--- loncom/interface/domainprefs.pm	2019/04/01 17:24:45	1.351
+++ loncom/interface/domainprefs.pm	2020/02/05 23:46:01	1.369
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.351 2019/04/01 17:24:45 raeburn Exp $
+# $Id: domainprefs.pm,v 1.369 2020/02/05 23:46:01 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -219,7 +219,7 @@ sub handler {
                 'serverstatuses','requestcourses','helpsettings',
                 'coursedefaults','usersessions','loadbalancing',
                 'requestauthor','selfenrollment','inststatus',
-                'ltitools','ssl','trust','lti'],$dom);
+                'ltitools','ssl','trust','lti','privacy','passwords'],$dom);
     my %encconfig =
         &Apache::lonnet::get_dom('encconfig',['ltitools','lti'],$dom);
     if (ref($domconfig{'ltitools'}) eq 'HASH') {
@@ -246,8 +246,8 @@ sub handler {
             }
         }
     }
-    my @prefs_order = ('rolecolors','login','defaults','quotas','autoenroll',
-                       'autoupdate','autocreate','directorysrch','contacts',
+    my @prefs_order = ('rolecolors','login','defaults','passwords','quotas','autoenroll',
+                       'autoupdate','autocreate','directorysrch','contacts','privacy',
                        'usercreation','selfcreation','usermodification','scantron',
                        'requestcourses','requestauthor','coursecategories',
                        'serverstatuses','helpsettings','coursedefaults',
@@ -291,13 +291,25 @@ sub handler {
                       help => 'Domain_Configuration_LangTZAuth',
                       header => [{col1 => 'Setting',
                                   col2 => 'Value'},
-                                 {col1 => 'Internal Authentication',
-                                  col2 => 'Value'},
                                  {col1 => 'Institutional user types',
                                   col2 => 'Name displayed'}],
                       print => \&print_defaults,
                       modify => \&modify_defaults,
                     },
+        'passwords' =>
+                    { text => 'Passwords (Internal authentication)',
+                      help => 'Domain_Configuration_Passwords',
+                      header => [{col1 => 'Resetting Forgotten Password',
+                                  col2 => 'Settings'},
+                                 {col1 => 'Encryption of Stored Passwords (Internal Auth)',
+                                  col2 => 'Settings'},
+                                 {col1 => 'Rules for LON-CAPA Passwords',
+                                  col2 => 'Settings'},
+                                 {col1 => 'Course Owner Changing Student Passwords',
+                                  col2 => 'Settings'}],
+                      print => \&print_passwords,
+                      modify => \&modify_passwords,
+                    },
         'quotas' => 
                     { text => 'Blogs, personal web pages, webDAV/quotas, portfolios',
                       help => 'Domain_Configuration_Quotas',
@@ -485,10 +497,16 @@ sub handler {
                   modify => \&modify_selfenrollment,
                  },
         'privacy' => 
-                 {text   => 'User Privacy',
+                 {text   => 'Availability of User Information',
                   help   => 'Domain_Configuration_User_Privacy',
-                  header => [{col1 => 'Setting',
-                              col2 => 'Value',}],
+                  header => [{col1 => 'Role assigned in different domain',
+                              col2 => 'Approval options'},
+                             {col1 => 'Role assigned in different domain to user of type',
+                              col2 => 'User information available in that domain'},
+                             {col1 => "Role assigned in user's domain",
+                              col2 => 'Information viewable by privileged user'},
+                             {col1 => "Role assigned in user's domain",
+                              col2 => 'Information viewable by unprivileged user'}],
                   print => \&print_privacy,
                   modify => \&modify_privacy,
                  },
@@ -759,6 +777,10 @@ sub process_changes {
         $output = &modify_trust($dom,$lastactref,%domconfig);
     } elsif ($action eq 'lti') {
         $output = &modify_lti($r,$dom,$action,$lastactref,%domconfig);
+    } elsif ($action eq 'privacy') {
+        $output = &modify_privacy($dom,%domconfig);
+    } elsif ($action eq 'passwords') {
+        $output = &modify_passwords($r,$dom,$confname,$lastactref,%domconfig);
     }
     return $output;
 }
@@ -771,6 +793,8 @@ sub print_config_box {
         $output = &coursecategories_javascript($settings);
     } elsif ($action eq 'defaults') {
         $output = &defaults_javascript($settings); 
+    } elsif ($action eq 'passwords') {
+        $output = &passwords_javascript();
     } elsif ($action eq 'helpsettings') {
         my (%privs,%levelscurrent);
         my %full=();
@@ -807,6 +831,7 @@ sub print_config_box {
     if ($numheaders > 1) {
         my $colspan = '';
         my $rightcolspan = '';
+        my $leftnobr = '';
         if (($action eq 'rolecolors') || ($action eq 'defaults') ||
             ($action eq 'directorysrch') ||
             (($action eq 'login') && ($numheaders < 4))) {
@@ -815,12 +840,15 @@ sub print_config_box {
         if ($action eq 'usersessions') {
             $rightcolspan = ' colspan="3"'; 
         }
+        if ($action eq 'passwords') {
+            $leftnobr = ' LC_nobreak';
+        }
         $output .= '
           <tr>
            <td>
             <table class="LC_nested">
              <tr class="LC_info_row">
-              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[0]->{'col1'}).'</td>
+              <td class="LC_left_item'.$leftnobr.'"'.$colspan.'>'.&mt($item->{'header'}->[0]->{'col1'}).'</td>
               <td class="LC_right_item"'.$rightcolspan.'>'.&mt($item->{'header'}->[0]->{'col2'}).'</td>
              </tr>';
         $rowtotal ++;
@@ -828,8 +856,10 @@ sub print_config_box {
             ($action eq 'usermodification') || ($action eq 'defaults') || ($action eq 'coursedefaults') ||
             ($action eq 'selfenrollment') || ($action eq 'usersessions') || ($action eq 'ssl') ||
             ($action eq 'directorysrch') || ($action eq 'trust') || ($action eq 'helpsettings') ||
-            ($action eq 'contacts')) {
+            ($action eq 'contacts') || ($action eq 'privacy')) {
             $output .= $item->{'print'}->('top',$dom,$settings,\$rowtotal);
+        } elsif ($action eq 'passwords') {
+            $output .= $item->{'print'}->('top',$dom,$confname,$settings,\$rowtotal);
         } elsif ($action eq 'coursecategories') {
             $output .= $item->{'print'}->('top',$dom,$item,$settings,\$rowtotal);
         } elsif ($action eq 'scantron') {
@@ -861,12 +891,16 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') ||
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') || 
-            ($action eq 'trust') || ($action eq 'contacts') || ($action eq 'defaults')) {
+            ($action eq 'trust') || ($action eq 'contacts') ||
+            ($action eq 'privacy') || ($action eq 'passwords')) {
+            my $leftnobr = ' LC_nobreak';
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
             } elsif ($action eq 'trust') {
                 $output .= $item->{'print'}->('shared',$dom,$settings,\$rowtotal);
+            } elsif ($action eq 'passwords') {
+                $output .= $item->{'print'}->('middle',$dom,$confname,$settings,\$rowtotal);
             } else {
                 $output .= $item->{'print'}->('middle',$dom,$settings,\$rowtotal);
             }
@@ -912,8 +946,13 @@ sub print_config_box {
              </tr>'."\n";
                 if ($action eq 'coursecategories') {
                     $output .= &print_coursecategories('bottom',$dom,$item,$settings,\$rowtotal);
-                } elsif ($action eq 'contacts') {
-                    $output .= $item->{'print'}->('lower',$dom,$settings,\$rowtotal).'
+                } elsif (($action eq 'contacts') || ($action eq 'privacy') || ($action eq 'passwords')) {
+                    if ($action eq 'passwords') {
+                        $output .= $item->{'print'}->('lower',$dom,$confname,$settings,\$rowtotal);
+                    } else {
+                        $output .= $item->{'print'}->('lower',$dom,$settings,\$rowtotal);
+                    }
+                    $output .= '
              </tr>
             </table>
            </td>
@@ -922,9 +961,14 @@ sub print_config_box {
            <td>
             <table class="LC_nested">
              <tr class="LC_info_row">
-              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
-              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td></tr>'.
-                           $item->{'print'}->('bottom',$dom,$settings,\$rowtotal).'
