--- loncom/interface/domainprefs.pm	2021/12/24 11:07:42	1.398
+++ loncom/interface/domainprefs.pm	2022/02/18 13:39:22	1.408
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.398 2021/12/24 11:07:42 raeburn Exp $
+# $Id: domainprefs.pm,v 1.408 2022/02/18 13:39:22 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -220,10 +220,10 @@ sub handler {
                 'serverstatuses','requestcourses','helpsettings',
                 'coursedefaults','usersessions','loadbalancing',
                 'requestauthor','selfenrollment','inststatus',
-                'ltitools','ssl','trust','lti','privacy','passwords',
+                'ltitools','ssl','trust','lti','ltisec','privacy','passwords',
                 'proctoring','wafproxy','ipaccess'],$dom);
     my %encconfig =
-        &Apache::lonnet::get_dom('encconfig',['ltitools','lti','proctoring'],$dom,undef,1);
+        &Apache::lonnet::get_dom('encconfig',['ltitools','lti','proctoring','linkprot'],$dom,undef,1);
     if (ref($domconfig{'ltitools'}) eq 'HASH') {
         if (ref($encconfig{'ltitools'}) eq 'HASH') {
             foreach my $id (keys(%{$domconfig{'ltitools'}})) {
@@ -248,6 +248,23 @@ sub handler {
             }
         }
     }
+    if (ref($domconfig{'ltisec'}) eq 'HASH') {
+        if (ref($domconfig{'ltisec'}{'linkprot'}) eq 'HASH') {
+            if (ref($encconfig{'linkprot'}) eq 'HASH') {
+                foreach my $id (keys(%{$domconfig{'ltisec'}{'linkprot'}})) {
+                    unless ($id =~ /^\d+$/) {
+                        delete($domconfig{'ltisec'}{'linkprot'}{$id});
+                    }
+                    if ((ref($domconfig{'ltisec'}{'linkprot'}{$id}) eq 'HASH') &&
+                        (ref($encconfig{'linkprot'}{$id}) eq 'HASH')) {
+                        foreach my $item ('key','secret') {
+                            $domconfig{'ltisec'}{'linkprot'}{$id}{$item} = $encconfig{'linkprot'}{$id}{$item};
+                        }
+                    }
+                }
+            }
+        }
+    }
     if (ref($domconfig{'proctoring'}) eq 'HASH') {
         if (ref($encconfig{'proctoring'}) eq 'HASH') {
             foreach my $provider (keys(%{$domconfig{'proctoring'}})) {
@@ -617,10 +634,16 @@ sub handler {
                   modify => \&modify_trust,
                  },
           'lti' =>
-                 {text => 'LTI Provider',
+                 {text => 'LTI Link Protection and LTI Consumers',
                   help => 'Domain_Configuration_LTI_Provider',
-                  header => [{col1 => 'Setting',
-                              col2 => 'Value',}],
+                  header => [{col1 => 'Encryption of shared secrets',
+                              col2 => 'Settings'},
+                             {col1 => 'Rules for shared secrets', 
+                              col2 => 'Settings'},
+                             {col1 => 'Link Protectors',
+                              col2 => 'Settings'},
+                             {col1 => 'Consumers',
+                              col2 => 'Settings'},],
                   print => \&print_lti,
                   modify => \&modify_lti,
                  },
@@ -639,7 +662,7 @@ sub handler {
                             header => [{col1 => 'Log-in Service',
                                         col2 => 'Server Setting',},
                                        {col1 => 'Log-in Page Items',
-                                        col2 => ''},
+                                        col2 => 'Settings'},
                                        {col1 => 'Log-in Help',
                                         col2 => 'Value'},
                                        {col1 => 'Custom HTML in document head',
@@ -850,7 +873,7 @@ sub print_config_box {
     } elsif ($action eq 'defaults') {
         $output = &defaults_javascript($settings); 
     } elsif ($action eq 'passwords') {
-        $output = &passwords_javascript();
+        $output = &passwords_javascript($action);
     } elsif ($action eq 'helpsettings') {
         my (%privs,%levelscurrent);
         my %full=();
@@ -870,13 +893,16 @@ sub print_config_box {
     } elsif ($action eq 'ltitools') {
         $output .= &ltitools_javascript($settings);
     } elsif ($action eq 'lti') {
-        $output .= &lti_javascript($settings);
+        $output .= &passwords_javascript('secrets')."\n".
+                   &lti_javascript($dom,$settings);
     } elsif ($action eq 'proctoring') {
         $output .= &proctoring_javascript($settings);
     } elsif ($action eq 'wafproxy') {
         $output .= &wafproxy_javascript($dom);
     } elsif ($action eq 'autoupdate') {
         $output .= &autoupdate_javascript();
+    } elsif ($action eq 'autoenroll') {
+        $output .= &autoenroll_javascript();
     } elsif ($action eq 'login') {
         $output .= &saml_javascript();
     } elsif ($action eq 'ipaccess') {
@@ -922,7 +948,7 @@ sub print_config_box {
             ($action eq 'usermodification') || ($action eq 'defaults') || ($action eq 'coursedefaults') ||
             ($action eq 'selfenrollment') || ($action eq 'usersessions') || ($action eq 'ssl') ||
             ($action eq 'directorysrch') || ($action eq 'trust') || ($action eq 'helpsettings') ||
-            ($action eq 'contacts') || ($action eq 'privacy') || ($action eq 'wafproxy')) {
+            ($action eq 'contacts') || ($action eq 'privacy') || ($action eq 'wafproxy') || ($action eq 'lti')) {
             $output .= $item->{'print'}->('top',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'passwords') {
             $output .= $item->{'print'}->('top',$dom,$confname,$settings,\$rowtotal);
@@ -958,7 +984,7 @@ sub print_config_box {
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') || 
             ($action eq 'trust') || ($action eq 'contacts') ||
-            ($action eq 'privacy') || ($action eq 'passwords')) {
+            ($action eq 'privacy') || ($action eq 'passwords') || ($action eq 'lti')) {
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
@@ -1011,7 +1037,8 @@ sub print_config_box {
              </tr>'."\n";
                 if ($action eq 'coursecategories') {
                     $output .= &print_coursecategories('bottom',$dom,$item,$settings,\$rowtotal);
-                } elsif (($action eq 'contacts') || ($action eq 'privacy') || ($action eq 'passwords')) {
+                } elsif (($action eq 'contacts') || ($action eq 'privacy') || 
+                         ($action eq 'passwords') || ($action eq 'lti')) {
                     if ($action eq 'passwords') {
                         $output .= $item->{'print'}->('lower',$dom,$confname,$settings,\$rowtotal);
                     } else {
@@ -1248,8 +1275,8 @@ sub print_config_box {
             $output .= &print_quotas($dom,$settings,\$rowtotal,$action);
         } elsif (($action eq 'autoenroll') || ($action eq 'autocreate') || 
                  ($action eq 'serverstatuses') || ($action eq 'loadbalancing') || 
-                 ($action eq 'ltitools') || ($action eq 'lti') ||
-                 ($action eq 'proctoring') || ($action eq 'ipaccess')) {
+                 ($action eq 'ltitools') || ($action eq 'proctoring') ||
+                 ($action eq 'ipaccess')) {
             $output .= $item->{'print'}->($dom,$settings,\$rowtotal);
         }
     }
@@ -1355,6 +1382,7 @@ sub print_login {
             }
         }
         my @images = ('img','logo','domlogo','login');
+        my @alttext = ('img','logo','domlogo');
         my @logintext = ('textcol','bgcol');
         my @bgs = ('pgbg','mainbg','sidebg');
         my @links = ('link','alink','vlink');
@@ -1396,6 +1424,13 @@ sub print_login {
                     $designs{'showlogo'}{$item} = $settings->{'showlogo'}{$item};
                 }
             }
+            foreach my $item (@alttext) {
+                if (ref($settings->{'alttext'}) eq 'HASH') {
+                    if ($settings->{'alttext'}->{$item} ne '') {
+                        $designs{'alttext'}{$item} = $settings->{'alttext'}{$item};
+                    }
+                }
+            }
             foreach my $item (@logintext) {
                 if ($settings->{$item} ne '') {
                     $designs{'logintext'}{$item} = $settings->{$item};
@@ -1705,6 +1740,7 @@ sub login_choices {
             current       => "Current",
             samllanding   => "Dual login?",
             samloptions   => "Options",
+            alttext       => "Alt text",
         );
     return %choices;
 }
@@ -2050,7 +2086,7 @@ sub display_color_options {
         $css_class = $itemcount%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'>'.
                       '<td>'.$choices->{$img};
-        my ($imgfile,$img_import,$login_hdr_pick,$logincolors);
+        my ($imgfile,$img_import,$login_hdr_pick,$logincolors,$alttext);
         if ($role eq 'login') {
             if ($img eq 'login') {
                 $login_hdr_pick =
@@ -2058,8 +2094,13 @@ sub display_color_options {
                 $logincolors =
                     &login_text_colors($img,$role,$logintext,$phase,$choices,
                                        $designs,$defaults);
-            } elsif ($img ne 'domlogo') {
-                $datatable.= &logo_display_options($img,$defaults,$designs);
+            } else {
+                if ($img ne 'domlogo') {
+                    $datatable.= &logo_display_options($img,$defaults,$designs);
+                }
+                if (ref($designs->{'alttext'}) eq 'HASH') {
+                    $alttext = $designs->{'alttext'}{$img};
+                }
             }
         }
         $datatable .= '</td>';
@@ -2151,6 +2192,11 @@ sub display_color_options {
                 $datatable .='&nbsp;<input type="file" name="'.$role.'_'.$img.'" />';
             }
         }
+        if (($role eq 'login') && ($img ne 'login')) {
+            $datatable .= ('&nbsp;' x2).' <span class="LC_nobreak"><label>'.$choices->{'alttext'}.':'.
+                          '<input type="text" name="'.$role.'_alt_'.$img.'" size="10" value="'.$alttext.'" />'.
+                          '</label></span>';
+        }
         $datatable .= '</td></tr>';
     }
     $itemcount ++;
@@ -3365,8 +3411,8 @@ ENDSCRIPT
 
 
 sub lti_javascript {
-    my ($settings) = @_;
-    my $togglejs = &lti_toggle_js();
+    my ($dom,$settings) = @_;
+    my $togglejs = &lti_toggle_js($dom);
     unless (ref($settings) eq 'HASH') {
         return $togglejs;
     }
@@ -3386,6 +3432,7 @@ sub lti_javascript {
         push(@jsarray,$ordered{$item});
     }
     my $jstext = '    var lti = Array('."'".join("','",@jsarray)."'".');'."\n";
+    my $linkprot_js = &Apache::courseprefs::linkprot_javascript();
     return <<"ENDSCRIPT";
 <script type="text/javascript">
 // <![CDATA[
@@ -3430,6 +3477,9 @@ $jstext
     }
     return;
 }
+
+$linkprot_js
+
 // ]]>
 </script>
 
