ref($current{'approval'}) eq 'HASH') {
+                if (ref($current{'approval'}{'instdom'}) eq 'HASH') {
+                    unless ($privacyhash{'approval'}{'instdom'}{$item} eq $current{'approval'}{'instdom'}{$item}) {
+                        $changes{'approval'} = 1;
+                    }
+                }
+            } elsif ($privacyhash{'approval'}{'instdom'}{$item} ne 'auto') {
+                $changes{'approval'} = 1;
+            }
+        }
+        if (keys(%by_location) > 0) {
+            if ($env{'form.privacy_approval_extdom_'.$item} =~ /^(none|user|domain|auto)$/) {
+                $privacyhash{'approval'}{'extdom'}{$item} = $env{'form.privacy_approval_extdom_'.$item};
+            }
+            if (ref($current{'approval'}) eq 'HASH') {
+                if (ref($current{'approval'}{'extdom'}) eq 'HASH') {
+                    unless ($privacyhash{'approval'}{'extdom'}{$item} eq $current{'approval'}{'extdom'}{$item}) {
+                        $changes{'approval'} = 1;
+                    }
+                }
+            } elsif ($privacyhash{'approval'}{'extdom'}{$item} ne 'auto') {
+                $changes{'approval'} = 1;
+            }
+        }
+        foreach my $status ('priv','unpriv') {
+            my @possibles = sort(&Apache::loncommon::get_env_multiple('form.privacy_'.$status.'_'.$item));
+            my @newvalues;
+            foreach my $field (@possibles) {
+                if (grep(/^\Q$field\E$/,@fields)) {
+                    $privacyhash{$status}{$item}{$field} = 1;
+                    push(@newvalues,$field);
+                }
+            }
+            @newvalues = sort(@newvalues);
+            if (ref($current{$status}) eq 'HASH') {
+                if (ref($current{$status}{$item}) eq 'HASH') {
+                    my @currvalues = sort(keys(%{$current{$status}{$item}}));
+                    my @diffs = &Apache::loncommon::compare_arrays(\@currvalues,\@newvalues);
+                    if (@diffs > 0) {
+                        $changes{$status} = 1;
+                    }
+                }
+            } else {
+                my @stdfields;
+                foreach my $field (@fields) {
+                    if ($field eq 'id') {
+                        next if ($status eq 'unpriv');
+                        next if (($status eq 'priv') && ($item eq 'community'));
+                    }
+                    push(@stdfields,$field);
+                }
+                my @diffs = &Apache::loncommon::compare_arrays(\@stdfields,\@newvalues);
+                if (@diffs > 0) {
+                    $changes{$status} = 1;
+                }
+            }
+        }
+    }
+    if ((@instdoms > 1) || (keys(%by_location) > 0)) {
+        my @statuses;
+        if (ref($types) eq 'ARRAY') {
+            @statuses = @{$types};
+        }
+        foreach my $type (@statuses,'default') {
+            my @possfields = &Apache::loncommon::get_env_multiple('form.privacy_othdom_'.$type);
+            my @newvalues;
+            foreach my $field (sort(@possfields)) {
+                if (grep(/^\Q$field\E$/,@fields)) {
+                    $privacyhash{'othdom'}{$type}{$field} = 1;
+                    push(@newvalues,$field);
+                }
+            }
+            @newvalues = sort(@newvalues);
+            if (ref($current{'othdom'}) eq 'HASH') {
+                if (ref($current{'othdom'}{$type}) eq 'HASH') {
+                    my @currvalues = sort(keys(%{$current{'othdom'}{$type}}));
+                    my @diffs = &Apache::loncommon::compare_arrays(\@currvalues,\@newvalues);
+                    if (@diffs > 0) {
+                        $changes{'othdom'} = 1;
+                    }
+                }
+            } else {
+                my @stdfields = ('lastname','firstname','middlename','generation','permanentemail');
+                my @diffs = &Apache::loncommon::compare_arrays(\@stdfields,\@newvalues);