+              <td class="LC_left_item'.$leftnobr.'"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
+              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td></tr>'."\n";
+                    if ($action eq 'passwords') {
+                        $output .= $item->{'print'}->('bottom',$dom,$confname,$settings,\$rowtotal);
+                    } else {
+                        $output .= $item->{'print'}->('bottom',$dom,$settings,\$rowtotal);
+                    }
+                    $output .= '
             </table>
           </td>
          </tr>
@@ -2857,7 +2901,7 @@ function toggleLTI(form,setting,item) {
                         }
                     }
                 }
-                for (var j=0; j<fieldsets.length; j++) { 
+                for (var j=0; j<fieldsets.length; j++) {
                     if (setvis) {
                         fieldsets[j].style.display = 'block';
                     } else {
@@ -2866,7 +2910,7 @@ function toggleLTI(form,setting,item) {
                 }
             }
         }
-    } else if ((setting == 'user') || (setting == 'crs') || (setting == 'passback')) {
+    } else if ((setting == 'user') || (setting == 'crs') || (setting == 'passback') || (setting == 'callback')) {
         var radioname = '';
         var divid = '';
         if (setting == 'user') {
@@ -2875,6 +2919,9 @@ function toggleLTI(form,setting,item) {
         } else if (setting == 'crs') {
             radioname = 'lti_mapcrs_'+item;
             divid = 'lti_crsfield_'+item;
+        } else if (setting == 'callback') {
+            radioname = 'lti_callback_'+item;
+            divid = 'lti_callbackfield_'+item;
         } else {
             radioname = 'lti_passback_'+item;
             divid =  'lti_passback_'+item;
@@ -2884,7 +2931,7 @@ function toggleLTI(form,setting,item) {
             var setvis = '';
             for (var i=0; i<num; i++) {
                if (form.elements[radioname][i].checked) {
-                   if (setting == 'passback') {
+                   if ((setting == 'passback') || (setting == 'callback')) {
                        if (form.elements[radioname][i].value == '1') {
                            if (document.getElementById(divid)) {
                                document.getElementById(divid).style.display = 'inline-block';
@@ -4815,7 +4862,7 @@ sub print_lti {
             if (!$requser) {
                 $checkedrequser{'no'} = $checkedrequser{'yes'};
                 $checkedrequser{'yes'} = '';
-            } 
+            }
             my $chgstr = ' onchange="javascript:reorderLTI(this.form,'."'lti_pos_".$item."'".');"';
             $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'
                          .'<select name="lti_pos_'.$item.'"'.$chgstr.'>';
@@ -4918,7 +4965,7 @@ sub lti_names {
 
 sub lti_options {
     my ($num,$current,$itemcount,%lt) = @_;
-    my (%checked,%rolemaps,$crssecsrc,$userfield,$cidfield);
+    my (%checked,%rolemaps,$crssecsrc,$userfield,$cidfield,$callback);
     $checked{'mapuser'}{'sourcedid'} = ' checked="checked"';
     $checked{'mapcrs'}{'course_offering_sourcedid'} = ' checked="checked"';
     $checked{'makecrs'}{'N'} = '  checked="checked"';
@@ -4936,6 +4983,7 @@ sub lti_options {
     my $crsfieldsty = 'none';
     my $crssecfieldsty = 'none';
     my $secsrcfieldsty = 'none';
+    my $callbacksty = 'none';
     my $passbacksty = 'none';
     my $optionsty = 'block';
     my $lcauthparm;
@@ -5015,6 +5063,13 @@ sub lti_options {
         } else {
             $checked{'crssec'}{'N'} = ' checked="checked"';
         }
+        if ($current->{'callback'} ne '') {
+            $callback = $current->{'callback'};
+            $checked{'callback'}{'Y'} = ' checked="checked"';
+            $callbacksty = 'inline-block';
+        } else {
+            $checked{'callback'}{'N'} = ' checked="checked"';
+        }
         if ($current->{'topmenu'}) {
             $checked{'topmenu'}{'Y'} = ' checked="checked"';
         } else {
@@ -5040,6 +5095,7 @@ sub lti_options {
     } else {
         $checked{'makecrs'}{'N'} = ' checked="checked"';
         $checked{'crssec'}{'N'} = ' checked="checked"';
+        $checked{'callback'}{'N'} = ' checked="checked"';
         $checked{'topmenu'}{'N'} = ' checked="checked"';
         $checked{'inlinemenu'}{'Y'} = ' checked="checked"'; 
         $checked{'menuitem'}{'grades'} = ' checked="checked"';
@@ -5068,6 +5124,7 @@ sub lti_options {
     my $onclickuser = ' onclick="toggleLTI(this.form,'."'user','$num'".');"';
     my $onclickcrs = ' onclick="toggleLTI(this.form,'."'crs','$num'".');"';
     my $onclicksec = ' onclick="toggleLTI(this.form,'."'sec','$num'".');"';
+    my $onclickcallback = ' onclick="toggleLTI(this.form,'."'callback','$num'".');"';
     my $onclicksecsrc = ' onclick="toggleLTI(this.form,'."'secsrc','$num'".')"';
     my $onclicklcauth = ' onclick="toggleLTI(this.form,'."'lcauth','$num'".')"';
     my $onclickmenu = ' onclick="toggleLTI(this.form,'."'lcmenu','$num'".');"';
@@ -5217,7 +5274,17 @@ sub lti_options {
                '<label><input type="radio" name="lti_passbackformat_'.$num.'" value="1.1"'.$pb1p1chk.' />'.
                &mt('Outcomes Service (1.1)').'</label>'.('&nbsp;'x2).
                '<label><input type="radio" name="lti_passbackformat_'.$num.'" value="1.0"'.$pb1p0chk.'/>'.
-               &mt('Outcomes Extension (1.0)').'</label></span></div></fieldset>'.
+               &mt('Outcomes Extension (1.0)').'</label></span></div>'.
+               '<div style="padding:0;clear:both;margin:0;border:0"></div>'.
+               '<div class="LC_floatleft"><span class="LC_nobreak">'.&mt('Callback on logout').':&nbsp;'.
+               '<label><input type="radio" name="lti_callback_'.$num.'" value="0"'.
+               $checked{'callback'}{'N'}.$onclickcallback.' />'.&mt('No').'</label>'.('&nbsp;'x2).
+               '<label><input type="radio" name="lti_callback_'.$num.'" value="1"'.
+               $checked{'callback'}{'Y'}.$onclickcallback.' />'.&mt('Yes').'</label></span></div>'.
+               '<div class="LC_floatleft" style="display:'.$callbacksty.';" id="lti_callbackfield_'.$num.'">'.
+               '<span class="LC_nobreak">'.&mt('Parameter').': '.
+               '<input type="text" name="lti_callbackparam_'.$num.'" value="'.$callback.'" /></span>'.
+               '</div><div style="padding:0;clear:both;margin:0;border:0"></div></fieldset>'.
                '<fieldset class="ltioption_'.$num.'" style="display:'.$optionsty.'"><legend>'.&mt('Course defaults (Course Coordinator can override)').'</legend>'.
                '<div class="LC_floatleft"><span class="LC_nobreak">'.$lt{'topmenu'}.':&nbsp;'.
                '<label><input type="radio" name="lti_topmenu_'.$num.'" value="0"'.
@@ -5770,6 +5837,577 @@ sub print_validation_rows {
     return $datatable;
 }
 
+sub print_privacy {
+    my ($position,$dom,$settings,$rowtotal) = @_;
+    my ($datatable,$css_class,$numinrow,@items,%names,$othertitle,$usertypes,$types);
+    my $itemcount = 0;
+    unless ($position eq 'top') {
+        @items = ('domain','author','course','community');
+        %names = &Apache::lonlocal::texthash (
+                     domain => 'Assigned domain role(s)',
+                     author => 'Assigned co-author role(s)',
+                     course => 'Assigned course role(s)',
+                     community => 'Assigned community role',
+                 );
+        $numinrow = 4;
+        ($othertitle,$usertypes,$types) =
+            &Apache::loncommon::sorted_inst_types($dom);
+    }
+    if (($position eq 'top') || ($position eq 'middle')) {
+        my (%by_ip,%by_location,@intdoms,@instdoms);
+        &build_location_hashes(\@intdoms,\%by_ip,\%by_location,\@instdoms);
+        if ($position eq 'top') {
+            my %curr;
+            my @options = ('none','user','domain','auto');
+            my %titles = &Apache::lonlocal::texthash (
+                none   => 'Not allowed',
+                user   => 'User authorizes',
+                domain => 'DC authorizes',
+                auto   => 'Unrestricted',
+                instdom => 'Other domain shares institution/provider',
+                extdom => 'Other domain has different institution/provider',
+            );
+            my %names = &Apache::lonlocal::texthash (
+                domain => 'Domain role',
+                author => 'Co-author role',
+                course => 'Course role',
+                community => 'Community role',
+            );
+            my $primary_id = &Apache::lonnet::domain($dom,'primary');
+            my $intdom = &Apache::lonnet::internet_dom($primary_id);
+            foreach my $domtype ('instdom','extdom') {
+                my (%checked,$skip);
+                $css_class = $itemcount%2?' class="LC_odd_row"':'';
+                $datatable .= '<tr'.$css_class.'><td>'.$titles{$domtype}.'</td>'.
+                              '<td class="LC_left_item">';
+                if ($domtype eq 'instdom') {
+                    unless (@instdoms > 1) {
+                        $datatable .= &mt('Nothing to set, as no domains besides [_1] are hosted by [_2]',$dom,$intdom);
+                        $skip = 1;
+                    }
+                } elsif ($domtype eq 'extdom') {
+                    if (keys(%by_location) == 0) {
+                        $datatable .= &mt('Nothing to set, as no other hosts besides [_1]',$intdom);
+                        $skip = 1;
+                    }
+                }
+                unless ($skip) {
+                    foreach my $roletype ('domain','author','course','community') {
+                        $checked{'auto'} = ' checked="checked"';
+                        if (ref($settings) eq 'HASH') {
+                            if (ref($settings->{approval}) eq 'HASH') {
+                                if (ref($settings->{approval}->{$domtype}) eq 'HASH') {
+                                    if ($settings->{approval}->{$domtype}->{$roletype}=~ /^(none|user|domain)$/) {
+                                        $checked{$1} = ' checked="checked"';
+                                        $checked{'auto'} = '';
+                                    }
+                                }
+                            }
+                        }
+                        $datatable .= '<fieldset><legend>'.$names{$roletype}.'</legend>';
+                        foreach my $option (@options) {
+                            $datatable .= '<span class="LC_nobreak"><label>'.
+                                          '<input type="radio" name="privacy_approval_'.$domtype.'_'.$roletype.'" '.
+                                          'value="'.$option.'"'.$checked{$option}.' />'.$titles{$option}.