@@ -3439,12 +3489,17 @@ ENDSCRIPT
 }
 
 sub lti_toggle_js {
+    my ($dom) = @_;
     my %lcauthparmtext = &Apache::lonlocal::texthash (
                             localauth => 'Local auth argument',
                             krb       => 'Kerberos domain',
                          );
     my $crsincalert = &mt('"User\'s identity sent" needs to be set to "Yes" first,[_1] before setting "Course\'s identity sent" to "Yes"',"\n");
     &js_escape(\$crsincalert);
+    my %servers = &Apache::lonnet::get_servers($dom,'library');
+    my $primary = &Apache::lonnet::domain($dom,'primary');
+    my $course_servers = "'".join("','",keys(%servers))."'";
+
     return <<"ENDSCRIPT";
 <script type="text/javascript">
 // <![CDATA[
@@ -3647,6 +3702,125 @@ function toggleLTI(form,setting,item) {
     }
     return;
 }
+
+function toggleLTIEncKey(form) {
+    var shownhosts = new Array();
+    var hiddenhosts = new Array();
+    var forcourse = new Array($course_servers);
+    var fromdomain = '$primary';
+    var crsradio = form.elements['ltisec_crslinkprot'];
+    if (crsradio.length) {
+        for (var i=0; i<crsradio.length; i++) {
+            if (crsradio[i].checked) {
+                if (crsradio[i].value == 1) {
+                    if (forcourse.length > 0) {
+                        for (var j=0; j<forcourse.length; j++) {
+                            if (!shownhosts.includes(forcourse[j])) {
+                                shownhosts.push(forcourse[j]);
+                            }
+                        }
+                    }
+                } else {
+                    if (forcourse.length > 0) {
+                        for (var j=0; j<forcourse.length; j++) {
+                            if (!hiddenhosts.includes(forcourse[j])) { 
+                                hiddenhosts.push(forcourse[j]);
+                            }
+                        }
+                    } 
+                }
+            }
+        }
+    }
+    var domradio = form.elements['ltisec_domlinkprot'];
+    if (domradio.length) {
+        for (var i=0; i<domradio.length; i++) {
+            if (domradio[i].checked) {
+                if (domradio[i].value == 1) {
+                    if (!shownhosts.includes(fromdomain)) { 
+                        shownhosts.push(fromdomain);
+                    }
+                } else {
+                    if (!hiddenhosts.includes(fromdomain)) {
+                        hiddenhosts.push(fromdomain);
+                    }
+                }
+            }
+        }
+    }
+    var consumersradio = form.elements['ltisec_consumers'];
+    if (consumersradio.length) {
+        for (var i=0; i<consumersradio.length; i++) {
+            if (consumersradio[i].checked) {
+                if (consumersradio[i].value == 1) {
+                    if (!shownhosts.includes(fromdomain)) {     
+                        shownhosts.push(fromdomain);
+                    }
+                } else {
+                    if (!hiddenhosts.includes(fromdomain)) {
+                        hiddenhosts.push(fromdomain);
+                    }
+                }
+            }
+        }
+    }
+    if (shownhosts.length > 0) {
+        for (var i=0; i<shownhosts.length; i++) {
+            if (document.getElementById('ltisec_info_'+shownhosts[i])) {
+                document.getElementById('ltisec_info_'+shownhosts[i]).style.display = 'block';                 
+            }
+        }
+        if (document.getElementById('ltisec_noprivkey')) {
+            document.getElementById('ltisec_noprivkey').style.display = 'none';
+        }
+    } else {
+        if (document.getElementById('ltisec_noprivkey')) {
+            document.getElementById('ltisec_noprivkey').style.display = 'inline-block';
+        }
+    }
+    if (hiddenhosts.length > 0) {
+        for (var i=0; i<hiddenhosts.length; i++) {
+            if (!shownhosts.includes(hiddenhosts[i])) {
+                if (document.getElementById('ltisec_info_'+hiddenhosts[i])) {
+                    document.getElementById('ltisec_info_'+hiddenhosts[i]).style.display = 'none';
+                }
+            }
+        }
+    }
+    return;
+}
+
+function togglePrivKey(form,hostid) {
+    var radioname = '';
+    var currdivid = '';
+    var newdivid = '';
+    if ((document.getElementById('ltisec_divcurrprivkey_'+hostid)) &&
+        (document.getElementById('ltisec_divchgprivkey_'+hostid))) {
+        currdivid = document.getElementById('ltisec_divcurrprivkey_'+hostid);
+        newdivid = document.getElementById('ltisec_divchgprivkey_'+hostid);
+        radioname = form.elements['ltisec_changeprivkey_'+hostid];
+        if (radioname) {
+            if (radioname.length > 0) {
+                var setvis;
+                for (var i=0; i<radioname.length; i++) {
+                    if (radioname[i].checked == true) {
+                        if (radioname[i].value == 1) {
+                            newdivid.style.display = 'inline-block';
+                            currdivid.style.display = 'none';
+                            setvis = 1;
+                        }
+                        break;
+                    }
+                }
+                if (!setvis) {
+                    newdivid.style.display = 'none';
+                    currdivid.style.display = 'inline-block';
+                }
+            }
+        }
+    }
+}
+
 // ]]>
 </script>
 
@@ -3688,6 +3862,41 @@ function toggleLastActiveDays(form) {
 ENDSCRIPT
 }
 
+sub autoenroll_javascript {
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function toggleFailsafe(form) {
+    var radioname = 'autoenroll_failsafe';
+    var divid = 'autoenroll_failsafe_div';
+    var num = form.elements[radioname].length;
+    if (num) {
+        var setvis = '';
+        for (var i=0; i<num; i++) {
+            if (form.elements[radioname][i].checked) {
+                if ((form.elements[radioname][i].value == 'zero') || (form.elements[radioname][i].value == 'any')) {
+                    if (document.getElementById(divid)) {
+                        document.getElementById(divid).style.display = 'inline-block';
+                    }
+                    setvis = 1;
+                }
+                break;
+            }
+        }
+        if (!setvis) {
+            if (document.getElementById(divid)) {
+                document.getElementById(divid).style.display = 'none';
+            }
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
 sub saml_javascript {
     return <<"ENDSCRIPT";
 <script type="text/javascript">
@@ -3801,7 +4010,12 @@ ENDSCRIPT
 sub print_autoenroll {
     my ($dom,$settings,$rowtotal) = @_;
     my $autorun = &Apache::lonnet::auto_run(undef,$dom),
-    my ($defdom,$runon,$runoff,$coownerson,$coownersoff,$failsafe);
+    my ($defdom,$runon,$runoff,$coownerson,$coownersoff,
+        $failsafe,$autofailsafe,$failsafesty,%failsafechecked);
+    $failsafesty = 'none';
+    %failsafechecked = (
+        off => ' checked="checked"',
+    );
     if (ref($settings) eq 'HASH') {
         if (exists($settings->{'run'})) {
             if ($settings->{'run'} eq '0') {
@@ -3835,8 +4049,24 @@ sub print_autoenroll {
         if (exists($settings->{'sender_domain'})) {
             $defdom = $settings->{'sender_domain'};
         }
-        if (exists($settings->{'autofailsafe'})) {
-            $failsafe = $settings->{'autofailsafe'};
+        if (exists($settings->{'failsafe'})) {
+            $failsafe = $settings->{'failsafe'};
+            if ($failsafe eq 'zero') {
+                $failsafechecked{'zero'} = ' checked="checked"';
+                $failsafechecked{'off'} = '';
+                $failsafesty = 'inline-block';
+            } elsif ($failsafe eq 'any') {
+                $failsafechecked{'any'} = ' checked="checked"';
+                $failsafechecked{'off'} = '';
+            }
+            $autofailsafe = $settings->{'autofailsafe'};
+        } elsif (exists($settings->{'autofailsafe'})) {
+            $autofailsafe = $settings->{'autofailsafe'};
+            if ($autofailsafe ne '') {
+                $failsafechecked{'zero'} = ' checked="checked"';
+                $failsafe = 'zero';
+                $failsafechecked{'off'} = '';
+            }
         }
     } else {
         if ($autorun) {
@@ -3875,9 +4105,15 @@ sub print_autoenroll {
                   $coownersoff.' value="0" />'.&mt('No').'</label></span></td>'.
                   '</tr><tr>'.
                   '<td>'.&mt('Failsafe for no drops when institutional data missing').'</td>'.
-                  '<td class="LC_right_item"><span class="LC_nobreak">'.
-                  '<input type="text" name="autoenroll_failsafe"'.
-                  ' value="'.$failsafe.'" size="4" /></span></td></tr>';
+                  '<td class="LC_left_item"><span class="LC_nobreak">'.
+                  '<span class="LC_nobreak"><label><input type="radio" name="autoenroll_failsafe" value="off" onclick="toggleFailsafe(this.form)"'.$failsafechecked{'off'}.' />'.&mt('Not in use').'</label></span>&nbsp;&nbsp;&nbsp; '.
+                  '<span class="LC_nobreak"><label><input type="radio" name="autoenroll_failsafe" value="zero" onclick="toggleFailsafe(this.form)"'.$failsafechecked{'zero'}.' />'.&mt('Retrieved section enrollment is zero').'</label></span><br />'.
+                  '<span class="LC_nobreak"><label><input type="radio" name="autoenroll_failsafe" value="any" onclick="toggleFailsafe(this.form)"'.$failsafechecked{'any'}.' />'.&mt('Retrieved section enrollment is zero or greater').'</label></span>'.
+                  '<div class="LC_floatleft" style="display:'.$failsafesty.';" id="autoenroll_failsafe_div">'.
+                  '<span class="LC_nobreak">'.
+                  &mt('Threshold for number of students in section to drop: [_1]',
+                      '<input type="text" name="autoenroll_autofailsafe" value="'.$autofailsafe.'" size="4" />').
+                  '</span></div></td></tr>';
     $$rowtotal += 4;
     return $datatable;
 }
@@ -6225,144 +6461,290 @@ sub proctoring_providernames {
 }
 