+                if (@diffs > 0) {
+                    $changes{'othdom'} = 1;
+                }
+            }
+        }
+    }
+    my %confighash = (
+                        privacy => \%privacyhash,
+                     );
+    my $putresult = &Apache::lonnet::put_dom('configuration',\%confighash,$dom);
+    if ($putresult eq 'ok') {
+        if (keys(%changes) > 0) {
+            $resulttext = &mt('Changes made: ').'<ul>';
+            foreach my $key ('approval','othdom','priv','unpriv') {
+                if ($changes{$key}) {
+                    $resulttext .= '<li>'.$titles{$key}.':<ul>';
+                    if ($key eq 'approval') {
+                        if (keys(%{$privacyhash{$key}{instdom}})) {
+                            $resulttext .= '<li>'.$titles{'instdom'}.'<ul>';
+                            foreach my $item (@items) {
+                                $resulttext .=  '<li>'.$roles{$item}.': '.$titles{$privacyhash{$key}{instdom}{$item}}.'</li>';
+                            }
+                            $resulttext .= '</ul></li>';
+                        }
+                        if (keys(%{$privacyhash{$key}{extdom}})) {
+                            $resulttext .= '<li>'.$titles{'extdom'}.'<ul>';
+                            foreach my $item (@items) {
+                                $resulttext .=  '<li>'.$roles{$item}.': '.$titles{$privacyhash{$key}{extdom}{$item}}.'</li>';
+                            }
+                            $resulttext .= '</ul></li>';
+                        }
+                    } elsif ($key eq 'othdom') {
+                        my @statuses;
+                        if (ref($types) eq 'ARRAY') {
+                            @statuses = @{$types};
+                        }
+                        if (ref($privacyhash{$key}) eq 'HASH') {
+                            foreach my $status (@statuses,'default') {
+                                if ($status eq 'default') {
+                                    $resulttext .= '<li>'.$othertitle.': ';
+                                } elsif (ref($usertypes) eq 'HASH') {
+                                    $resulttext .= '<li>'.$usertypes->{$status}.': ';
+                                } else {
+                                    next;
+                                }
+                                if (ref($privacyhash{$key}{$status}) eq 'HASH') {
+                                    if (keys(%{$privacyhash{$key}{$status}})) {
+                                        $resulttext .= join(', ', map { $fieldnames{$_}; } (sort(keys(%{$privacyhash{$key}{$status}}))));
+                                    } else {
+                                        $resulttext .= &mt('none');
+                                    }
+                                }
+                                $resulttext .= '</li>';
+                            }
+                        }
+                    } else {
+                        foreach my $item (@items) {
+                            if (ref($privacyhash{$key}{$item}) eq 'HASH') {
+                                $resulttext .= '<li>'.$names{$item}.': ';
+                                if (keys(%{$privacyhash{$key}{$item}})) {
+                                    $resulttext .= join(', ', map { $fieldnames{$_}; } (sort(keys(%{$privacyhash{$key}{$item}}))));
+                                } else {
+                                    $resulttext .= &mt('none');
+                                }
+                                $resulttext .= '</li>';
+                            }
+                        }
+                    }
+                    $resulttext .= '</ul></li>';
+                }
+            }
+        } else {
+            $resulttext = &mt('No changes made to user information settings');
+        }
+    } else {
+        $resulttext = '<span class="LC_error">'.