+                                          '</label></span>&nbsp; ';
+                        }
+                        $datatable .= '</fieldset>';
+                    }
+                }
+                $datatable .= '</td></tr>';
+                $itemcount ++;
+            }
+        } elsif ($position eq 'middle') {
+            if ((@instdoms > 1) || (keys(%by_location) > 0)) {
+                if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                    foreach my $item (@{$types}) {
+                        $datatable .= &modifiable_userdata_row('privacy','othdom_'.$item,$settings,
+                                                               $numinrow,$itemcount,'','','','','',
+                                                               '',$usertypes->{$item});
+                        $itemcount ++;
+                    }
+                }
+                $datatable .= &modifiable_userdata_row('privacy','othdom_default',$settings,
+                                                       $numinrow,$itemcount,'','','','','',
+                                                       '',$othertitle);
+                $itemcount ++;
+            } else {
+                my (@insttypes,%insttitles);
+                if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                    @insttypes = @{$types};
+                    %insttitles = %{$usertypes};
+                }
+                foreach my $item (@insttypes,'default') {
+                    my $title;
+                    if ($item eq 'default') {
+                        $title = $othertitle;
+                    } else {
+                        $title = $insttitles{$item};
+                    }
+                    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+                    $datatable .= '<tr'.$css_class.'>'.
+                                  '<td class="LC_left_item">'.$title.'</td>'.
+                                  '<td class="LC_left_item">'.
+                                  &mt('Nothing to set here, as there are no other domains').
+                                  '</td></tr>';
+                    $itemcount ++;
+                }
+            }
+        }
+    } else {
+        my $prefix;
+        if ($position eq 'lower') {
+            $prefix = 'priv';
+        } else {
+            $prefix = 'unpriv';
+        }
+        foreach my $item (@items) {
+            $datatable .= &modifiable_userdata_row('privacy',$prefix.'_'.$item,$settings,
+                                                   $numinrow,$itemcount,'','','','','',
+                                                   '',$names{$item});
+            $itemcount ++;
+        }
+    }
+    if (ref($rowtotal)) {
+        $$rowtotal += $itemcount;
+    }
+    return $datatable;
+}
+
+sub print_passwords {
+    my ($position,$dom,$confname,$settings,$rowtotal) = @_;
+    my ($datatable,$css_class);
+    my $itemcount = 0;
+    my %titles = &Apache::lonlocal::texthash (
+        captcha        => '"Forgot Password" CAPTCHA validation',
+        link           => 'Reset link expiration (hours)',
+        case           => 'Case-sensitive usernames/e-mail',
+        prelink        => 'Information required (form 1)',
+        postlink       => 'Information required (form 2)',
+        emailsrc       => 'LON-CAPA e-mail address type(s)',
+        customtext     => 'Domain specific text (HTML)',
+        intauth_cost   => 'Encryption cost for bcrypt (positive integer)',
+        intauth_check  => 'Check bcrypt cost if authenticated',
+        intauth_switch => 'Existing crypt-based switched to bcrypt on authentication',
+        permanent      => 'Permanent e-mail address',
+        critical       => 'Critical notification address',
+        notify         => 'Notification address',
+        min            => 'Minimum password length',
+        max            => 'Maximum password length',
+        chars          => 'Required characters',
+        expire         => 'Password expiration (days)',
+        numsaved       => 'Number of previous passwords to save and disallow reuse',
+    );
+    if ($position eq 'top') {
+        my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
+        my $shownlinklife = 2;
+        my $prelink = 'both';
+        my (%casesens,%postlink,%emailsrc,$nostdtext,$customurl);
+        if (ref($settings) eq 'HASH') {
+            if ($settings->{resetlink} =~ /^\d+(|\.\d*)$/) {
+                $shownlinklife = $settings->{resetlink};
+            }
+            if (ref($settings->{resetcase}) eq 'ARRAY') {
+                map { $casesens{$_} = 1; } (@{$settings->{resetcase}});
+            }
+            if ($settings->{resetprelink} =~ /^(both|either)$/) {
+                $prelink = $settings->{resetprelink};
+            }
+            if (ref($settings->{resetpostlink}) eq 'HASH') {
+                %postlink = %{$settings->{resetpostlink}};
+            }
+            if (ref($settings->{resetemail}) eq 'ARRAY') {
+                map { $emailsrc{$_} = 1; } (@{$settings->{resetemail}});
+            }
+            if ($settings->{resetremove}) {
+                $nostdtext = 1;
+            }
+            if ($settings->{resetcustom}) {
+                $customurl = $settings->{resetcustom};
+            }
+        } else {
+            if (ref($types) eq 'ARRAY') {
+                foreach my $item (@{$types}) {
+                    $casesens{$item} = 1;
+                    $postlink{$item} = ['username','email'];
+                }
+            }
+            $casesens{'default'} = 1;
+            $postlink{'default'} = ['username','email'];
+            $prelink = 'both';
+            %emailsrc = (
+                          permanent => 1,
+                          critical  => 1,
+                          notify    => 1,
+            );
+        }
+        $datatable = &captcha_choice('passwords',$settings,$$rowtotal);
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'link'}.'</td>'.
+                      '<td class="LC_left_item">'.
+                      '<input type="textbox" value="'.$shownlinklife.'" '.
+                      'name="passwords_link" size="3" /></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'case'}.'</td>'.
+                      '<td class="LC_left_item">';
+        if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+            foreach my $item (@{$types}) {
+                my $checkedcase;
+                if ($casesens{$item}) {
+                    $checkedcase = ' checked="checked"';
+                }
+                $datatable .= '<span class="LC_nobreak"><label>'.
+                              '<input type="checkbox" name="passwords_case_sensitive" value="'.
+                              $item.'"'.$checkedcase.' />'.$usertypes->{$item}.'</label>'.
+                              '</span>&nbsp;&nbsp; ';
+            }
+        }
+        my $checkedcase;
+        if ($casesens{'default'}) {
+            $checkedcase = ' checked="checked"';
+        }
+        $datatable .= '<span class="LC_nobreak"><label><input type="checkbox" '.
+                      'name="passwords_case_sensitive" value="default"'.$checkedcase.' />'.
+                      $othertitle.'</label></span></td>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        my %checkedpre = (
+                             both => ' checked="checked"',
+                             either => '',
+                         );
+        if ($prelink eq 'either') {
+            $checkedpre{either} = ' checked="checked"';
+            $checkedpre{both} = '';
+        }
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'prelink'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<label><input type="radio" name="passwords_prelink" value="both"'.$checkedpre{'both'}.' />'.
+                      &mt('Both username and e-mail address').'</label></span>&nbsp;&nbsp; '.
+                      '<span class="LC_nobreak"><label>'.
+                      '<input type="radio" name="passwords_prelink" value="either"'.$checkedpre{'either'}.' />'.
+                      &mt('Either username or e-mail address').'</label></span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'postlink'}.'</td>'.
+                      '<td class="LC_left_item">';
+        my %postlinked;
+        if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+            foreach my $item (@{$types}) {
+                undef(%postlinked);
+                $datatable .= '<fieldset style="display: inline-block;">'.
+                              '<legend>'.$usertypes->{$item}.'</legend>';
+                if (ref($postlink{$item}) eq 'ARRAY') {
+                    map { $postlinked{$_} = 1; } (@{$postlink{$item}});
+                }
+                foreach my $field ('email','username') {
+                    my $checked;
+                    if ($postlinked{$field}) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<span class="LC_nobreak"><label>'.
+                                  '<input type="checkbox" name="passwords_postlink_'.$item.'" value="'.
+                                  $field.'"'.$checked.' />'.$field.'</label>'.
+                                  '<span>&nbsp;&nbsp; ';
+                }
+                $datatable .= '</fieldset>';
+            }
+        }
+        if (ref($postlink{'default'}) eq 'ARRAY') {
+            map { $postlinked{$_} = 1; } (@{$postlink{'default'}});
+        }
+        $datatable .= '<fieldset style="display: inline-block;">'.
+                      '<legend>'.$othertitle.'</legend>';
+        foreach my $field ('email','username') {
+            my $checked;
+            if ($postlinked{$field}) {
+                $checked = ' checked="checked"';
+            }
+            $datatable .= '<span class="LC_nobreak"><label>'.
+                          '<input type="checkbox" name="passwords_postlink_default" value="'.
+                          $field.'"'.$checked.' />'.$field.'</label>'.
+                          '<span>&nbsp;&nbsp; ';
+        }
+        $datatable .= '</fieldset></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'emailsrc'}.'</td>'.
+                      '<td class="LC_left_item">';
+        foreach my $type ('permanent','critical','notify') {
+            my $checkedemail;
+            if ($emailsrc{$type}) {
+                $checkedemail = ' checked="checked"';
+            }
+            $datatable .= '<span class="LC_nobreak"><label>'.
+                          '<input type="checkbox" name="passwords_emailsrc" value="'.
+                          $type.'"'.$checkedemail.' />'.$titles{$type}.'</label>'.
+                          '<span>&nbsp;&nbsp; ';
+        }
+        $datatable .= '</td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        my $switchserver = &check_switchserver($dom,$confname);
+        my ($showstd,$noshowstd);
+        if ($nostdtext) {
+            $noshowstd = ' checked="checked"';
+        } else {
+            $showstd = ' checked="checked"';
+        }
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'customtext'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      &mt('Retain standard text:').
+                      '<label><input type="radio" name="passwords_stdtext" value="1"'.$showstd.' />'.
+                      &mt('Yes').'</label>'.'&nbsp;'.
+                      '<label><input type="radio" name="passwords_stdtext" value="0"'.$noshowstd.' />'.
+                      &mt('No').'</label></span><br />'.
+                      '<span class="LC_fontsize_small">'.
+                      &mt('(If you use the same account ...  reset a password from this page.)').'</span><br /><br />'.
+                      &mt('Include custom text:');
+        if ($customurl) {
+            my $link =  &Apache::loncommon::modal_link($customurl,&mt('custom text'),600,500,
+                                                       undef,undef,undef,undef,'background-color:#ffffff');
+            $datatable .= '<span class="LC_nobreak">&nbsp;'.$link.
+                          '<label><input type="checkbox" name="passwords_custom_del"'.
+                          ' value="1" />'.&mt('Delete?').'</label></span>'.