 sub print_lti {
-    my ($dom,$settings,$rowtotal) = @_;
+    my ($position,$dom,$settings,$rowtotal) = @_;
     my $itemcount = 1;
-    my $maxnum = 0;
-    my $css_class;
-    my %ordered;
+    my ($datatable,$css_class);
+    my (%rules,%encrypt,%privkeys,%linkprot);
     if (ref($settings) eq 'HASH') {
-        foreach my $item (keys(%{$settings})) {
-            if (ref($settings->{$item}) eq 'HASH') {
-                my $num = $settings->{$item}{'order'};
-                if ($num eq '') {
-                    $num = scalar(keys(%{$settings}));
+        if ($position eq 'top') {
+            if (exists($settings->{'encrypt'})) {
+                if (ref($settings->{'encrypt'}) eq 'HASH') {
+                    foreach my $key (keys(%{$settings->{'encrypt'}})) {
+                        if ($key eq 'consumers') {
+                            $encrypt{'ltisec_'.$key} = $settings->{'encrypt'}{$key};
+                        } else {
+                            $encrypt{'ltisec_'.$key.'linkprot'} = $settings->{'encrypt'}{$key};
+                        }
+                    }
+                }
+            }
+            if (exists($settings->{'private'})) {
+                if (ref($settings->{'private'}) eq 'HASH') {
+                    if (ref($settings->{'private'}) eq 'HASH') {
+                        if (ref($settings->{'private'}{'keys'}) eq 'ARRAY') {
+                            map { $privkeys{$_} = 1; } (@{$settings->{'private'}{'keys'}});
+                        }
+                    }
+                }
+            }
+        } elsif ($position eq 'middle') {
+            if (exists($settings->{'rules'})) {
+                if (ref($settings->{'rules'}) eq 'HASH') {
+                    %rules = %{$settings->{'rules'}};
+                }
+            }
+        } elsif ($position eq 'lower') {
+            if (exists($settings->{'linkprot'})) {
+                if (ref($settings->{'linkprot'}) eq 'HASH') {
+                    %linkprot = %{$settings->{'linkprot'}};
+                    if ($linkprot{'lock'}) {
+                        delete($linkprot{'lock'});
+                    }
+                }
+            }
+        } else {
+            foreach my $key ('encrypt','private','rules','linkprot') {
+                if (exists($settings->{$key})) {
+                    delete($settings->{$key});
                 }
-                $ordered{$num} = $item;
             }
         }
     }
-    my $maxnum = scalar(keys(%ordered));
-    my $datatable;
-    my %lt = &lti_names();
-    if (keys(%ordered)) {
-        my @items = sort { $a <=> $b } keys(%ordered);
-        for (my $i=0; $i<@items; $i++) {
-            $css_class = $itemcount%2?' class="LC_odd_row"':'';
-            my $item = $ordered{$items[$i]};
-            my ($key,$secret,$lifetime,$consumer,$requser,$crsinc,$current);
-            if (ref($settings->{$item}) eq 'HASH') {
-                $key = $settings->{$item}->{'key'};
-                $secret = $settings->{$item}->{'secret'};
-                $lifetime = $settings->{$item}->{'lifetime'};
-                $consumer = $settings->{$item}->{'consumer'};
-                $requser = $settings->{$item}->{'requser'};
-                $crsinc = $settings->{$item}->{'crsinc'};
-                $current = $settings->{$item};
-            }
-            my $onclickrequser = ' onclick="toggleLTI(this.form,'."'requser','$i'".');"';
-            my %checkedrequser = (
-                                   yes => ' checked="checked"',
-                                   no  => '',
-                                 );
-            if (!$requser) {
-                $checkedrequser{'no'} = $checkedrequser{'yes'};
-                $checkedrequser{'yes'} = '';
+    if ($position eq 'top') {
+        my @ids=&Apache::lonnet::current_machine_ids();
+        my %servers = &Apache::lonnet::get_servers($dom,'library');
+        my $primary = &Apache::lonnet::domain($dom,'primary');
+        my ($extra,$numshown);
+        foreach my $hostid (sort(keys(%servers))) {
+            my ($showextra,$divsty,$switch);
+            if ($hostid eq $primary) {
+                if (($encrypt{'ltisec_consumers'}) || ($encrypt{'ltisec_domlinkprot'})) {
+                    $showextra = 1;
+                }
+            }
+            if ($encrypt{'ltisec_crslinkprot'}) {
+                $showextra = 1;
+            }
+            unless (grep(/^\Q$hostid\E$/,@ids)) {
+                $switch = 1;
+            }
+            if ($showextra) {
+                $numshown ++;
+                $divsty = 'display:inline-block'; 
+            } else {
+                $divsty = 'display:none';
+            } 
+            $extra .= '<fieldset id="ltisec_info_'.$hostid.'" style="'.$divsty.'">'.
+                      '<legend>'.$hostid.'</legend>';
+            if ($switch) {
+                my $switchserver = '<a href="/adm/switchserver?otherserver='.$hostid.'&amp;role='.
+                                   &HTML::Entities::encode($env{'request.role'},'\'<>"&').
+                                   '&amp;destinationurl=/adm/domainprefs">'.&mt('Switch Server').'</a>';
+                if (exists($privkeys{$hostid})) {
+                    $extra .= '<div id="ltisec_divcurrprivkey_'.$hostid.'" style="display:inline-block" />'.
+                              '<span class="LC_nobreak">'.
+                              &mt('Encryption Key').': ['.&mt('not shown').'] '.('&nbsp;'x2).'</span></div>'.
+                              '<span class="LC_nobreak">'.&mt('Change?').
+                              '<label><input type="radio" value="0" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" checked="checked" />'.&mt('No').'</label>'.
+                              ('&nbsp;'x2).
+                              '<label><input type="radio" value="1" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" />'.&mt('Yes').
+                              '</label>&nbsp;&nbsp;</span><div id="ltisec_divchgprivkey_'.$hostid.'" style="display:none" />'.
+                              '<span class="LC_nobreak"> - '.&mt('submit from server ([_1]): [_2].',$hostid,$switchserver).
+                              '</span></div>';
+                } else {
+                    $extra .= '<span class="LC_nobreak">'.
+                              &mt('Key required').' - '.&mt('submit from server ([_1]): [_2].',$hostid,$switchserver).
+                              '</span>'."\n";
+                }
+            } elsif (exists($privkeys{$hostid})) {
+                $extra .= '<div id="ltisec_divcurrprivkey_'.$hostid.'" style="display:inline-block" /><span class="LC_nobreak">'.
+                          &mt('Encryption Key').': ['.&mt('not shown').'] '.('&nbsp;'x2).'</span></div>'.
+                          '<span class="LC_nobreak">'.&mt('Change?').
+                          '<label><input type="radio" value="0" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" checked="checked" />'.&mt('No').'</label>'.
+                          ('&nbsp;'x2).
+                          '<label><input type="radio" value="1" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" />'.&mt('Yes').
+                          '</label>&nbsp;&nbsp;</span><div id="ltisec_divchgprivkey_'.$hostid.'" style="display:none" />'.
+                          '<span class="LC_nobreak">'.&mt('New Key').':'.
+                          '<input type="password" size="20" name="ltisec_privkey_'.$hostid.'" value="" autocomplete="off" />'.
+                          '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.ltisec_privkey_'.$hostid.'.type='."'text'".' } else { this.form.ltisec_privkey_'.$hostid.'.type='."'password'".' }" />'.&mt('Visible input').'</label>'.
+                          '</span></div>';
+            } else {
+                $extra .= '<span class="LC_nobreak">'.&mt('Encryption Key').':'.
+                          '<input type="password" size="20" name="ltisec_privkey_'.$hostid.'" value="" autocomplete="off" />'.
+                          '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.ltisec_privkey_'.$hostid.'.type='."'text'".' } else { this.form.ltisec_privkey_'.$hostid.'.type='."'password'".' }" />'.&mt('Visible input').'</label>';
             }
-            my $onclickcrsinc = ' onclick="toggleLTI(this.form,'."'crsinc','$i'".');"';
-            my %checkedcrsinc = (
+            $extra .= '</fieldset>';
+        }
+        my %choices = &Apache::lonlocal::texthash (
+                                                      ltisec_crslinkprot => 'Encrypt stored link protection secrets defined in courses',
+                                                      ltisec_domlinkprot => 'Encrypt stored link protection secrets defined in domain',
+                                                      ltisec_consumers   => 'Encrypt stored consumer secrets defined in domain',
+                                                  );
+        my @toggles = qw(ltisec_crslinkprot ltisec_domlinkprot ltisec_consumers);
+        my %defaultchecked = (
+                               'ltisec_crslinkprot' => 'off',
+                               'ltisec_domlinkprot' => 'off',
+                               'ltisec_consumers'   => 'off',
+                             );
+        my ($onclick,$itemcount);
+        $onclick = 'javascript:toggleLTIEncKey(this.form);';
+        ($datatable,$itemcount) = &radiobutton_prefs(\%encrypt,\@toggles,\%defaultchecked,
+                                                     \%choices,$itemcount,$onclick,'','left','no');
+
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        my $noprivkeysty = 'display:inline-block';
+        if ($numshown) {
+            $noprivkeysty = 'display:none'; 
+        }
+        $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'.&mt('Encryption Key(s)').'</td>'.
+                      '<td><div id="ltisec_noprivkey" style="'.$noprivkeysty.'" >'.
+                      '<span class="LC_nobreak">'.&mt('Not in use').'</span></div>'.
+                      $extra.
+                      '</td></tr>';
+        $itemcount ++;                
+        $$rowtotal += $itemcount;
+    } elsif ($position eq 'middle') {
+        $datatable = &password_rules('secrets',\$itemcount,\%rules);
+        $$rowtotal += $itemcount;
+    } elsif ($position eq 'lower') {
+         $datatable .= &Apache::courseprefs::print_linkprotection($dom,'',$settings,$rowtotal,'','','domain');
+    } else {
+        my $maxnum = 0;
+        my %ordered;
+        if (ref($settings) eq 'HASH') {
+            foreach my $item (keys(%{$settings})) {
+                if (ref($settings->{$item}) eq 'HASH') {
+                    my $num = $settings->{$item}{'order'};
+                    if ($num eq '') {
+                        $num = scalar(keys(%{$settings}));
+                    }
+                    $ordered{$num} = $item;
+                }
+            }
+        }
+        $maxnum = scalar(keys(%ordered));
+        my %lt = &lti_names();
+        if (keys(%ordered)) {
+            my @items = sort { $a <=> $b } keys(%ordered);
+            for (my $i=0; $i<@items; $i++) {
+                $css_class = $itemcount%2?' class="LC_odd_row"':'';
+                my $item = $ordered{$items[$i]};
+                my ($key,$secret,$lifetime,$consumer,$requser,$crsinc,$current);
+                if (ref($settings->{$item}) eq 'HASH') {
+                    $key = $settings->{$item}->{'key'};
+                    $secret = $settings->{$item}->{'secret'};
+                    $lifetime = $settings->{$item}->{'lifetime'};
+                    $consumer = $settings->{$item}->{'consumer'};
+                    $requser = $settings->{$item}->{'requser'};
+                    $crsinc = $settings->{$item}->{'crsinc'};
+                    $current = $settings->{$item};
+                }
+                my $onclickrequser = ' onclick="toggleLTI(this.form,'."'requser','$i'".');"';
+                my %checkedrequser = (
+                                       yes => ' checked="checked"',
+                                       no  => '',
+                                     );
+                if (!$requser) {
+                    $checkedrequser{'no'} = $checkedrequser{'yes'};
+                    $checkedrequser{'yes'} = '';
+                }
+                my $onclickcrsinc = ' onclick="toggleLTI(this.form,'."'crsinc','$i'".');"';
+                my %checkedcrsinc = (
                                       yes => ' checked="checked"',
                                       no  => '',
-                                   );
-            if (!$crsinc) {
-                $checkedcrsinc{'no'} = $checkedcrsinc{'yes'};
-                $checkedcrsinc{'yes'} = '';
-            }
-            my $chgstr = ' onchange="javascript:reorderLTI(this.form,'."'lti_pos_".$item."'".');"';