+            &mt('An error occurred: [_1]',$putresult).'</span>';
+    }
+    return $resulttext;
+}
+
 sub modify_passwords {
     my ($r,$dom,$confname,$lastactref,%domconfig) = @_;
-    my ($resulttext,%current,%changes,%newvalues,@oktypes,$errors,$updatedefaults);
+    my ($resulttext,%current,%changes,%newvalues,@oktypes,$errors,
+        $updatedefaults,$updateconf);
     my $customfn = 'resetpw.html';
     if (ref($domconfig{'passwords'}) eq 'HASH') {
         %current = %{$domconfig{'passwords'}};
@@ -13983,6 +14460,7 @@ sub modify_passwords {
         max            => 'Maximum password length',
         chars          => 'Required characters',
         expire         => 'Password expiration (days)',
+        numsaved       => 'Number of previous passwords to save',
         reset          => 'Resetting Forgotten Password',
         intauth        => 'Encryption of Stored Passwords (Internal Auth)',
         rules          => 'Rules for LON-CAPA Passwords',
@@ -14190,9 +14668,17 @@ sub modify_passwords {
             $updatedefaults = 1;
         }
     }
-    foreach my $rule ('min','max','expire') {
+    foreach my $rule ('min','max','expire','numsaved') {
         $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
-        if ($env{'form.passwords_'.$rule} =~ /^(|\d+(|\.\d*))$/) {
+        my $ruleok;
+        if ($rule eq 'expire') {
+            if ($env{'form.passwords_'.$rule} =~ /^\d+(|\.\d*)$/) {
+                $ruleok = 1;
+            }
+        } elsif ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
+            $ruleok = 1;
+        }
+        if ($ruleok) {
             $newvalues{$rule} = $env{'form.passwords_'.$rule};
             if (exists($current{$rule})) {
                 if ($newvalues{$rule} ne $current{$rule}) {
@@ -14227,13 +14713,36 @@ sub modify_passwords {
             }
         }
     }
-    if ($env{'form.passwords_crsowner'}) {
-        $newvalues{'crsownerchg'} = 1;
-        unless ($current{'crsownerchg'}) {
-            $changes{'crsownerchg'} = 1;
+    my %crsownerchg = (
+                        by => [],
+                        for => [],
+                      );
+    foreach my $item ('by','for') {
+        my @posstypes = &Apache::loncommon::get_env_multiple('form.passwords_crsowner_'.$item);
+        foreach my $type (sort(@posstypes)) {
+            if (grep(/^\Q$type\E$/,@oktypes)) {
+                push(@{$crsownerchg{$item}},$type);
+            }
+        }
+    }
+    $newvalues{'crsownerchg'} = \%crsownerchg;
+    if (ref($current{'crsownerchg'}) eq 'HASH') {
+        foreach my $item ('by','for') {
+            if (ref($current{'crsownerchg'}{$item}) eq 'ARRAY') {
+                my @diffs = &Apache::loncommon::compare_arrays($current{'crsownerchg'}{$item},$crsownerchg{$item});
+                if (@diffs > 0) {
+                    $changes{'crsownerchg'} = 1;
+                    last;
+                }
+            }
+        }
+    } elsif (!exists($domconfig{passwords})) {
+        foreach my $item ('by','for') {
+            if (@{$crsownerchg{$item}} > 0) {
+                $changes{'crsownerchg'} = 1;
+                last;
+            }
         }
-    } elsif ($current{'crsownerchg'}) {
-        $changes{'crsownerchg'} = 1;
     }
 
     my %confighash = (
@@ -14248,6 +14757,9 @@ sub modify_passwords {
             $resulttext = &mt('Changes made: ').'<ul>';
             foreach my $key ('reset','intauth','rules','crsownerchg') {
                 if ($changes{$key}) {
+                    unless ($key eq 'intauth') {
+                        $updateconf = 1;
+                    }
                     $resulttext .= '<li>'.$titles{$key}.':<ul>';
                     if ($key eq 'reset') {
                         if ($confighash{'passwords'}{'captcha'} eq 'original') {
@@ -14369,22 +14881,42 @@ sub modify_passwords {
                             $resulttext .= '<li>'.&mt('[_1] set to "[_2]"',$titles{$key.'_'.$item},$value).'</li>';
                         }
                     } elsif ($key eq 'rules') {
-                        foreach my $rule ('min','max','expire') {
+                        foreach my $rule ('min','max','expire','numsaved') {
                             if ($confighash{'passwords'}{$rule} eq '') {
-                                $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
                                 if ($rule eq 'min') {
-                                   $resulttext .= ' '.&mt('Default of 7 will be used');
+                                    $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
+                                                   ' '.&mt('Default of 7 will be used').'</li>';
+                                } else {
+                                    $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
                                 }
-                                $resulttext .= '</li>';
                             } else {