+                          ' <span class="LC_nobreak">&nbsp;'.&mt('Replace:').'</span>';
+        }
+        if ($switchserver) {
+            $datatable .= '<span class="LC_nobreak">&nbsp;'.&mt('Upload to library server: [_1]',$switchserver).'</span>';
+        } else {
+            $datatable .='<span class="LC_nobreak">&nbsp;'.
+                         '<input type="file" name="passwords_customfile" /></span>';
+        }
+        $datatable .= '</td></tr>';
+    } elsif ($position eq 'middle') {
+        my %domconf = &Apache::lonnet::get_dom('configuration',['defaults'],$dom);
+        my @items = ('intauth_cost','intauth_check','intauth_switch');
+        my %defaults;
+        if (ref($domconf{'defaults'}) eq 'HASH') {
+            %defaults = %{$domconf{'defaults'}};
+            if ($defaults{'intauth_cost'} !~ /^\d+$/) {
+                $defaults{'intauth_cost'} = 10;
+            }
+            if ($defaults{'intauth_check'} !~ /^(0|1|2)$/) {
+                $defaults{'intauth_check'} = 0;
+            }
+            if ($defaults{'intauth_switch'} !~ /^(0|1|2)$/) {
+                $defaults{'intauth_switch'} = 0;
+            }
+        } else {
+            %defaults = (
+                          'intauth_cost'   => 10,
+                          'intauth_check'  => 0,
+                          'intauth_switch' => 0,
+                        );
+        }
+        foreach my $item (@items) {
+            if ($itemcount%2) {
+                $css_class = '';
+            } else {
+                $css_class = ' class="LC_odd_row" ';
+            }
+            $datatable .= '<tr'.$css_class.'>'.
+                          '<td><span class="LC_nobreak">'.$titles{$item}.
+                          '</span></td><td class="LC_left_item" colspan="3">';
+            if ($item eq 'intauth_switch') {
+                my @options = (0,1,2);
+                my %optiondesc = &Apache::lonlocal::texthash (
+                                   0 => 'No',
+                                   1 => 'Yes',
+                                   2 => 'Yes, and copy existing passwd file to passwd.bak file',
+                                 );
+                $datatable .= '<table width="100%">';
+                foreach my $option (@options) {
+                    my $checked = ' ';
+                    if ($defaults{$item} eq $option) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
+                                  '<label><input type="radio" name="'.$item.
+                                  '" value="'.$option.'"'.$checked.' />'.
+                                  $optiondesc{$option}.'</label></span></td></tr>';
+                }
+                $datatable .= '</table>';
+            } elsif ($item eq 'intauth_check') {
+                my @options = (0,1,2);
+                my %optiondesc = &Apache::lonlocal::texthash (
+                                   0 => 'No',
+                                   1 => 'Yes, allow login then update passwd file using default cost (if higher)',
+                                   2 => 'Yes, disallow login if stored cost is less than domain default',
+                                 );
+                $datatable .= '<table width="100%">';
+                foreach my $option (@options) {
+                    my $checked = ' ';
+                    my $onclick;
+                    if ($defaults{$item} eq $option) {
+                        $checked = ' checked="checked"';
+                    }
+                    if ($option == 2) {
+                        $onclick = ' onclick="javascript:warnIntAuth(this);"';
+                    }
+                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
+                                  '<label><input type="radio" name="'.$item.
+                                  '" value="'.$option.'"'.$checked.$onclick.' />'.
+                                  $optiondesc{$option}.'</label></span></td></tr>';
+                }
+                $datatable .= '</table>';
+            } else {
+                $datatable .= '<input type="text" name="'.$item.'" value="'.
+                              $defaults{$item}.'" size="3" onblur="javascript:warnIntAuth(this);" />';
+            }
+            $datatable .= '</td></tr>';
+            $itemcount ++;
+        }
+    } elsif ($position eq 'lower') {
+        my ($min,$max,%chars,$expire,$numsaved);
+        $min = $Apache::lonnet::passwdmin;
+        if (ref($settings) eq 'HASH') {
+            if ($settings->{min}) {
+                $min = $settings->{min};
+            }
+            if ($settings->{max}) {
+                $max = $settings->{max};
+            }
+            if (ref($settings->{chars}) eq 'ARRAY') {
+                map { $chars{$_} = 1; } (@{$settings->{chars}});
+            }
+            if ($settings->{expire}) {
+                $expire = $settings->{expire};
+            }
+            if ($settings->{numsaved}) {
+                $numsaved = $settings->{numsaved};
+            }
+        }
+        my %rulenames = &Apache::lonlocal::texthash(
+                                                     uc => 'At least one upper case letter',
+                                                     lc => 'At least one lower case letter',
+                                                     num => 'At least one number',
+                                                     spec => 'At least one non-alphanumeric',
+                                                   );
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" '.
+                      'onblur="javascript:warnIntPass(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" '.
+                      'onblur="javascript:warnIntPass(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'chars'}.'<br />'.
+                      '<span class="LC_nobreak LC_fontsize_small">'.&mt('(Leave unchecked if not required)').
+                      '</span></td>';
+        my $numinrow = 2;
+        my @possrules = ('uc','lc','num','spec');
+        $datatable .= '<td class="LC_left_item"><table>';
+        for (my $i=0; $i<@possrules; $i++) {
+            my ($rem,$checked);
+            if ($chars{$possrules[$i]}) {
+                $checked = ' checked="checked"';
+            }
+            $rem = $i%($numinrow);
+            if ($rem == 0) {
+                if ($i > 0) {
+                    $datatable .= '</tr>';
+                }
+                $datatable .= '<tr>';
+            }
+            $datatable .= '<td><span class="LC_nobreak"><label>'.
+                          '<input type="checkbox" name="passwords_chars" value="'.$possrules[$i].'"'.$checked.' />'.
+                          $rulenames{$possrules[$i]}.'</label></span></td>';
+        }
+        my $rem = @possrules%($numinrow);
+        my $colsleft = $numinrow - $rem;
+        if ($colsleft > 1 ) {
+            $datatable .= '<td colspan="'.$colsleft.'" class="LC_left_item">'.
+                          '&nbsp;</td>';
+        } elsif ($colsleft == 1) {
+            $datatable .= '<td class="LC_left_item">&nbsp;</td>';
+        }
+        $datatable .='</table></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'expire'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_expire" value="'.$expire.'" size="4" '.
+                      'onblur="javascript:warnIntPass(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no expiration)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" '.
+                      'onblur="javascript:warnIntPass(this);" />'. 
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
+                      '</span></td></tr>';
+    } else {
+        my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
+        my %ownerchg = (
+                          by  => {},
+                          for => {},
+                       );
+        my %ownertitles = &Apache::lonlocal::texthash (
+                            by  => 'Course owner status(es) allowed',
+                            for => 'Student status(es) allowed',
+                          );
+        if (ref($settings) eq 'HASH') {
+            if (ref($settings->{crsownerchg}) eq 'HASH') {
+                if (ref($settings->{crsownerchg}{'by'}) eq 'ARRAY') {
+                    map { $ownerchg{by}{$_} = 1; } (@{$settings->{crsownerchg}{'by'}});
+                }
+                if (ref($settings->{crsownerchg}{'for'}) eq 'ARRAY') {
+                    map { $ownerchg{for}{$_} = 1; } (@{$settings->{crsownerchg}{'for'}});
+                }
+            }
+        }
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr '.$css_class.'>'.
+                      '<td>'.
+                      &mt('Requirements').'<ul>'.
+                      '<li>'.&mt("Course 'type' is not a Community or Placement Test").'</li>'.
+                      '<li>'.&mt('User is Course Coordinator and also course owner').'</li>'.
+                      '<li>'.&mt("Student's only active roles are student role(s) in course(s) owned by this user").'</li>'.
+                      '<li>'.&mt('User, course, and student share same domain').'</li>'.
+                      '</ul>'.
+                      '</td>'.
+                      '<td class="LC_left_item">';
+        foreach my $item ('by','for') {
+            $datatable .= '<fieldset style="display: inline-block;">'.
+                          '<legend>'.$ownertitles{$item}.'</legend>';
+            if ((ref($types) eq 'ARRAY') && (ref($usertypes) eq 'HASH')) {
+                foreach my $type (@{$types}) {
+                    my $checked;
+                    if ($ownerchg{$item}{$type}) {
+                        $checked = ' checked="checked"';
+                    }
+                    $datatable .= '<span class="LC_nobreak"><label>'.
+                                  '<input type="checkbox" name="passwords_crsowner_'.$item.'" value="'.
+                                  $type.'"'.$checked.' />'.$usertypes->{$type}.'</label>'.
+                                  '</span>&nbsp;&nbsp; ';
+                }
+            }
+            my $checked;
+            if ($ownerchg{$item}{'default'}) {
+                $checked = ' checked="checked"';
+            }
+            $datatable .= '<span class="LC_nobreak"><label><input type="checkbox" '.
+                          'name="passwords_crsowner_'.$item.'" value="default"'.$checked.' />'.
+                          $othertitle.'</label></span></fieldset>';
+        }
+        $datatable .= '</td></tr>';
+    }
+    return $datatable;
+}
+
 sub print_usersessions {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my ($css_class,$datatable,$itemcount,%checked,%choices);
@@ -7528,10 +8166,14 @@ sub captcha_choice {
         $vertext,$currver);
     my %lt = &captcha_phrases();
     $keyentry = 'hidden';
+    my $colspan=2;
     if ($context eq 'cancreate') {
         $rowname = &mt('CAPTCHA validation');
     } elsif ($context eq 'login') {
         $rowname =  &mt('"Contact helpdesk" CAPTCHA validation');
+    } elsif ($context eq 'passwords') {
+        $rowname = &mt('"Forgot Password" CAPTCHA validation');
+        $colspan=1;
     }
     if (ref($settings) eq 'HASH') {
         if ($settings->{'captcha'}) {
@@ -7571,7 +8213,7 @@ sub captcha_choice {
         $css_class .= ' style="'.$rowstyle.'"';
     }
     my $output = '<tr'.$css_class.'>'.