-            $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'
-                         .'<select name="lti_pos_'.$item.'"'.$chgstr.'>';
-            for (my $k=0; $k<=$maxnum; $k++) {
-                my $vpos = $k+1;
-                my $selstr;
-                if ($k == $i) {
-                    $selstr = ' selected="selected" ';
+                                    );
+                if (!$crsinc) {
+                    $checkedcrsinc{'no'} = $checkedcrsinc{'yes'};
+                    $checkedcrsinc{'yes'} = '';
+                }
+                my $chgstr = ' onchange="javascript:reorderLTI(this.form,'."'lti_pos_".$item."'".');"';
+                $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'
+                             .'<select name="lti_pos_'.$item.'"'.$chgstr.'>';
+                for (my $k=0; $k<=$maxnum; $k++) {
+                    my $vpos = $k+1;
+                    my $selstr;
+                    if ($k == $i) {
+                        $selstr = ' selected="selected" ';
+                    }
+                    $datatable .= '<option value="'.$k.'"'.$selstr.'>'.$vpos.'</option>';
                 }
-                $datatable .= '<option value="'.$k.'"'.$selstr.'>'.$vpos.'</option>';
+                $datatable .= '</select>'.('&nbsp;'x2).
+                    '<label><input type="checkbox" name="lti_del" value="'.$item.'" />'.
+                    &mt('Delete?').'</label></span></td>'.
+                    '<td colspan="2">'.
+                    '<fieldset><legend>'.&mt('Required settings').'</legend>'.
+                    '<span class="LC_nobreak">'.$lt{'consumer'}.
+                    ':<input type="text" size="15" name="lti_consumer_'.$i.'" value="'.$consumer.'" /></span> '.
+                    ('&nbsp;'x2).
+                    '<span class="LC_nobreak">'.$lt{'version'}.':<select name="lti_version_'.$i.'">'.
+                    '<option value="LTI-1p0" selected="selected">1.1</option></select></span> '.
+                    ('&nbsp;'x2).
+                    '<span class="LC_nobreak">'.$lt{'lifetime'}.':<input type="text" name="lti_lifetime_'.$i.'"'.
+                    'value="'.$lifetime.'" size="3" /></span>'.
+                    ('&nbsp;'x2).
+                    '<span class="LC_nobreak">'.$lt{'requser'}.':'.
+                    '<label><input type="radio" name="lti_requser_'.$i.'" value="1"'.$onclickrequser.$checkedrequser{yes}.' />'.&mt('Yes').'</label>&nbsp;'."\n".
+                    '<label><input type="radio" name="lti_requser_'.$i.'" value="0"'.$onclickrequser.$checkedrequser{no}.' />'.&mt('No').'</label></span>'."\n".
+                    '<br /><br />'.
+                    '<span class="LC_nobreak">'.$lt{'crsinc'}.':'.
+                    '<label><input type="radio" name="lti_crsinc_'.$i.'" value="1"'.$onclickcrsinc.$checkedcrsinc{yes}.' />'.&mt('Yes').'</label>&nbsp;'."\n".
+                    '<label><input type="radio" name="lti_crsinc_'.$i.'" value="0"'.$onclickcrsinc.$checkedcrsinc{no}.' />'.&mt('No').'</label></span>'."\n".
+                    ('&nbsp;'x4).
+                    '<span class="LC_nobreak">'.$lt{'key'}.
+                    ':<input type="text" size="25" name="lti_key_'.$i.'" value="'.$key.'" /></span> '.
+                    ('&nbsp;'x2).
+                    '<span class="LC_nobreak">'.$lt{'secret'}.':'.
+                    '<input type="password" size="20" name="lti_secret_'.$i.'" value="'.$secret.'" />'.
+                    '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.lti_secret_'.$i.'.type='."'text'".' } else { this.form.lti_secret_'.$i.'.type='."'password'".' }" />'.&mt('Visible input').'</label>'.
+                    '<input type="hidden" name="lti_id_'.$i.'" value="'.$item.'" /></span>'.
+                    '</fieldset>'.&lti_options($i,$current,$itemcount,%lt).'</td></tr>';
+                $itemcount ++;
             }
-            $datatable .= '</select>'.('&nbsp;'x2).
-                '<label><input type="checkbox" name="lti_del" value="'.$item.'" />'.
-                &mt('Delete?').'</label></span></td>'.
-                '<td colspan="2">'.
-                '<fieldset><legend>'.&mt('Required settings').'</legend>'.
-                '<span class="LC_nobreak">'.$lt{'consumer'}.
-                ':<input type="text" size="15" name="lti_consumer_'.$i.'" value="'.$consumer.'" /></span> '.
-                ('&nbsp;'x2).
-                '<span class="LC_nobreak">'.$lt{'version'}.':<select name="lti_version_'.$i.'">'.
-                '<option value="LTI-1p0" selected="selected">1.1</option></select></span> '.
-                ('&nbsp;'x2).
-                '<span class="LC_nobreak">'.$lt{'lifetime'}.':<input type="text" name="lti_lifetime_'.$i.'"'.
-                'value="'.$lifetime.'" size="3" /></span>'.
-                ('&nbsp;'x2).
-                 '<span class="LC_nobreak">'.$lt{'requser'}.':'.
-                 '<label><input type="radio" name="lti_requser_'.$i.'" value="1"'.$onclickrequser.$checkedrequser{yes}.' />'.&mt('Yes').'</label>&nbsp;'."\n".
-                 '<label><input type="radio" name="lti_requser_'.$i.'" value="0"'.$onclickrequser.$checkedrequser{no}.' />'.&mt('No').'</label></span>'."\n".
-                '<br /><br />'.
-                '<span class="LC_nobreak">'.$lt{'crsinc'}.':'.
-                '<label><input type="radio" name="lti_crsinc_'.$i.'" value="1"'.$onclickcrsinc.$checkedcrsinc{yes}.' />'.&mt('Yes').'</label>&nbsp;'."\n".
-                '<label><input type="radio" name="lti_crsinc_'.$i.'" value="0"'.$onclickcrsinc.$checkedcrsinc{no}.' />'.&mt('No').'</label></span>'."\n".
-                ('&nbsp;'x4).
-                '<span class="LC_nobreak">'.$lt{'key'}.
-                ':<input type="text" size="25" name="lti_key_'.$i.'" value="'.$key.'" /></span> '.
-                ('&nbsp;'x2).
-                '<span class="LC_nobreak">'.$lt{'secret'}.':'.
-                '<input type="password" size="20" name="lti_secret_'.$i.'" value="'.$secret.'" />'.
-                '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.lti_secret_'.$i.'.type='."'text'".' } else { this.form.lti_secret_'.$i.'.type='."'password'".' }" />'.&mt('Visible input').'</label>'.
-                '<input type="hidden" name="lti_id_'.$i.'" value="'.$item.'" /></span>'.
-                '</fieldset>'.&lti_options($i,$current,$itemcount,%lt).'</td></tr>';
-            $itemcount ++;
         }
-    }
-    $css_class = $itemcount%2?' class="LC_odd_row"':'';
-    my $chgstr = ' onchange="javascript:reorderLTI(this.form,'."'lti_pos_add'".');"';
-    $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'."\n".
-                  '<input type="hidden" name="lti_maxnum" value="'.$maxnum.'" />'."\n".
-                  '<select name="lti_pos_add"'.$chgstr.'>';
-    for (my $k=0; $k<$maxnum+1; $k++) {
-        my $vpos = $k+1;
-        my $selstr;
-        if ($k == $maxnum) {
-            $selstr = ' selected="selected" ';
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        my $chgstr = ' onchange="javascript:reorderLTI(this.form,'."'lti_pos_add'".');"';
+        $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'."\n".
+                      '<input type="hidden" name="lti_maxnum" value="'.$maxnum.'" />'."\n".
+                      '<select name="lti_pos_add"'.$chgstr.'>';
+        for (my $k=0; $k<$maxnum+1; $k++) {
+            my $vpos = $k+1;
+            my $selstr;
+            if ($k == $maxnum) {
+                $selstr = ' selected="selected" ';
+            }
+            $datatable .= '<option value="'.$k.'"'.$selstr.'>'.$vpos.'</option>';
         }
-        $datatable .= '<option value="'.$k.'"'.$selstr.'>'.$vpos.'</option>';
+        $datatable .= '</select>&nbsp;'."\n".
+                      '<input type="checkbox" name="lti_add" value="1" />'.&mt('Add').'</span></td>'."\n".
+                      '<td colspan="2">'.
+                      '<fieldset><legend>'.&mt('Required settings').'</legend>'.
+                      '<span class="LC_nobreak">'.$lt{'consumer'}.
+                      ':<input type="text" size="15" name="lti_consumer_add" value="" /></span> '."\n".
+                      ('&nbsp;'x2).
+                      '<span class="LC_nobreak">'.$lt{'version'}.':<select name="lti_version_add">'.
+                      '<option value="LTI-1p0" selected="selected">1.1</option></select></span> '."\n".
+                      ('&nbsp;'x2).
+                      '<span class="LC_nobreak">'.$lt{'lifetime'}.':<input type="text" size="3" name="lti_lifetime_add" value="300" /></span> '."\n".
+                      ('&nbsp;'x2).
+                      '<span class="LC_nobreak">'.$lt{'requser'}.':'.
+                      '<label><input type="radio" name="lti_requser_add" value="1" onclick="toggleLTI(this.form,'."'requser','add'".');" checked="checked" />'.&mt('Yes').'</label>&nbsp;'."\n".
+                      '<label><input type="radio" name="lti_requser_add" value="0" onclick="toggleLTI(this.form,'."'requser','add'".');" />'.&mt('No').'</label></span>'."\n".
+                      '<br /><br />'.
+                      '<span class="LC_nobreak">'.$lt{'crsinc'}.':'.
+                      '<label><input type="radio" name="lti_crsinc_add" value="1" onclick="toggleLTI(this.form,'."'crsinc','add'".');" checked="checked" />'.&mt('Yes').'</label>&nbsp;'."\n".
+                      '<label><input type="radio" name="lti_crsinc_add" value="0" onclick="toggleLTI(this.form,'."'crsinc','add'".');" />'.&mt('No').'</label></span>'."\n".
+                      ('&nbsp;'x4).
+                      '<span class="LC_nobreak">'.$lt{'key'}.':<input type="text" size="25" name="lti_key_add" value="" /></span> '."\n".
+                      ('&nbsp;'x2).
+                      '<span class="LC_nobreak">'.$lt{'secret'}.':<input type="password" size="20" name="lti_secret_add" value="" />'.
+                      '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.lti_secret_add.type='."'text'".' } else { this.form.lti_secret_add.type='."'password'".' }" />'.&mt('Visible input').'</label></span> '."\n".
+                      '</fieldset>'.&lti_options('add',undef,$itemcount,%lt).
+                      '</td>'."\n".
+                      '</tr>'."\n";
+        $itemcount ++;
     }
-    $datatable .= '</select>&nbsp;'."\n".
-                  '<input type="checkbox" name="lti_add" value="1" />'.&mt('Add').'</span></td>'."\n".
-                  '<td colspan="2">'.
-                  '<fieldset><legend>'.&mt('Required settings').'</legend>'.
-                  '<span class="LC_nobreak">'.$lt{'consumer'}.
-                  ':<input type="text" size="15" name="lti_consumer_add" value="" /></span> '."\n".
-                  ('&nbsp;'x2).
-                  '<span class="LC_nobreak">'.$lt{'version'}.':<select name="lti_version_add">'.
-                  '<option value="LTI-1p0" selected="selected">1.1</option></select></span> '."\n".
-                  ('&nbsp;'x2).
-                  '<span class="LC_nobreak">'.$lt{'lifetime'}.':<input type="text" size="3" name="lti_lifetime_add" value="300" /></span> '."\n".
-                  ('&nbsp;'x2).
-                  '<span class="LC_nobreak">'.$lt{'requser'}.':'.
-                  '<label><input type="radio" name="lti_requser_add" value="1" onclick="toggleLTI(this.form,'."'requser','add'".');" checked="checked" />'.&mt('Yes').'</label>&nbsp;'."\n".
-                  '<label><input type="radio" name="lti_requser_add" value="0" onclick="toggleLTI(this.form,'."'requser','add'".');" />'.&mt('No').'</label></span>'."\n".
-                  '<br /><br />'.
-                  '<span class="LC_nobreak">'.$lt{'crsinc'}.':'.
-                  '<label><input type="radio" name="lti_crsinc_add" value="1" onclick="toggleLTI(this.form,'."'crsinc','add'".');" checked="checked" />'.&mt('Yes').'</label>&nbsp;'."\n".
-                  '<label><input type="radio" name="lti_crsinc_add" value="0" onclick="toggleLTI(this.form,'."'crsinc','add'".');" />'.&mt('No').'</label></span>'."\n".
-                  ('&nbsp;'x4).
-                  '<span class="LC_nobreak">'.$lt{'key'}.':<input type="text" size="25" name="lti_key_add" value="" /></span> '."\n".
-                  ('&nbsp;'x2).
-                  '<span class="LC_nobreak">'.$lt{'secret'}.':<input type="password" size="20" name="lti_secret_add" value="" />'.
-                  '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.lti_secret_add.type='."'text'".' } else { this.form.lti_secret_add.type='."'password'".' }" />'.&mt('Visible input').'</label></span> '."\n".
-                  '</fieldset>'.&lti_options('add',undef,$itemcount,%lt).
-                  '</td>'."\n".
-                  '</tr>'."\n";
-    $$rowtotal ++;
-    return $datatable;;
+    $$rowtotal += $itemcount;
+    return $datatable;
 }
 