                                 $resulttext .= '<li>'.&mt('[_1] set to [_2]',$titles{$rule},$confighash{'passwords'}{$rule}).'</li>';
                             }
                         }
                     } elsif ($key eq 'crsownerchg') {
-                        if ($confighash{'passwords'}{'crsownerchg'}) {
-                            $resulttext .= '<li>'.&mt('Course owner may change student passwords.').'</li>';
+                        if (ref($confighash{'passwords'}{'crsownerchg'}) eq 'HASH') {
+                            if ((@{$confighash{'passwords'}{'crsownerchg'}{'by'}} == 0) ||
+                                (@{$confighash{'passwords'}{'crsownerchg'}{'for'}} == 0)) {
+                                $resulttext .= '<li>'.&mt('Course owner may not change student passwords.').'</li>';
+                            } else {
+                                my %crsownerstr;
+                                foreach my $item ('by','for') {
+                                    if (ref($confighash{'passwords'}{'crsownerchg'}{$item}) eq 'ARRAY') {
+                                        foreach my $type (@{$confighash{'passwords'}{'crsownerchg'}{$item}}) {
+                                            if ($type eq 'default') {
+                                                $crsownerstr{$item} .= $othertitle.', ';
+                                            } elsif ($usertypes->{$type} ne '') {
+                                                $crsownerstr{$item} .= $usertypes->{$type}.', ';
+                                            }
+                                        }
+                                        $crsownerstr{$item} =~ s/\Q, \E$//;
+                                    }
+                                }
+                                $resulttext .= '<li>'.&mt('Course owner (with status: [_1]) may change passwords for students (with status: [_2]).',
+                                           $crsownerstr{'by'},$crsownerstr{'for'}).'</li>';
+                            }
                         } else {
-                            $resulttext .= '<li>'.&mt('Course owner may not change student passwords.');
+                            $resulttext .= '<li>'.&mt('Course owner may not change student passwords.').'</li>';
                         }
                     }
                     $resulttext .= '</ul></li>';
@@ -14394,13 +14926,19 @@ sub modify_passwords {
         } else {
             $resulttext = &mt('No changes made to password settings');
         }
+        my $cachetime = 24*60*60;
         if ($updatedefaults) {
-            my $cachetime = 24*60*60;
             &Apache::lonnet::do_cache_new('domdefaults',$dom,\%domdefaults,$cachetime);
             if (ref($lastactref) eq 'HASH') {
                 $lastactref->{'domdefaults'} = 1;
             }
         }
+        if ($updateconf) {
+            &Apache::lonnet::do_cache_new('passwdconf',$dom,$confighash{'passwords'},$cachetime);
+            if (ref($lastactref) eq 'HASH') {
+                $lastactref->{'passwdconf'} = 1;
+            }
+        }
     } else {
         $resulttext = '<span class="LC_error">'.
             &mt('An error occurred: [_1]',$putresult).'</span>';
@@ -15225,7 +15763,7 @@ sub modify_selfcreation {
                                 $chgtext .= &mt('For self-created accounts verified by e-mail address, username is set as follows:').
                                             '<ul>';
                                 foreach my $status (@statuses) {
-                                    if ($type eq 'default') {
+                                    if ($status eq 'default') {
                                         $chgtext .= '<li>'.$othertitle.' -- '.$options{$cancreate{'emailverified'}{$status}}.'</li>';
                                     } else {
                                         $chgtext .= '<li>'.$usertypes{$status}.' -- '.$options{$cancreate{'emailverified'}{$status}}.'</li>';
@@ -16357,6 +16895,10 @@ sub modify_coursecategories {
                     }
                     $resulttext .= '</ul></li>';
                 }
+                &Apache::lonnet::do_cache_new('cats',$dom,$cathash,3600);
+                if (ref($lastactref) eq 'HASH') {
+                    $lastactref->{'cats'} = 1;
+                }
             }
             $resulttext .= '</ul>';
             if ($changes{'unauth'} || $changes{'auth'}) {
@@ -19136,7 +19678,8 @@ sub devalidate_remote_domconfs {
     my %servers = &Apache::lonnet::internet_dom_servers($dom);
     my %thismachine;
     map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
-    my @posscached = ('domainconfig','domdefaults','ltitools','usersessions','directorysrch');
+    my @posscached = ('domainconfig','domdefaults','ltitools','usersessions',
+                      'directorysrch','passwdconf','cats');
     if (keys(%servers)) {
         foreach my $server (keys(%servers)) {
             next if ($thismachine{$server});