-                 '<td class="LC_left_item">'.$rowname.'</td><td class="LC_left_item" colspan="2">'."\n".
+                 '<td class="LC_left_item">'.$rowname.'</td><td class="LC_left_item" colspan="'.$colspan.'">'."\n".
                  '<table><tr><td>'."\n";
     foreach my $option ('original','recaptcha','notused') {
         $output .= '<span class="LC_nobreak"><label><input type="radio" name="'.$context.'_captcha" value="'.
@@ -7810,85 +8452,6 @@ sub print_defaults {
             $datatable .= '</td></tr>';
             $rownum ++;
         }
-    } elsif ($position eq 'middle') {
-        my @items = ('intauth_cost','intauth_check','intauth_switch');
-        my %defaults;
-        if (ref($settings) eq 'HASH') {
-            %defaults = %{$settings};
-            if ($defaults{'intauth_cost'} !~ /^\d+$/) {
-                $defaults{'intauth_cost'} = 10;
-            }
-            if ($defaults{'intauth_check'} !~ /^(0|1|2)$/) {
-                $defaults{'intauth_check'} = 0;
-            }
-            if ($defaults{'intauth_switch'} !~ /^(0|1|2)$/) {
-                $defaults{'intauth_switch'} = 0;
-            }
-        } else {
-            %defaults = (
-                          'intauth_cost'   => 10,
-                          'intauth_check'  => 0,
-                          'intauth_switch' => 0,
-                        );
-        }
-        foreach my $item (@items) {
-            if ($rownum%2) {
-                $css_class = '';
-            } else {
-                $css_class = ' class="LC_odd_row" ';
-            }
-            $datatable .= '<tr'.$css_class.'>'.
-                          '<td><span class="LC_nobreak">'.$titles->{$item}.
-                          '</span></td><td class="LC_left_item" colspan="3">';
-            if ($item eq 'intauth_switch') {
-                my @options = (0,1,2);
-                my %optiondesc = &Apache::lonlocal::texthash (
-                                   0 => 'No',
-                                   1 => 'Yes',
-                                   2 => 'Yes, and copy existing passwd file to passwd.bak file',
-                                 );
-                $datatable .= '<table width="100%">';
-                foreach my $option (@options) {
-                    my $checked = ' ';
-                    if ($defaults{$item} eq $option) {
-                        $checked = ' checked="checked"';
-                    }
-                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
-                                  '<label><input type="radio" name="'.$item.
-                                  '" value="'.$option.'"'.$checked.' />'.
-                                  $optiondesc{$option}.'</label></span></td></tr>';
-                }
-                $datatable .= '</table>';
-            } elsif ($item eq 'intauth_check') {
-                my @options = (0,1,2);
-                my %optiondesc = &Apache::lonlocal::texthash (
-                                   0 => 'No',
-                                   1 => 'Yes, allow login then update passwd file using default cost (if higher)',
-                                   2 => 'Yes, disallow login if stored cost is less than domain default',
-                                 );
-                $datatable .= '<table width="100%">';
-                foreach my $option (@options) {
-                    my $checked = ' ';
-                    my $onclick;
-                    if ($defaults{$item} eq $option) {
-                        $checked = ' checked="checked"';
-                    }
-                    if ($option == 2) {
-                        $onclick = ' onclick="javascript:warnIntAuth(this);"';
-                    }
-                    $datatable .= '<tr><td class="LC_left_item"><span class="LC_nobreak">'.
-                                  '<label><input type="radio" name="'.$item.
-                                  '" value="'.$option.'"'.$checked.$onclick.' />'.
-                                  $optiondesc{$option}.'</label></span></td></tr>';
-                }
-                $datatable .= '</table>';
-            } else {
-                $datatable .= '<input type="text" name="'.$item.'" value="'.
-                              $defaults{$item}.'" size="3" onblur="javascript:warnIntAuth(this);" />'; 
-            }
-            $datatable .= '</td></tr>';
-            $rownum ++;
-        }
     } else {
         my %defaults;
         if (ref($settings) eq 'HASH') {
@@ -8677,35 +9240,7 @@ sub serverstatus_pages {
 
 sub defaults_javascript {
     my ($settings) = @_;
-    my $intauthcheck = &mt('Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.');
-    my $intauthcost = &mt('Warning: bcrypt encryption cost for internal authentication must be an integer.');
-    &js_escape(\$intauthcheck);
-    &js_escape(\$intauthcost);
-    my $intauthjs = <<"ENDSCRIPT";
-
-function warnIntAuth(field) {
-    if (field.name == 'intauth_check') {
-        if (field.value == '2') {
-            alert('$intauthcheck');
-        }
-    }
-    if (field.name == 'intauth_cost') {
-        field.value.replace(/\s/g,'');
-        if (field.value != '') {
-            var regexdigit=/^\\d+\$/;
-            if (!regexdigit.test(field.value)) {
-                alert('$intauthcost');
-            }
-        }
-    }
-    return;
-}
-
-ENDSCRIPT
-
-    if (ref($settings) ne 'HASH') {
-        return &Apache::lonhtmlcommon::scripttag($intauthjs);
-    }
+    return unless (ref($settings) eq 'HASH');
     if ((ref($settings->{'inststatusorder'}) eq 'ARRAY') && (ref($settings->{'inststatustypes'}) eq 'HASH')) {
         my $maxnum = scalar(@{$settings->{'inststatusorder'}});
         if ($maxnum eq '') {
@@ -8759,15 +9294,100 @@ $jstext
     return;
 }
 
-$intauthjs
-
 // ]]>
 </script>
 
 ENDSCRIPT
+    }
+    return;
+}
+
+sub passwords_javascript {
+    my %intalert = &Apache::lonlocal::texthash (
+        authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
+        authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
+        passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
+        passmax => 'Warning: maximum password length must be a positive integer (or blank).',
+        passexp => 'Warning: days before password expiration must be a positive integer (or blank).',
+        passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
+    );
+    &js_escape(\%intalert);
+    my $defmin = $Apache::lonnet::passwdmin;
+    my $intauthjs = <<"ENDSCRIPT";
+
+function warnIntAuth(field) {
+    if (field.name == 'intauth_check') {
+        if (field.value == '2') {
+            alert('$intalert{authcheck}');
+        }
+    }
+    if (field.name == 'intauth_cost') {
+        field.value.replace(/\s/g,'');
+        if (field.value != '') {
+            var regexdigit=/^\\d+\$/;
+            if (!regexdigit.test(field.value)) {
+                alert('$intalert{authcost}');
+            }
+        }
+    }
+    return;
+}
+
+function warnIntPass(field) {
+    field.value.replace(/^\s+/,'');
+    field.value.replace(/\s+\$/,'');
+    var regexdigit=/^\\d+\$/;
+    if (field.name == 'passwords_min') {
+        if (field.value == '') {
+            alert('$intalert{passmin}');
+            field.value = '$defmin';
+        } else {
+            if (!regexdigit.test(field.value)) {
+                alert('$intalert{passmin}');
+                field.value = '$defmin';
+            }
+            var minval = parseInt(field.value,10);
+            if (minval < $defmin) {
+                alert('$intalert{passmin}');
+                field.value = '$defmin';
+            }
+        }
     } else {
-        return &Apache::lonhtmlcommon::scripttag($intauthjs);
+        if (field.value == '0') {
+            field.value = '';
+        }
+        if (field.value != '') {
+            if (field.name == 'passwords_expire') {
+                var regexpposnum=/^\\d+(|\\.\\d*)\$/; 
+                if (!regexpposnum.test(field.value)) {
+                    alert('$intalert{passexp}');
+                    field.value = '';
+                } else {
+                    var expval = parseFloat(field.value);
+                    if (expval == 0) {
+                        alert('$intalert{passexp}');
+                        field.value = '';
+                    }
+                }
+            } else {
+                if (!regexdigit.test(field.value)) {
+                    if (field.name == 'passwords_max') {
+                        alert('$intalert{passmax}');
+                    } else {
+                        if (field.name == 'passwords_numsaved') {
+                            alert('$intalert{passnum}');
+                        }
+                    }
+                }
+                field.value = '';
+            }
+        }
     }
+    return;
+}
+
+ENDSCRIPT
+    return &Apache::lonhtmlcommon::scripttag($intauthjs);
 }
 
 sub coursecategories_javascript {
@@ -9013,7 +9633,7 @@ sub build_category_rows {
 
 sub modifiable_userdata_row {
     my ($context,$item,$settings,$numinrow,$rowcount,$usertypes,$fieldsref,$titlesref,
-        $rowid,$customcss,$rowstyle) = @_;
+        $rowid,$customcss,$rowstyle,$itemdesc) = @_;
     my ($role,$rolename,$statustype);
     $role = $item;
     if ($context eq 'cancreate') {
@@ -9036,6 +9656,8 @@ sub modifiable_userdata_row {
         }
     } elsif ($context eq 'lti') {
         $rolename = &mt('Institutional data used (if available)');
+    } elsif ($context eq 'privacy') {
+        $rolename = $itemdesc;
     } else {
         if ($role eq 'cr') {
             $rolename = &mt('Custom role');
@@ -9085,6 +9707,13 @@ sub modifiable_userdata_row {
             if (ref($settings) eq 'HASH') {
                 $hashref = $settings->{'instdata'};
             }
+        } elsif ($context eq 'privacy') {
+            my ($key,$inner) = split(/_/,$role);
+            if (ref($settings) eq 'HASH') {
+                if (ref($settings->{$key}) eq 'HASH') {
+                    $hashref = $settings->{$key}->{$inner};
+                }
+            }
         } elsif (ref($settings->{$context}) eq 'HASH') {
             if (ref($settings->{$context}->{$role}) eq 'HASH') {
                 $hashref = $settings->{'lti_instdata'};
@@ -9122,7 +9751,25 @@ sub modifiable_userdata_row {
         my $check = ' ';
         unless ($role eq 'emailusername') {
             if (exists($checks{$fields[$i]})) {
-                $check = $checks{$fields[$i]}
+                $check = $checks{$fields[$i]};
+            } elsif ($context eq 'privacy') {
+                if ($role =~ /^priv_(domain|course)$/) {
+                    if (ref($settings) ne 'HASH') {
+                        $check = ' checked="checked" ';
+                    }
+                } elsif ($role =~ /^priv_(author|community)$/) {
+                    if (ref($settings) ne 'HASH') {
+                        unless ($fields[$i] eq 'id') {
+                            $check = ' checked="checked" ';
+                        }
+                    }
+                } elsif ($role =~ /^(unpriv|othdom)_/) {
+                    if (ref($settings) ne 'HASH') {
+                        if (($fields[$i] eq 'lastname') || ($fields[$i] eq 'firstname')) {
+                            $check = ' checked="checked" ';
+                        }
+                    }
+                }
             } elsif ($context ne 'lti') {
                 if ($role eq 'st') {
                     if (ref($settings) ne 'HASH') {
@@ -9151,6 +9798,8 @@ sub modifiable_userdata_row {
         } else {
             if ($context eq 'lti') {
                 $prefix = 'lti';
+            } elsif ($context eq 'privacy') {
+                $prefix = 'privacy';
             }
             $output .= '<label>'.