 sub lti_names {
@@ -6764,6 +7146,22 @@ sub ltimenu_titles {
     );
 }
 
+sub check_switchserver {
+    my ($home) = @_;
+    my $switchserver;
+    if ($home ne '') {
+        my $allowed;
+        my @ids=&Apache::lonnet::current_machine_ids();
+        foreach my $id (@ids) { if ($id eq $home) { $allowed=1; } }
+        if (!$allowed) {
+            $switchserver='<a href="/adm/switchserver?otherserver='.$home.'&amp;role='.
+                          &HTML::Entities::encode($env{'request.role'},'\'<>"&').
+                          '&amp;destinationurl=/adm/domainprefs">'.&mt('Switch Server').'</a>';
+        }
+    }
+    return $switchserver;
+}
+
 sub print_coursedefaults {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my ($css_class,$datatable,%checkedon,%checkedoff,%defaultchecked,@toggles);
@@ -6780,6 +7178,7 @@ sub print_coursedefaults {
         postsubmit           => 'Disable submit button/keypress following student submission',
         canclone             => "People who may clone a course (besides course's owner and coordinators)",
         mysqltables          => 'Lifetime (s) of "Temporary" MySQL tables (student performance data) on homeserver',
+        ltiauth              => 'Student username in LTI launch of deep-linked URL can be accepted without re-authentication',
     );
     my %staticdefaults = (
                            anonsurvey_threshold => 10,
@@ -6902,8 +7301,12 @@ sub print_coursedefaults {
         my ($currdefresponder,%defcredits,%curruploadquota,%deftimeout,%currmysql);
         my $currusecredits = 0;
         my $postsubmitclient = 1;
+        my $ltiauth = 0;
         my @types = ('official','unofficial','community','textbook','placement');
         if (ref($settings) eq 'HASH') {
+            if ($settings->{'ltiauth'}) {
+                $ltiauth = 1;
+            }
             $currdefresponder = $settings->{'anonsurvey_threshold'};
             if (ref($settings->{'uploadquota'}) eq 'HASH') {
                 foreach my $type (keys(%{$settings->{'uploadquota'}})) {
@@ -7049,7 +7452,16 @@ sub print_coursedefaults {
         }
         $datatable .= '</tr></table></td></tr>'."\n";
         $itemcount ++;
-
+        %defaultchecked = ('ltiauth' => 'off');
+        @toggles = ('ltiauth');
+        $current = {
+                       'ltiauth' => $ltiauth,
+                   };
+        ($table,$itemcount) =
+            &radiobutton_prefs($current,\@toggles,\%defaultchecked,
+                               \%choices,$itemcount,undef,undef,'left');
+        $datatable .= $table;
+        $itemcount ++;
     }
     $$rowtotal += $itemcount;
     return $datatable;
@@ -7703,95 +8115,7 @@ sub print_passwords {
             $itemcount ++;
         }
     } elsif ($position eq 'lower') {
-        my ($min,$max,%chars,$expire,$numsaved);
-        $min = $Apache::lonnet::passwdmin;
-        if (ref($settings) eq 'HASH') {
-            if ($settings->{min}) {
-                $min = $settings->{min};
-            }
-            if ($settings->{max}) {
-                $max = $settings->{max};
-            }
-            if (ref($settings->{chars}) eq 'ARRAY') {
-                map { $chars{$_} = 1; } (@{$settings->{chars}});
-            }
-            if ($settings->{expire}) {
-                $expire = $settings->{expire};
-            }
-            if ($settings->{numsaved}) {
-                $numsaved = $settings->{numsaved};
-            }
-        }
-        my %rulenames = &Apache::lonlocal::texthash(
-                                                     uc => 'At least one upper case letter',
-                                                     lc => 'At least one lower case letter',
-                                                     num => 'At least one number',
-                                                     spec => 'At least one non-alphanumeric',
-                                                   );
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
-                      '</span></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
-                      '</span></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'chars'}.'<br />'.
-                      '<span class="LC_nobreak LC_fontsize_small">'.&mt('(Leave unchecked if not required)').
-                      '</span></td>';
-        my $numinrow = 2;
-        my @possrules = ('uc','lc','num','spec');
-        $datatable .= '<td class="LC_left_item"><table>';
-        for (my $i=0; $i<@possrules; $i++) {
-            my ($rem,$checked);
-            if ($chars{$possrules[$i]}) {
-                $checked = ' checked="checked"';
-            }
-            $rem = $i%($numinrow);
-            if ($rem == 0) {
-                if ($i > 0) {
-                    $datatable .= '</tr>';
-                }
-                $datatable .= '<tr>';
-            }
-            $datatable .= '<td><span class="LC_nobreak"><label>'.
-                          '<input type="checkbox" name="passwords_chars" value="'.$possrules[$i].'"'.$checked.' />'.
-                          $rulenames{$possrules[$i]}.'</label></span></td>';
-        }
-        my $rem = @possrules%($numinrow);
-        my $colsleft = $numinrow - $rem;
-        if ($colsleft > 1 ) {
-            $datatable .= '<td colspan="'.$colsleft.'" class="LC_left_item">'.
-                          '&nbsp;</td>';
-        } elsif ($colsleft == 1) {
-            $datatable .= '<td class="LC_left_item">&nbsp;</td>';
-        }
-        $datatable .='</table></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'expire'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_expire" value="'.$expire.'" size="4" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no expiration)').'</span>'.
-                      '</span></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'. 
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
-                      '</span></td></tr>';
+        $datatable .= &password_rules('passwords',\$itemcount,$settings);
     } else {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
         my %ownerchg = (
@@ -7851,6 +8175,129 @@ sub print_passwords {
     return $datatable;
 }
 
+sub password_rules {
+    my ($prefix,$itemcountref,$settings) = @_;
+    my ($min,$max,%chars,$expire,$numsaved,$numinrow);
+    my %titles;
+    if ($prefix eq 'passwords') {
+        %titles = &Apache::lonlocal::texthash (
+            min            => 'Minimum password length',
+            max            => 'Maximum password length',
+            chars          => 'Required characters',
+        );
+    } elsif ($prefix eq 'secrets') {
+        %titles = &Apache::lonlocal::texthash (
+            min            => 'Minimum secret length',
+            max            => 'Maximum secret length',
+            chars          => 'Required characters',
+        );
+    }
+    $min = $Apache::lonnet::passwdmin;
+    my $datatable;
+    my $itemcount;
+    if (ref($itemcountref)) {
+        $itemcount = $$itemcountref;
+    }
+    if (ref($settings) eq 'HASH') {
+        if ($settings->{min}) {
+            $min = $settings->{min};
+        }
+        if ($settings->{max}) {
+            $max = $settings->{max};
+        }
+        if (ref($settings->{chars}) eq 'ARRAY') {
+            map { $chars{$_} = 1; } (@{$settings->{chars}});
+        }
+        if ($prefix eq 'passwords') { 
+            if ($settings->{expire}) {
+                $expire = $settings->{expire};
+            }
+            if ($settings->{numsaved}) {
+                $numsaved = $settings->{numsaved};
+            }
+        }
+    }
+    my %rulenames = &Apache::lonlocal::texthash(
+                                                 uc => 'At least one upper case letter',
+                                                 lc => 'At least one lower case letter',
+                                                 num => 'At least one number',
+                                                 spec => 'At least one non-alphanumeric',
+                                               );
+    my $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
+                  '<td class="LC_left_item"><span class="LC_nobreak">'.
+                  '<input type="text" name="'.$prefix.'_min" value="'.$min.'" size="3" '.
+                  'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                  '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
+                  '</span></td></tr>';
+    $itemcount ++;
+    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
+                  '<td class="LC_left_item"><span class="LC_nobreak">'.
+                  '<input type="text" name="'.$prefix.'_max" value="'.$max.'" size="3" '.
+                  'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                  '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
+                  '</span></td></tr>';
+    $itemcount ++;
+    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'chars'}.'<br />'.
+                  '<span class="LC_nobreak LC_fontsize_small">'.&mt('(Leave unchecked if not required)').
+                  '</span></td>';
+    my $numinrow = 2;
+    my @possrules = ('uc','lc','num','spec');
+    $datatable .= '<td class="LC_left_item"><table>';
+    for (my $i=0; $i<@possrules; $i++) {
+        my ($rem,$checked);
+        if ($chars{$possrules[$i]}) {
+            $checked = ' checked="checked"';
+        }
+        $rem = $i%($numinrow);
+        if ($rem == 0) {
+            if ($i > 0) {
+                $datatable .= '</tr>';
+            }
+            $datatable .= '<tr>';
+        }
+        $datatable .= '<td><span class="LC_nobreak"><label>'.
+                      '<input type="checkbox" name="'.$prefix.'_chars" value="'.$possrules[$i].'"'.$checked.' />'.
+                      $rulenames{$possrules[$i]}.'</label></span></td>';
+    }
+    my $rem = @possrules%($numinrow);
+    my $colsleft = $numinrow - $rem;
+    if ($colsleft > 1 ) {
+        $datatable .= '<td colspan="'.$colsleft.'" class="LC_left_item">'.
+                      '&nbsp;</td>';
+    } elsif ($colsleft == 1) {
+        $datatable .= '<td class="LC_left_item">&nbsp;</td>';
+    }
+    $datatable .='</table></td></tr>';
+    $itemcount ++;
+    if ($prefix eq 'passwords') {
+        $titles{'expire'} = &mt('Password expiration (days)');
+        $titles{'numsaved'} = &mt('Number of previous passwords to save and disallow reuse');
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'expire'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="'.$prefix.'_expire" value="'.$expire.'" size="4" '.
+                      'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no expiration)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="'.$prefix.'_numsaved" value="'.$numsaved.'" size="3" '.
+                      'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+    }
+    if (ref($itemcountref)) {
+        $$itemcountref += $itemcount;
+    }
+    return $datatable;
+}
+
 sub print_wafproxy {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my $css_class;
@@ -11071,17 +11518,27 @@ ENDSCRIPT
 }
 