                        '<input type="checkbox" name="'.$prefix.'_'.$role.'" '.
@@ -10238,7 +10887,7 @@ sub check_configuser {
     my ($configuserok,%currroles);
     if ($uhome eq 'no_host') {
         srand( time() ^ ($$ + ($$ << 15))  ); # Seed rand.
-        my $configpass = &LONCAPA::Enrollment::create_password();
+        my $configpass = &LONCAPA::Enrollment::create_password($dom);
         $configuserok = 
             &Apache::lonnet::modifyuser($dom,$confname,'','internal',
                              $configpass,'','','','','',undef,$servadm);
@@ -12116,6 +12765,13 @@ sub modify_lti {
                     }
                 }
             }
+            if ($env{'form.lti_callback_'.$idx}) {
+                if ($env{'form.lti_callbackparam_'.$idx}) {
+                    my $callback = $env{'form.lti_callbackparam_'.$idx};
+                    $callback =~ s/^\s+|\s+$//g;
+                    $confhash{$itemid}{'callback'} = $callback;
+                }
+            }
             foreach my $field ('passback','roster','topmenu','inlinemenu') {
                 if ($env{'form.lti_'.$field.'_'.$idx}) {
                     $confhash{$itemid}{$field} = 1;
@@ -12141,7 +12797,7 @@ sub modify_lti {
                 }
             }
             unless (($idx eq 'add') || ($changes{$itemid})) {
-                foreach my $field ('mapuser','mapcrs','makecrs','section','passback','roster','lcauth','lcauthparm','topmenu','inlinemenu') {
+                foreach my $field ('mapuser','mapcrs','makecrs','section','passback','roster','lcauth','lcauthparm','topmenu','inlinemenu','callback') {
                     if ($domconfig{$action}{$itemid}{$field} ne $confhash{$itemid}{$field}) {
                         $changes{$itemid} = 1;
                     }
@@ -12367,6 +13023,11 @@ sub modify_lti {
                         } else {
                             $resulttext .= '<li>'.&mt('No section assignment').'</li>';
                         }
+                        if ($confhash{$itemid}{'callback'}) {
+                            $resulttext .= '<li>'.&mt('Callback setting').': '.$confhash{$itemid}{'callback'}.'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('No callback to logout LON-CAPA session when user logs out of Comsumer');
+                        }
                         foreach my $item ('passback','roster','topmenu','inlinemenu') {
                             $resulttext .= '<li>'.$lt{$item}.':&nbsp;';
                             if ($confhash{$itemid}{$item}) {
@@ -13616,6 +14277,758 @@ sub modify_contacts {
     return $resulttext;
 }
 
+sub modify_privacy {
+    my ($dom,%domconfig) = @_;
+    my ($resulttext,%current,%changes);
+    if (ref($domconfig{'privacy'}) eq 'HASH') {
+        %current = %{$domconfig{'privacy'}};
+    }
+    my @fields = ('lastname','firstname','middlename','generation','permanentemail','id');
+    my @items = ('domain','author','course','community');
+    my %names = &Apache::lonlocal::texthash (
+                   domain => 'Assigned domain role(s)',
+                   author => 'Assigned co-author role(s)',
+                   course => 'Assigned course role(s)',
+                   community => 'Assigned community role',
+                );
+    my %roles = &Apache::lonlocal::texthash (
+                   domain => 'Domain role',
+                   author => 'Co-author role',
+                   course => 'Course role',
+                   community => 'Community role',
+                );
+    my %titles = &Apache::lonlocal::texthash (
+                  approval => 'Approval for role in different domain',
+                  othdom   => 'User information available in other domain',
+                  priv     => 'Information viewable by privileged user in same domain',
+                  unpriv   => 'Information viewable by unprivileged user in same domain',
+                  instdom  => 'Other domain shares institution/provider',
+                  extdom   => 'Other domain has different institution/provider',
+                  none     => 'Not allowed',
+                  user     => 'User authorizes',
+                  domain   => 'Domain Coordinator authorizes',
+                  auto     => 'Unrestricted',
+    );
+    my %fieldnames = &Apache::lonlocal::texthash (
+                        id => 'Student/Employee ID',
+                        permanentemail => 'E-mail address',
+                        lastname => 'Last Name',
+                        firstname => 'First Name',
+                        middlename => 'Middle Name',
+                        generation => 'Generation',
+    );
+    my ($othertitle,$usertypes,$types) =
+        &Apache::loncommon::sorted_inst_types($dom);
+    my (%by_ip,%by_location,@intdoms,@instdoms);
+    &build_location_hashes(\@intdoms,\%by_ip,\%by_location,\@instdoms);
+
+    my %privacyhash = (
+                       'approval' => {
+                                       instdom => {},
+                                       extdom  => {},
+                                     },
+                       'othdom'   => {},
+                       'priv'     => {},
+                       'unpriv'   => {},
+                      );
+    foreach my $item (@items) {
+        if (@instdoms > 1) {
+            if ($env{'form.privacy_approval_instdom'.$item} =~ /^(none|user|domain|auto)$/) {
+                $privacyhash{'approval'}{'instdom'}{$item} = $env{'form.privacy_approval_instdom_'.$item};
+            }
+            if (ref($current{'approval'}) eq 'HASH') {
+                if (ref($current{'approval'}{'instdom'}) eq 'HASH') {
+                    unless ($privacyhash{'approval'}{'instdom'}{$item} eq $current{'approval'}{'instdom'}{$item}) {
+                        $changes{'approval'} = 1;
+                    }
+                }
+            } elsif ($privacyhash{'approval'}{'instdom'}{$item} ne 'auto') {
+                $changes{'approval'} = 1;
+            }
+        }
+        if (keys(%by_location) > 0) {
+            if ($env{'form.privacy_approval_extdom_'.$item} =~ /^(none|user|domain|auto)$/) {
+                $privacyhash{'approval'}{'extdom'}{$item} = $env{'form.privacy_approval_extdom_'.$item};
+            }
+            if (ref($current{'approval'}) eq 'HASH') {
+                if (ref($current{'approval'}{'extdom'}) eq 'HASH') {
+                    unless ($privacyhash{'approval'}{'extdom'}{$item} eq $current{'approval'}{'extdom'}{$item}) {
+                        $changes{'approval'} = 1;
+                    }
+                }
+            } elsif ($privacyhash{'approval'}{'extdom'}{$item} ne 'auto') {
+                $changes{'approval'} = 1;
+            }
+        }
+        foreach my $status ('priv','unpriv') {
+            my @possibles = sort(&Apache::loncommon::get_env_multiple('form.privacy_'.$status.'_'.$item));
+            my @newvalues;
+            foreach my $field (@possibles) {
+                if (grep(/^\Q$field\E$/,@fields)) {
+                    $privacyhash{$status}{$item}{$field} = 1;
+                    push(@newvalues,$field);
+                }
+            }
+            @newvalues = sort(@newvalues);
+            if (ref($current{$status}) eq 'HASH') {
+                if (ref($current{$status}{$item}) eq 'HASH') {
+                    my @currvalues = sort(keys(%{$current{$status}{$item}}));
+                    my @diffs = &Apache::loncommon::compare_arrays(\@currvalues,\@newvalues);
+                    if (@diffs > 0) {
+                        $changes{$status} = 1;
+                    }
+                }
+            } else {
+                my @stdfields;
+                foreach my $field (@fields) {
+                    if ($field eq 'id') {
+                        next if ($status eq 'unpriv');
+                        next if (($status eq 'priv') && ($item eq 'community'));
+                    }
+                    push(@stdfields,$field);
+                }
+                my @diffs = &Apache::loncommon::compare_arrays(\@stdfields,\@newvalues);
+                if (@diffs > 0) {
+                    $changes{$status} = 1;
+                }
+            }
+        }
+    }
+    if ((@instdoms > 1) || (keys(%by_location) > 0)) {
+        my @statuses;
+        if (ref($types) eq 'ARRAY') {
+            @statuses = @{$types};
+        }
+        foreach my $type (@statuses,'default') {
+            my @possfields = &Apache::loncommon::get_env_multiple('form.privacy_othdom_'.$type);
+            my @newvalues;
+            foreach my $field (sort(@possfields)) {
+                if (grep(/^\Q$field\E$/,@fields)) {
+                    $privacyhash{'othdom'}{$type}{$field} = 1;
+                    push(@newvalues,$field);
+                }
+            }
+            @newvalues = sort(@newvalues);
+            if (ref($current{'othdom'}) eq 'HASH') {
+                if (ref($current{'othdom'}{$type}) eq 'HASH') {
+                    my @currvalues = sort(keys(%{$current{'othdom'}{$type}}));
+                    my @diffs = &Apache::loncommon::compare_arrays(\@currvalues,\@newvalues);
+                    if (@diffs > 0) {
+                        $changes{'othdom'} = 1;
+                    }
+                }
+            } else {
+                my @stdfields = ('lastname','firstname','middlename','generation','permanentemail');
+                my @diffs = &Apache::loncommon::compare_arrays(\@stdfields,\@newvalues);
+                if (@diffs > 0) {
+                    $changes{'othdom'} = 1;
+                }
+            }
+        }
+    }
+    my %confighash = (
+                        privacy => \%privacyhash,
+                     );
+    my $putresult = &Apache::lonnet::put_dom('configuration',\%confighash,$dom);
+    if ($putresult eq 'ok') {
+        if (keys(%changes) > 0) {
+            $resulttext = &mt('Changes made: ').'<ul>';
+            foreach my $key ('approval','othdom','priv','unpriv') {
+                if ($changes{$key}) {
+                    $resulttext .= '<li>'.$titles{$key}.':<ul>';
+                    if ($key eq 'approval') {
+                        if (keys(%{$privacyhash{$key}{instdom}})) {
+                            $resulttext .= '<li>'.$titles{'instdom'}.'<ul>';
+                            foreach my $item (@items) {
+                                $resulttext .=  '<li>'.$roles{$item}.': '.$titles{$privacyhash{$key}{instdom}{$item}}.'</li>';
+                            }
+                            $resulttext .= '</ul></li>';
+                        }
+                        if (keys(%{$privacyhash{$key}{extdom}})) {
+                            $resulttext .= '<li>'.$titles{'extdom'}.'<ul>';
+                            foreach my $item (@items) {
+                                $resulttext .=  '<li>'.$roles{$item}.': '.$titles{$privacyhash{$key}{extdom}{$item}}.'</li>';
+                            }
+                            $resulttext .= '</ul></li>';
+                        }
+                    } elsif ($key eq 'othdom') {
+                        my @statuses;
+                        if (ref($types) eq 'ARRAY') {
+                            @statuses = @{$types};
+                        }
+                        if (ref($privacyhash{$key}) eq 'HASH') {
+                            foreach my $status (@statuses,'default') {
+                                if ($status eq 'default') {
+                                    $resulttext .= '<li>'.$othertitle.': ';
+                                } elsif (ref($usertypes) eq 'HASH') {
+                                    $resulttext .= '<li>'.$usertypes->{$status}.': ';
+                                } else {
+                                    next;
+                                }
+                                if (ref($privacyhash{$key}{$status}) eq 'HASH') {
+                                    if (keys(%{$privacyhash{$key}{$status}})) {
+                                        $resulttext .= join(', ', map { $fieldnames{$_}; } (sort(keys(%{$privacyhash{$key}{$status}}))));
+                                    } else {
+                                        $resulttext .= &mt('none');
+                                    }
+                                }
+                                $resulttext .= '</li>';
+                            }
+                        }
+                    } else {
+                        foreach my $item (@items) {
+                            if (ref($privacyhash{$key}{$item}) eq 'HASH') {
+                                $resulttext .= '<li>'.$names{$item}.': ';
+                                if (keys(%{$privacyhash{$key}{$item}})) {
+                                    $resulttext .= join(', ', map { $fieldnames{$_}; } (sort(keys(%{$privacyhash{$key}{$item}}))));
+                                } else {
+                                    $resulttext .= &mt('none');
+                                }
+                                $resulttext .= '</li>';
+                            }
+                        }
+                    }
+                    $resulttext .= '</ul></li>';
+                }
+            }
+        } else {
+            $resulttext = &mt('No changes made to user information settings');
+        }
+    } else {
+        $resulttext = '<span class="LC_error">'.
+            &mt('An error occurred: [_1]',$putresult).'</span>';
+    }
+    return $resulttext;
+}
+
+sub modify_passwords {
+    my ($r,$dom,$confname,$lastactref,%domconfig) = @_;
+    my ($resulttext,%current,%changes,%newvalues,@oktypes,$errors,
+        $updatedefaults,$updateconf);
+    my $customfn = 'resetpw.html';
+    if (ref($domconfig{'passwords'}) eq 'HASH') {
+        %current = %{$domconfig{'passwords'}};
+    }
+    my %domdefaults = &Apache::lonnet::get_domain_defaults($dom,1);
+    my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
+    if (ref($types) eq 'ARRAY') {
+        @oktypes = @{$types};
+    }
+    push(@oktypes,'default');
+
+    my %titles = &Apache::lonlocal::texthash (
+        intauth_cost   => 'Encryption cost for bcrypt (positive integer)',
+        intauth_check  => 'Check bcrypt cost if authenticated',
+        intauth_switch => 'Existing crypt-based switched to bcrypt on authentication',
+        permanent      => 'Permanent e-mail address',
+        critical       => 'Critical notification address',
+        notify         => 'Notification address',
+        min            => 'Minimum password length',
+        max            => 'Maximum password length',
+        chars          => 'Required characters',
+        expire         => 'Password expiration (days)',
+        numsaved       => 'Number of previous passwords to save',
+        reset          => 'Resetting Forgotten Password',
+        intauth        => 'Encryption of Stored Passwords (Internal Auth)',
+        rules          => 'Rules for LON-CAPA Passwords',
+        crsownerchg    => 'Course Owner Changing Student Passwords',
+        username       => 'Username',
+        email          => 'E-mail address',
+    );
+
+#
+# Retrieve current domain configuration for internal authentication from $domconfig{'defaults'}.
+#
+    my (%curr_defaults,%save_defaults);
+    if (ref($domconfig{'defaults'}) eq 'HASH') {
+        foreach my $key (keys(%{$domconfig{'defaults'}})) {
+            if ($key =~ /^intauth_(cost|check|switch)$/) {
+                $curr_defaults{$key} = $domconfig{'defaults'}{$key};
+            } else {
+                $save_defaults{$key} = $domconfig{'defaults'}{$key};
+            }
+        }
+    }
+    my %staticdefaults = (
+        'resetlink'      => 2,
+        'resetcase'      => \@oktypes,
+        'resetprelink'   => 'both',
+        'resetemail'     => ['critical','notify','permanent'],
+        'intauth_cost'   => 10,
+        'intauth_check'  => 0,
+        'intauth_switch' => 0,
+    );
+    $staticdefaults{'min'} = $Apache::lonnet::passwdmin;
+    foreach my $type (@oktypes) {
+        $staticdefaults{'resetpostlink'}{$type} = ['email','username'];
+    }
+    my $linklife = $env{'form.passwords_link'};
+    $linklife =~ s/^\s+|\s+$//g;
+    if (($linklife =~ /^\d+(|\.\d*)$/) && ($linklife > 0)) {
+        $newvalues{'resetlink'} = $linklife;
+        if ($current{'resetlink'}) {
+            if ($current{'resetlink'} ne $linklife) {
+                $changes{'reset'} = 1;
+            }
+        } elsif (!ref($domconfig{passwords}) eq 'HASH') {
+            if ($staticdefaults{'resetlink'} ne $linklife) {
+                $changes{'reset'} = 1;
+            }
+        }
+    } elsif ($current{'resetlink'}) {
+        $changes{'reset'} = 1;
+    }
+    my @casesens;
+    my @posscase = &Apache::loncommon::get_env_multiple('form.passwords_case_sensitive');
+    foreach my $case (sort(@posscase)) {
+        if (grep(/^\Q$case\E$/,@oktypes)) {
+            push(@casesens,$case);
+        }
+    }
+    $newvalues{'resetcase'} = \@casesens;
+    if (ref($current{'resetcase'}) eq 'ARRAY') {
+        my @diffs = &Apache::loncommon::compare_arrays($current{'resetcase'},\@casesens);
+        if (@diffs > 0) {
+            $changes{'reset'} = 1;
+        }
+    } elsif (!ref($domconfig{passwords}) eq 'HASH') {
+        my @diffs = &Apache::loncommon::compare_arrays($staticdefaults{'resetcase'},\@casesens);
+        if (@diffs > 0) {
+            $changes{'reset'} = 1;
+        }
+    }
+    if ($env{'form.passwords_prelink'} =~ /^(both|either)$/) {
+        $newvalues{'resetprelink'} = $env{'form.passwords_prelink'};
+        if (exists($current{'resetprelink'})) {
+            if ($current{'resetprelink'} ne $newvalues{'resetprelink'}) {
+                $changes{'reset'} = 1;
+            }
+        } elsif (!ref($domconfig{passwords}) eq 'HASH') {
+            if ($staticdefaults{'resetprelink'} ne $newvalues{'resetprelink'}) {
+                $changes{'reset'} = 1;
+            }
+        }
+    } elsif ($current{'resetprelink'}) {
+        $changes{'reset'} = 1;
+    }
+    foreach my $type (@oktypes) {
+        my @possplink = &Apache::loncommon::get_env_multiple('form.passwords_postlink_'.$type);
+        my @postlink;
+        foreach my $item (sort(@possplink)) {
+            if ($item =~ /^(email|username)$/) {
+                push(@postlink,$item);
+            }
+        }
+        $newvalues{'resetpostlink'}{$type} = \@postlink;
+        unless ($changes{'reset'}) {
+            if (ref($current{'resetpostlink'}) eq 'HASH') {