 sub passwords_javascript {
-    my %intalert = &Apache::lonlocal::texthash (
-        authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
-        authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
-        passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
-        passmax => 'Warning: maximum password length must be a positive integer (or blank).',
-        passexp => 'Warning: days before password expiration must be a positive integer (or blank).',
-        passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
-    );
+    my ($prefix) = @_;
+    my %intalert;
+    if ($prefix eq 'passwords') {
+        %intalert = &Apache::lonlocal::texthash (
+            authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
+            authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
+            passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
+            passmax => 'Warning: maximum password length must be a positive integer (or blank).',
+            passexp => 'Warning: days before password expiration must be a positive integer (or blank).',
+            passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
+        );
+    } elsif ($prefix eq 'secrets') {
+        %intalert = &Apache::lonlocal::texthash (
+            passmin => 'Warning: minimum secret length must be a positive integer greater than 6.',
+            passmax => 'Warning: maximum secret length must be a positive integer (or blank).',
+        );
+    }
     &js_escape(\%intalert);
     my $defmin = $Apache::lonnet::passwdmin;
-    my $intauthjs = <<"ENDSCRIPT";
+    my $intauthjs; 
+    if ($prefix eq 'passwords') { $intauthjs = <<"ENDSCRIPT";
 
 function warnIntAuth(field) {
     if (field.name == 'intauth_check') {
@@ -11101,11 +11558,17 @@ function warnIntAuth(field) {
     return;
 }
 
-function warnIntPass(field) {
+ENDSCRIPT
+
+     }
+
+     $intauthjs .= <<"ENDSCRIPT";
+
+function warnInt$prefix(field) {
     field.value.replace(/^\s+/,'');
     field.value.replace(/\s+\$/,'');
     var regexdigit=/^\\d+\$/;
-    if (field.name == 'passwords_min') {
+    if (field.name == '${prefix}_min') {
         if (field.value == '') {
             alert('$intalert{passmin}');
             field.value = '$defmin';
@@ -11125,7 +11588,7 @@ function warnIntPass(field) {
             field.value = '';
         }
         if (field.value != '') {
-            if (field.name == 'passwords_expire') {
+            if (field.name == '${prefix}_expire') {
                 var regexpposnum=/^\\d+(|\\.\\d*)\$/; 
                 if (!regexpposnum.test(field.value)) {
                     alert('$intalert{passexp}');
@@ -11139,10 +11602,10 @@ function warnIntPass(field) {
                 }
             } else {
                 if (!regexdigit.test(field.value)) {
-                    if (field.name == 'passwords_max') {
+                    if (field.name == '${prefix}_max') {
                         alert('$intalert{passmax}');
                     } else {
-                        if (field.name == 'passwords_numsaved') {
+                        if (field.name == '${prefix}_numsaved') {
                             alert('$intalert{passnum}');
                         }
                     }
@@ -12792,13 +13255,18 @@ sub modify_colors {
             $domconfig->{$role} = {};
         }
         foreach my $img (@images) {
-            if (($role eq 'login') && (($img eq 'img') || ($img eq 'logo'))) {  
-                if (defined($env{'form.login_showlogo_'.$img})) {
-                    $confhash->{$role}{'showlogo'}{$img} = 1;
-                } else { 
-                    $confhash->{$role}{'showlogo'}{$img} = 0;
+            if ($role eq 'login') {
+                if (($img eq 'img') || ($img eq 'logo')) {  
+                    if (defined($env{'form.login_showlogo_'.$img})) {
+                        $confhash->{$role}{'showlogo'}{$img} = 1;
+                    } else { 
+                        $confhash->{$role}{'showlogo'}{$img} = 0;
+                    }
                 }
-            } 
+                if ($env{'form.login_alt_'.$img} ne '') {
+                    $confhash->{$role}{'alttext'}{$img} = $env{'form.login_alt_'.$img};
+                }
+            }
 	    if ( ! $env{'form.'.$role.'_'.$img.'.filename'} 
 		 && !defined($domconfig->{$role}{$img})
 		 && !$env{'form.'.$role.'_del_'.$img}
@@ -12873,15 +13341,29 @@ sub modify_colors {
                             $changes{$role}{'images'}{$img} = 1;
                         } 
                     }
-                    if (($role eq 'login') && (($img eq 'logo') || ($img eq 'img'))) {
-                        if (ref($domconfig->{'login'}{'showlogo'}) eq 'HASH') {
-                            if ($confhash->{$role}{'showlogo'}{$img} ne 
-                                $domconfig->{$role}{'showlogo'}{$img}) {
-                                $changes{$role}{'showlogo'}{$img} = 1; 
+                    if ($role eq 'login') {
+                        if (($img eq 'logo') || ($img eq 'img')) {
+                            if (ref($domconfig->{'login'}{'showlogo'}) eq 'HASH') {
+                                if ($confhash->{$role}{'showlogo'}{$img} ne 
+                                    $domconfig->{$role}{'showlogo'}{$img}) {
+                                    $changes{$role}{'showlogo'}{$img} = 1; 
+                                }
+                            } else {
+                                if ($confhash->{$role}{'showlogo'}{$img} == 0) {
+                                    $changes{$role}{'showlogo'}{$img} = 1;
+                                }
                             }
-                        } else {
-                            if ($confhash->{$role}{'showlogo'}{$img} == 0) {
-                                $changes{$role}{'showlogo'}{$img} = 1;
+                        }
+                        if ($img ne 'login') {
+                            if (ref($domconfig->{$role}{'alttext'}) eq 'HASH') {
+                                if ($confhash->{$role}{'alttext'}{$img} ne
+                                    $domconfig->{$role}{'alttext'}{$img}) {
+                                    $changes{$role}{'alttext'}{$img} = 1;
+                                }
+                            } else {
+                                if ($confhash->{$role}{'alttext'}{$img} ne '') {
+                                    $changes{$role}{'alttext'}{$img} = 1;
+                                }
                             }
                         }
                     }
@@ -12992,6 +13474,11 @@ sub default_change_checker {
             if ($confhash->{$role}{'showlogo'}{$img} == 0) {
                 $changes->{$role}{'showlogo'}{$img} = 1;
             }
+            if (ref($confhash->{$role}{'alttext'}) eq 'HASH') {
+                if ($confhash->{$role}{'alttext'}{$img} ne '') {
+                    $changes->{$role}{'alttext'}{$img} = 1;
+                }
+            }
         }
     }
     if ($confhash->{$role}{'font'}) {
@@ -13030,6 +13517,13 @@ sub display_colorchgs {
                             } else {
                                 $resulttext .= '<li>'.&mt("$choices{$item} set to not be displayed").'</li>';
                             }
+                        } elsif (($role eq 'login') && ($key eq 'alttext')) {
+                            if ($confhash->{$role}{$key}{$item} ne '') {
+                                $resulttext .= '<li>'.&mt("$choices{$key} for $choices{$item} set to [_1].",
+                                               $confhash->{$role}{$key}{$item}).'</li>';
+                            } else {
+                                $resulttext .= '<li>'.&mt("$choices{$key} for $choices{$item} deleted.").'</li>';
+                            }
                         } elsif ($confhash->{$role}{$item} eq '') {
                             $resulttext .= '<li>'.&mt("$choices{$item} set to default").'</li>';
                         } else {
@@ -15345,6 +15839,137 @@ sub modify_lti {
 
     my %menutitles = &ltimenu_titles();
 
+    my (%currltisec,%secchanges,%newltisec,%newltienc,%keyset,%newkeyset);
+    $newltisec{'private'}{'keys'} = [];
+    $newltisec{'encrypt'} = {};
+    $newltisec{'rules'} = {};
+    $newltisec{'linkprot'} = {};
+    if (ref($domconfig{'ltisec'}) eq 'HASH') {
+        %currltisec = %{$domconfig{'ltisec'}};
+        if (ref($currltisec{'linkprot'}) eq 'HASH') {
+            foreach my $id (keys(%{$currltisec{'linkprot'}})) {
+                unless ($id =~ /^\d+$/) {
+                    delete($currltisec{'linkprot'}{$id});
+                }
+            }
+        }
+        if (ref($currltisec{'private'}) eq 'HASH') {
+            if (ref($currltisec{'private'}{'keys'}) eq 'ARRAY') {
+                $newltisec{'private'}{'keys'} = $currltisec{'private'}{'keys'};
+                map { $keyset{$_} = 1; } @{$currltisec{'private'}{'keys'}};
+            }
+        }
+    }
+    foreach my $item ('crs','dom','consumers') {
+        my $formelement;
+        if ($item eq 'consumers') { 
+            $formelement = 'form.ltisec_'.$item;
+        } else {
+            $formelement = 'form.ltisec_'.$item.'linkprot';
+        }
+        if ($env{$formelement}) {
+            $newltisec{'encrypt'}{$item} = 1;
+            if (ref($currltisec{'encrypt'}) eq 'HASH') {
+                unless ($currltisec{'encrypt'}{$item}) {
+                    $secchanges{'encrypt'} = 1;
+                }
+            } else {
+                $secchanges{'encrypt'} = 1;
+            }
+        } elsif (ref($currltisec{'encrypt'}) eq 'HASH') {
+            if ($currltisec{'encrypt'}{$item}) {
+                $secchanges{'encrypt'} = 1;
+            }
+        }
+    }
+    unless (exists($currltisec{'rules'})) {
+        $currltisec{'rules'} = {};
+    }
+    &password_rule_changes('secrets',$newltisec{'rules'},$currltisec{'rules'},\%secchanges);
+
+    my @ids=&Apache::lonnet::current_machine_ids();
+    my %servers = &Apache::lonnet::get_servers($dom,'library');
+   
+    foreach my $hostid (keys(%servers)) {
+        if (($hostid ne '') && (grep(/^\Q$hostid\E$/,@ids))) {
+            my $newkey;
+            my $keyitem = 'form.ltisec_privkey_'.$hostid;
+            if (exists($env{$keyitem})) {
+                $env{$keyitem} =~ s/(`)/'/g;
+                if ($keyset{$hostid}) {
+                    if ($env{'form.ltisec_changeprivkey_'.$hostid}) {
+                        if ($env{$keyitem} ne '') {
+                            $secchanges{'private'} = 1;
+                            $newkeyset{$hostid} = $env{$keyitem};
+                        }
+                    }
+                } elsif ($env{$keyitem} ne '') {
+                    unless (grep(/^\Q$hostid\E$/,@{$newltisec{'private'}{'keys'}})) { 
+                        push(@{$newltisec{'private'}{'keys'}},$hostid);
+                    }
+                    $secchanges{'private'} = 1;
+                    $newkeyset{$hostid} = $env{$keyitem};
+                }
+            }
+        }
+    }
+
+    my (%linkprotchg,$linkprotoutput,$is_home);
+    my $proterror = &Apache::courseprefs::process_linkprot($dom,'',$currltisec{'linkprot'},
+                                                           \%linkprotchg,'domain');
+    my $home = &Apache::lonnet::domain($dom,'primary');
+    unless (($home eq 'no_host') || ($home eq '')) {
+        my @ids=&Apache::lonnet::current_machine_ids();
+        foreach my $id (@ids) { if ($id eq $home) { $is_home=1; } }
+    }
+
+    if (keys(%linkprotchg)) {
+        $secchanges{'linkprot'} = 1;
+        my %oldlinkprot;
+        if (ref($currltisec{'linkprot'}) eq 'HASH') {
+            %oldlinkprot = %{$currltisec{'linkprot'}};
+        }
+        foreach my $id (keys(%linkprotchg)) {
+            if (ref($linkprotchg{$id}) eq 'HASH') {
+                foreach my $inner (keys(%{$linkprotchg{$id}})) {
+                    if (($inner eq 'secret') || ($inner eq 'key')) {
+                        if ($is_home) {
+                            $newltienc{$id}{$inner} = $linkprotchg{$id}{$inner};
+                        }
+                    }
+                }
+            } else {
+                $newltisec{'linkprot'}{$id} = $linkprotchg{$id};
+            }
+        }
+        $linkprotoutput = &Apache::courseprefs::store_linkprot($dom,'','domain',\%linkprotchg,\%oldlinkprot);
+        if (keys(%linkprotchg)) {
+            %{$newltisec{'linkprot'}} = %linkprotchg;
+        }
+    }
+    if (ref($currltisec{'linkprot'}) eq 'HASH') {
+        foreach my $id (%{$currltisec{'linkprot'}}) {
+            next if ($id !~ /^\d+$/);
+            unless (exists($linkprotchg{$id})) {
+                if (ref($currltisec{'linkprot'}{$id}) eq 'HASH') {
+                    foreach my $inner (keys(%{$currltisec{'linkprot'}{$id}})) {
+                        if (($inner eq 'secret') || ($inner eq 'key')) {
+                            if ($is_home) {
+                                $newltienc{$id}{$inner} = $currltisec{'linkprot'}{$id}{$inner};
+                            }
+                        } else {
+                            $newltisec{'linkprot'}{$id}{$inner} = $currltisec{'linkprot'}{$id}{$inner};
+                        }
+                    }
+                } else {
+                    $newltisec{'linkprot'}{$id} = $currltisec{'linkprot'}{$id};
+                }
+            }
+        }
+    }
+    if ($proterror) {
+        $errors .= '<li>'.$proterror.'</li>';
+    }
     my (@items,%deletions,%itemids);
     if ($env{'form.lti_add'}) {
         my $consumer = $env{'form.lti_consumer_add'};
@@ -15410,14 +16035,14 @@ sub modify_lti {
         }
         if ($confhash{$itemid}{'requser'}) {
             if ($env{'form.lti_mapuser_'.$idx} eq 'sourcedid') {
-                $confhash{$itemid}{'mapuser'} = 'lis_person_sourcedid'; 
+                $confhash{$itemid}{'mapuser'} = 'lis_person_sourcedid';
             } elsif ($env{'form.lti_mapuser_'.$idx} eq 'email') {
                 $confhash{$itemid}{'mapuser'} = 'lis_person_contact_email_primary';
             } elsif ($env{'form.lti_mapuser_'.$idx} eq 'other') {
                 my $mapuser = $env{'form.lti_customuser_'.$idx};
                 $mapuser =~ s/(`)/'/g;
-                $mapuser =~ s/^\s+|\s+$//g; 
-                $confhash{$itemid}{'mapuser'} = $mapuser; 
+                $mapuser =~ s/^\s+|\s+$//g;
+                $confhash{$itemid}{'mapuser'} = $mapuser;
             }
             my @possmakeuser = &Apache::loncommon::get_env_multiple('form.lti_makeuser_'.$idx);
             my @makeuser;
@@ -15648,15 +16273,121 @@ sub modify_lti {
         }
     }
     my %ltihash = (
-                          $action => { %confhash }
-                       );
-    my $putresult = &Apache::lonnet::put_dom('configuration',\%ltihash,
-                                             $dom);
+                      $action => { %confhash }
+                  );
+    my %ltienchash = (
+                         $action => { %encconfig }
+                     );
+    if (keys(%secchanges)) {
+        $ltihash{'ltisec'} = \%newltisec;
+        if ($secchanges{'linkprot'}) {
+            if ($is_home) {
+                $ltienchash{'linkprot'} = \%newltienc;
+            }
+        }
+    }
+    my $putresult = &Apache::lonnet::put_dom('configuration',\%ltihash,$dom);
     if ($putresult eq 'ok') {
-        my %ltienchash = (
-                             $action => { %encconfig }
-                         );
+        my %keystore;
+        if (keys(%secchanges)) {
+            if ($secchanges{'private'}) {
+                my $who = &escape($env{'user.name'}.':'.$env{'user.domain'});
+                foreach my $hostid (keys(%newkeyset)) {
+                    my $storehash = {
+                                       key => $newkeyset{$hostid},
+                                       who => $env{'user.name'}.':'.$env{'user.domain'},
+                                    };
+                    $keystore{$hostid} = &Apache::lonnet::store_dom($storehash,'lti','private',
+                                                                    $dom,$hostid);
+                }
+            }
+            if (ref($lastactref) eq 'HASH') {
+                if (($secchanges{'encrypt'}) || ($secchanges{'private'})) {
+                    $lastactref->{'domdefaults'} = 1;
+                }
+            }
+        }
         &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom,undef,1);
+        if ((keys(%changes) == 0) && (keys(%secchanges) == 0)) {
+            return &mt('No changes made.');
+        }
+        $resulttext = &mt('Changes made:').'<ul>';
+        if (keys(%secchanges) > 0) {
+            foreach my $item (keys(%secchanges)) {
+                if ($item eq 'encrypt') {
+                    my %encrypted = (
+                              crs  => {
+                                        on => &mt('Encryption of stored link protection secrets defined in courses enabled'),
+                                        off => &mt('Encryption of stored link protection secrets defined in courses disabled'),
+                                      },
+                              dom => {
+                                       on => &mt('Encryption of stored link protection secrets defined in domain enabled'),
+                                       off => &mt('Encryption of stored link protection secrets defined in domain disabled'),
+                                     },
+                              consumers => {
+                                             on => &mt('Encryption of stored consumer secrets defined in domain enabled'),
+                                             off => &mt('Encryption of stored consumer secrets defined in domain disabled'),
+                                           },
+                            );
+                    foreach my $type ('crs','dom','consumers') {
+                        my $shown = $encrypted{$type}{'off'};
+                        if (ref($newltisec{$item}) eq 'HASH') {
+                            if ($newltisec{$item}{$type}) {
+                                $shown = $encrypted{$type}{'on'}; 
+                            }
+                        }
+                        $resulttext .= '<li>'.$shown.'</li>';
+                    } 
+                } elsif ($item eq 'rules') {
+                     my %titles = &Apache::lonlocal::texthash(
+                                      min   => 'Minimum password length',
+                                      max   => 'Maximum password length',
+                                      chars => 'Required characters',
+                     );
+                     foreach my $rule ('min','max') {
+                         if ($newltisec{rules}{$rule} eq '') {
+                             if ($rule eq 'min') {
+                                 $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
+                                                ' '.&mt('Default of [_1] will be used',
+                                                            $Apache::lonnet::passwdmin).'</li>';
+                             } else {
+                                 $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
+                             }
+                         } else {
+                             $resulttext .= '<li>'.&mt('[_1] set to [_2]',$titles{$rule},$newltisec{rules}{$rule}).'</li>';
+                         }
+                     }
+                     if (ref($newltisec{'rules'}{'chars'}) eq 'ARRAY') {
+                         if (@{$newltisec{'rules'}{'chars'}} > 0) {
+                             my %rulenames = &Apache::lonlocal::texthash(
+                                                 uc => 'At least one upper case letter',
+                                                 lc => 'At least one lower case letter',
+                                                 num => 'At least one number',
+                                                 spec => 'At least one non-alphanumeric',
+                                             );
+                             my $needed = '<ul><li>'.
+                                          join('</li><li>',map {$rulenames{$_} } @{$newltisec{'rules'}{'chars'}}).
+                                          '</li></ul>';
+                             $resulttext .= '<li>'.&mt('[_1] set to: [_2]',$titles{'chars'},$needed).'</li>';
+                         } else {
+                             $resulttext .= '<li>'.&mt('[_1] set to none',$titles{'chars'}).'</li>';
+                         }
+                     } else {
+                         $resulttext .= '<li>'.&mt('[_1] set to none',$titles{'chars'}).'</li>';
+                     }
+                } elsif ($item eq 'private') {
+                    if (keys(%newkeyset)) {
+                        foreach my $hostid (sort(keys(%newkeyset))) {
+                            if ($keystore{$hostid} eq 'ok') {
+                                $resulttext .= '<li>'.&mt('Encryption key for storage of shared secrets saved for [_1]',$hostid).'</li>';
+                            }
+                        }
+                    }
+                } elsif ($item eq 'linkprot') {
+                    $resulttext .= $linkprotoutput;
+                }
+            }
+        }
         if (keys(%changes) > 0) {
             my $cachetime = 24*60*60;
             my %ltiall = %confhash;
@@ -15671,7 +16402,6 @@ sub modify_lti {
             if (ref($lastactref) eq 'HASH') {
                 $lastactref->{'lti'} = 1;
             }
-            $resulttext = &mt('Changes made:').'<ul>';
             my %bynum;
             foreach my $itemid (sort(keys(%changes))) {
                 my $position = $confhash{$itemid}{'order'};
@@ -15848,10 +16578,8 @@ sub modify_lti {
                     $resulttext .= '</ul></li>';
                 }
             }
-            $resulttext .= '</ul>';
-        } else {
-            $resulttext = &mt('No changes made.');
         }
+        $resulttext .= '</ul>';
     } else {
         $errors .= '<li><span class="LC_error">'.&mt('Failed to save changes').'</span></li>';
     }
@@ -15918,7 +16646,7 @@ sub modify_autoenroll {
     my %title = ( run => 'Auto-enrollment active',
                   sender => 'Sender for notification messages',
                   coowners => 'Automatic assignment of co-ownership to instructors of record (institutional data)',
-                  failsafe => 'Failsafe for no drops if institutional data missing for a section');
+                  autofailsafe => 'Failsafe for no drops if institutional data missing for a section');
     my @offon = ('off','on');
     my $sender_uname = $env{'form.sender_uname'};
     my $sender_domain = $env{'form.sender_domain'};
@@ -15928,17 +16656,23 @@ sub modify_autoenroll {
         $sender_domain = '';
     }
     my $coowners = $env{'form.autoassign_coowners'};
+    my $autofailsafe = $env{'form.autoenroll_autofailsafe'};
+    $autofailsafe =~ s{^\s+|\s+$}{}g;
+    if ($autofailsafe =~ /\D/) {
+        undef($autofailsafe);
+    }
     my $failsafe = $env{'form.autoenroll_failsafe'};
-    $failsafe =~ s{^\s+|\s+$}{}g;
-    if ($failsafe =~ /\D/) {
-        undef($failsafe);
+    unless (($failsafe eq 'zero') || ($failsafe eq 'any')) {
+        $failsafe = 'off';
+        undef($autofailsafe);
     }
     my %autoenrollhash =  (
                        autoenroll => { 'run' => $env{'form.autoenroll_run'},
                                        'sender_uname' => $sender_uname,
                                        'sender_domain' => $sender_domain,
                                        'co-owners' => $coowners,
-                                       'autofailsafe' => $failsafe,
+                                       'autofailsafe' => $autofailsafe,
+                                       'failsafe' => $failsafe,
                                 }
                      );
     my $putresult = &Apache::lonnet::put_dom('configuration',\%autoenrollhash,
@@ -15966,9 +16700,12 @@ sub modify_autoenroll {
         } elsif ($coowners) {
             $changes{'coowners'} = 1;
         }
-        if ($currautoenroll{'autofailsafe'} ne $failsafe) {
+        if ($currautoenroll{'autofailsafe'} ne $autofailsafe) {
             $changes{'autofailsafe'} = 1;
         }
+        if ($currautoenroll{'failsafe'} ne $failsafe) {
+            $changes{'failsafe'} = 1;
+        }
         if (keys(%changes) > 0) {
             $resulttext = &mt('Changes made:').'<ul>';
             if ($changes{'run'}) {
@@ -15989,11 +16726,24 @@ sub modify_autoenroll {
                 }
             }
             if ($changes{'autofailsafe'}) {
-                if ($failsafe ne '') {
-                    $resulttext .= '<li>'.&mt('Failsafe for no drops if institutional data missing for a section set to: [_1]',$failsafe).'</li>';
+                if ($autofailsafe ne '') {
+                    $resulttext .= '<li>'.&mt('Failsafe for no drops if institutional data missing for a section set to: [_1]',$autofailsafe).'</li>';
+                } else {
+                    $resulttext .= '<li>'.&mt('Failsafe for no drops if institutional data missing for a section not in use').'</li>';
+                }
+            }
+            if ($changes{'failsafe'}) {
+                if ($failsafe eq 'off') {
+                    unless ($changes{'autofailsafe'}) {
+                        $resulttext .= '<li>'.&mt('Failsafe for no drops if institutional data missing for a section not in use').'</li>';
+                    }
+                } elsif ($failsafe eq 'zero') {
+                    $resulttext .= '<li>'.&mt('Failsafe applies if retrieved section enrollment is zero').'</li>';
                 } else {
-                    $resulttext .= '<li>'.&mt('Failsafe for no drops if institutional data missing for a section: deleted');
+                    $resulttext .= '<li>'.&mt('Failsafe applies if retrieved section enrollment is zero or greater').'</li>';
                 }
+            }
+            if (($changes{'autofailsafe'}) || ($changes{'failsafe'})) {
                 &Apache::lonnet::get_domain_defaults($dom,1);
                 if (ref($lastactref) eq 'HASH') {
                     $lastactref->{'domdefaults'} = 1;
@@ -17555,61 +18305,7 @@ sub modify_passwords {
             $updatedefaults = 1;
         }
     }
-    foreach my $rule ('min','max','expire','numsaved') {
-        $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
-        my $ruleok;
-        if ($rule eq 'expire') {
-            if (($env{'form.passwords_'.$rule} =~ /^\d+(|\.\d*)$/) &&
-                ($env{'form.passwords_'.$rule} ne '0')) {
-                $ruleok = 1;
-            }
-        } elsif ($rule eq 'min') {
-            if ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
-                if ($env{'form.passwords_'.$rule} >= $Apache::lonnet::passwdmin) {
-                    $ruleok = 1;
-                }
-            }
-        } elsif (($env{'form.passwords_'.$rule} =~ /^\d+$/) &&
-                 ($env{'form.passwords_'.$rule} ne '0')) {
-            $ruleok = 1;
-        }
-        if ($ruleok) {
-            $newvalues{$rule} = $env{'form.passwords_'.$rule};
-            if (exists($current{$rule})) {
-                if ($newvalues{$rule} ne $current{$rule}) {
-                    $changes{'rules'} = 1;
-                }
-            } elsif ($rule eq 'min') {
-                if ($staticdefaults{$rule} ne $newvalues{$rule}) {
-                    $changes{'rules'} = 1;
-                }
-            } else {
-                $changes{'rules'} = 1;
-            }
-        } elsif (exists($current{$rule})) {
-            $changes{'rules'} = 1;
-        }
-    }
-    my @posschars = &Apache::loncommon::get_env_multiple('form.passwords_chars');
-    my @chars;
-    foreach my $item (sort(@posschars)) {
-        if ($item =~ /^(uc|lc|num|spec)$/) {
-            push(@chars,$item);
-        }
-    }
-    $newvalues{'chars'} = \@chars;
-    unless ($changes{'rules'}) {
-        if (ref($current{'chars'}) eq 'ARRAY') {
-            my @diffs = &Apache::loncommon::compare_arrays($current{'chars'},\@chars);
-            if (@diffs > 0) {
-                $changes{'rules'} = 1;
-            }
-        } else {
-            if (@chars > 0) {
-                $changes{'rules'} = 1;
-            }
-        }
-    }
+    &password_rule_changes('passwords',\%newvalues,\%current,\%changes);
     my %crsownerchg = (
                         by => [],
                         for => [],
@@ -17869,6 +18565,76 @@ sub modify_passwords {
     return $resulttext;
 }
 
+sub password_rule_changes {
+    my ($prefix,$newvalues,$current,$changes) = @_;
+    return unless ((ref($newvalues) eq 'HASH') &&
+                   (ref($current) eq 'HASH') &&
+                   (ref($changes) eq 'HASH'));
+    my (@rules,%staticdefaults);
+    if ($prefix eq 'passwords') {
+        @rules = ('min','max','expire','numsaved');
+    } elsif ($prefix eq 'secrets') {
+        @rules = ('min','max');
+    }
+    $staticdefaults{'min'} = $Apache::lonnet::passwdmin;
+    foreach my $rule (@rules) {
+        $env{'form.'.$prefix.'_'.$rule} =~ s/^\s+|\s+$//g;
+        my $ruleok;
+        if ($rule eq 'expire') {
+            if (($env{'form.'.$prefix.'_'.$rule} =~ /^\d+(|\.\d*)$/) &&
+                ($env{'form.'.$prefix.'_'.$rule} ne '0')) {
+                $ruleok = 1;
+            }
+        } elsif ($rule eq 'min') {
+            if ($env{'form.'.$prefix.'_'.$rule} =~ /^\d+$/) {
+                if ($env{'form.'.$prefix.'_'.$rule} >= $staticdefaults{$rule}) {
+                    $ruleok = 1;
+                }
+            }
+        } elsif (($env{'form.'.$prefix.'_'.$rule} =~ /^\d+$/) &&
+                 ($env{'form.'.$prefix.'_'.$rule} ne '0')) {
+            $ruleok = 1;
+        }
+        if ($ruleok) {
+            $newvalues->{$rule} = $env{'form.'.$prefix.'_'.$rule};
+            if (exists($current->{$rule})) {
+                if ($newvalues->{$rule} ne $current->{$rule}) {
+                    $changes->{'rules'} = 1;
+                }
+            } elsif ($rule eq 'min') {
+                if ($staticdefaults{$rule} ne $newvalues->{$rule}) {
+                    $changes->{'rules'} = 1;
+                }
+            } else {
+                $changes->{'rules'} = 1;
+            }
+        } elsif (exists($current->{$rule})) {
+            $changes->{'rules'} = 1;
+        }
+    }
+    my @posschars = &Apache::loncommon::get_env_multiple('form.'.$prefix.'_chars');
+    my @chars;
+    foreach my $item (sort(@posschars)) {
+        if ($item =~ /^(uc|lc|num|spec)$/) {
+            push(@chars,$item);
+        }
+    }
+    $newvalues->{'chars'} = \@chars;
+    unless ($changes->{'rules'}) {
+        if (ref($current->{'chars'}) eq 'ARRAY') {
+            my @diffs = &Apache::loncommon::compare_arrays($current->{'chars'},\@chars);
+            if (@diffs > 0) {
+                $changes->{'rules'} = 1;
+            }
+        } else {
+            if (@chars > 0) {
+                $changes->{'rules'} = 1;
+            }
+        }
+    }
+    return;
+}
+
 sub modify_usercreation {
     my ($dom,%domconfig) = @_;
     my ($resulttext,%curr_usercreation,%changes,%authallowed,%cancreate,%save_usercreate);
@@ -20311,8 +21077,9 @@ sub modify_coursedefaults {
                            'uselcmath'       => 'on',
                            'usejsme'         => 'on',
                            'inline_chem'     => 'on',
+                           'ltiauth'         => 'off',
                          );
-    my @toggles = ('canuse_pdfforms','uselcmath','usejsme','inline_chem');
+    my @toggles = ('canuse_pdfforms','uselcmath','usejsme','inline_chem','ltiauth');
     my @numbers = ('anonsurvey_threshold','uploadquota_official','uploadquota_unofficial',
                    'uploadquota_community','uploadquota_textbook','uploadquota_placement',
                    'mysqltables_official','mysqltables_unofficial','mysqltables_community',
@@ -20523,8 +21290,8 @@ sub modify_coursedefaults {
             if (($changes{'canuse_pdfforms'}) || ($changes{'uploadquota'}) || ($changes{'postsubmit'}) ||
                 ($changes{'coursecredits'}) || ($changes{'uselcmath'}) || ($changes{'usejsme'}) ||
                 ($changes{'canclone'}) || ($changes{'mysqltables'}) || ($changes{'texengine'}) ||
-                ($changes{'inline_chem'})) {
-                foreach my $item ('canuse_pdfforms','uselcmath','usejsme','inline_chem','texengine') {
+                ($changes{'inline_chem'}) || ($changes{'ltiauth'})) {
+                foreach my $item ('canuse_pdfforms','uselcmath','usejsme','inline_chem','texengine','ltiauth') {
                     if ($changes{$item}) {
                         $domdefaults{$item}=$defaultshash{'coursedefaults'}{$item};
                     }
@@ -20698,6 +21465,12 @@ sub modify_coursedefaults {
                     } else {
                         $resulttext .= '<li>'.&mt('By default, only course owner and coordinators may clone a course.').'</li>';
                     }
+                } elsif ($item eq 'ltiauth') {
+                    if ($env{'form.'.$item} eq '1') {
+                        $resulttext .= '<li>'.&mt('LTI launch of deep-linked URL need not require re-authentication').'</li>';
+                    } else {
+                        $resulttext .= '<li>'.&mt('LTI launch of deep-linked URL will require re-authentication').'</li>';
+                    }
                 }
             }
             $resulttext .= '</ul>';
@@ -21169,7 +21942,7 @@ sub modify_wafproxy {
                 }
             }
             $output = &mt('Changes were made to Web Application Firewall/Reverse Proxy').'<ul>';
-            foreach my $item ('alias','remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
+            foreach my $item ('alias','saml','remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
                 if ($changes{$item}) {
                     if ($item eq 'alias') {
                         my $numaliased = 0;