+                if (ref($current{'resetpostlink'}{$type}) eq 'ARRAY') {
+                    my @diffs = &Apache::loncommon::compare_arrays($current{'resetpostlink'}{$type},\@postlink);
+                    if (@diffs > 0) {
+                        $changes{'reset'} = 1;
+                    }
+                } else {
+                    $changes{'reset'} = 1;
+                }
+            } elsif (!ref($domconfig{passwords}) eq 'HASH') {
+                my @diffs = &Apache::loncommon::compare_arrays($staticdefaults{'resetpostlink'}{$type},\@postlink);
+                if (@diffs > 0) {
+                    $changes{'reset'} = 1;
+                }
+            }
+        }
+    }
+    my @possemailsrc = &Apache::loncommon::get_env_multiple('form.passwords_emailsrc');
+    my @resetemail;
+    foreach my $item (sort(@possemailsrc)) {
+        if ($item =~ /^(permanent|critical|notify)$/) {
+            push(@resetemail,$item);
+        }
+    }
+    $newvalues{'resetemail'} = \@resetemail;
+    unless ($changes{'reset'}) {
+        if (ref($current{'resetemail'}) eq 'ARRAY') {
+            my @diffs = &Apache::loncommon::compare_arrays($current{'resetemail'},\@resetemail);
+            if (@diffs > 0) {
+                $changes{'reset'} = 1;
+            }
+        } elsif (!ref($domconfig{passwords}) eq 'HASH') {
+            my @diffs = &Apache::loncommon::compare_arrays($staticdefaults{'resetemail'},\@resetemail);
+            if (@diffs > 0) {
+                $changes{'reset'} = 1;
+            }
+        }
+    }
+    if ($env{'form.passwords_stdtext'} == 0) {
+        $newvalues{'resetremove'} = 1;
+        unless ($current{'resetremove'}) {
+            $changes{'reset'} = 1;
+        }
+    } elsif ($current{'resetremove'}) {
+        $changes{'reset'} = 1;
+    }
+    if ($env{'form.passwords_customfile.filename'} ne '') {
+        my $servadm = $r->dir_config('lonAdmEMail');
+        my ($configuserok,$author_ok,$switchserver) =
+            &config_check($dom,$confname,$servadm);
+        my $error;
+        if ($configuserok eq 'ok') {
+            if ($switchserver) {
+                $error = &mt("Upload of file containing domain-specific text is not permitted to this server: [_1]",$switchserver);
+            } else {
+                if ($author_ok eq 'ok') {
+                    my ($result,$customurl) =
+                        &publishlogo($r,'upload','passwords_customfile',$dom,
+                                     $confname,'customtext/resetpw','','',$customfn);
+                    if ($result eq 'ok') {
+                        $newvalues{'resetcustom'} = $customurl;
+                        $changes{'reset'} = 1;
+                    } else {
+                        $error = &mt("Upload of [_1] failed because an error occurred publishing the file in RES space. Error was: [_2].",$customfn,$result);
+                    }
+                } else {
+                    $error = &mt("Upload of [_1] failed because an author role could not be assigned to a Domain Configuration user ([_2]) in domain: [_3].  Error was: [_4].",$customfn,$confname,$dom,$author_ok);
+                }
+            }
+        } else {
+            $error = &mt("Upload of [_1] failed because a Domain Configuration user ([_2]) could not be created in domain: [_3].  Error was: [_4].",$customfn,$confname,$dom,$configuserok);
+        }
+        if ($error) {
+            &Apache::lonnet::logthis($error);
+            $errors .= '<li><span class="LC_error">'.$error.'</span></li>';
+        }
+    } elsif ($current{'resetcustom'}) {
+        if ($env{'form.passwords_custom_del'}) {
+            $changes{'reset'} = 1;
+        } else {
+            $newvalues{'resetcustom'} = $current{'resetcustom'};
+        }
+    }
+    $env{'form.intauth_cost'} =~ s/^\s+|\s+$//g;
+    if (($env{'form.intauth_cost'} ne '') && ($env{'form.intauth_cost'} =~ /^\d+$/)) {
+        $save_defaults{'intauth_cost'} = $env{'form.intauth_cost'};
+        if ($save_defaults{'intauth_cost'} ne $curr_defaults{'intauth_cost'}) {
+            $changes{'intauth'} = 1;
+        }
+    } else {
+        $save_defaults{'intauth_cost'} = $curr_defaults{'intauth_cost'};
+    }
+    if ($env{'form.intauth_check'} =~ /^(0|1|2)$/) {
+        $save_defaults{'intauth_check'} = $env{'form.intauth_check'};
+        if ($save_defaults{'intauth_check'} ne $curr_defaults{'intauth_check'}) {
+            $changes{'intauth'} = 1;
+        }
+    } else {
+        $save_defaults{'intauth_check'} = $curr_defaults{'intauth_check'};
+    }
+    if ($env{'form.intauth_switch'} =~ /^(0|1|2)$/) {
+        $save_defaults{'intauth_switch'} = $env{'form.intauth_switch'};
+        if ($save_defaults{'intauth_switch'} ne $curr_defaults{'intauth_switch'}) {
+            $changes{'intauth'} = 1;
+        }
+    } else {
+        $save_defaults{'intauth_check'} = $curr_defaults{'intauth_check'};
+    }
+    foreach my $item ('cost','check','switch') {
+        if ($save_defaults{'intauth_'.$item} ne $domdefaults{'intauth_'.$item}) {
+            $domdefaults{'intauth_'.$item} = $save_defaults{'intauth_'.$item};
+            $updatedefaults = 1;
+        }
+    }
+    foreach my $rule ('min','max','expire','numsaved') {
+        $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
+        my $ruleok;
+        if ($rule eq 'expire') {
+            if (($env{'form.passwords_'.$rule} =~ /^\d+(|\.\d*)$/) &&
+                ($env{'form.passwords_'.$rule} ne '0')) {
+                $ruleok = 1;
+            }
+        } elsif ($rule eq 'min') {
+            if ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
+                if ($env{'form.passwords_'.$rule} >= $Apache::lonnet::passwdmin) {
+                    $ruleok = 1;
+                }
+            }
+        } elsif (($env{'form.passwords_'.$rule} =~ /^\d+$/) &&
+                 ($env{'form.passwords_'.$rule} ne '0')) {
+            $ruleok = 1;
+        }
+        if ($ruleok) {
+            $newvalues{$rule} = $env{'form.passwords_'.$rule};
+            if (exists($current{$rule})) {
+                if ($newvalues{$rule} ne $current{$rule}) {
+                    $changes{'rules'} = 1;
+                }
+            } elsif ($rule eq 'min') {
+                if ($staticdefaults{$rule} ne $newvalues{$rule}) {
+                    $changes{'rules'} = 1;
+                }
+            }
+        } elsif (exists($current{$rule})) {
+            $changes{'rules'} = 1;
+        }
+    }
+    my @posschars = &Apache::loncommon::get_env_multiple('form.passwords_chars');
+    my @chars;
+    foreach my $item (sort(@posschars)) {
+        if ($item =~ /^(uc|lc|num|spec)$/) {
+            push(@chars,$item);
+        }
+    }
+    $newvalues{'chars'} = \@chars;
+    unless ($changes{'rules'}) {
+        if (ref($current{'chars'}) eq 'ARRAY') {
+            my @diffs = &Apache::loncommon::compare_arrays($current{'chars'},\@chars);
+            if (@diffs > 0) {
+                $changes{'rules'} = 1;
+            }
+        } else {
+            if (@chars > 0) {
+                $changes{'rules'} = 1;
+            }
+        }
+    }
+    my %crsownerchg = (
+                        by => [],
+                        for => [],
+                      );
+    foreach my $item ('by','for') {
+        my @posstypes = &Apache::loncommon::get_env_multiple('form.passwords_crsowner_'.$item);
+        foreach my $type (sort(@posstypes)) {
+            if (grep(/^\Q$type\E$/,@oktypes)) {
+                push(@{$crsownerchg{$item}},$type);
+            }
+        }
+    }
+    $newvalues{'crsownerchg'} = \%crsownerchg;
+    if (ref($current{'crsownerchg'}) eq 'HASH') {
+        foreach my $item ('by','for') {
+            if (ref($current{'crsownerchg'}{$item}) eq 'ARRAY') {
+                my @diffs = &Apache::loncommon::compare_arrays($current{'crsownerchg'}{$item},$crsownerchg{$item});
+                if (@diffs > 0) {
+                    $changes{'crsownerchg'} = 1;
+                    last;
+                }
+            }
+        }
+    } elsif (!(ref($domconfig{passwords}) eq 'HASH')) {
+        foreach my $item ('by','for') {
+            if (@{$crsownerchg{$item}} > 0) {
+                $changes{'crsownerchg'} = 1;
+                last;
+            }
+        }
+    }
+
+    my %confighash = (
+                        defaults  => \%save_defaults,
+                        passwords => \%newvalues,
+                     );
+    &process_captcha('passwords',\%changes,$confighash{'passwords'},$domconfig{'passwords'});
+
+    my $putresult = &Apache::lonnet::put_dom('configuration',\%confighash,$dom);
+    if ($putresult eq 'ok') {
+        if (keys(%changes) > 0) {
+            $resulttext = &mt('Changes made: ').'<ul>';
+            foreach my $key ('reset','intauth','rules','crsownerchg') {
+                if ($changes{$key}) {
+                    unless ($key eq 'intauth') {
+                        $updateconf = 1;
+                    }
+                    $resulttext .= '<li>'.$titles{$key}.':<ul>';
+                    if ($key eq 'reset') {
+                        if ($confighash{'passwords'}{'captcha'} eq 'original') {
+                            $resulttext .= '<li>'.&mt('CAPTCHA validation set to use: original CAPTCHA').'</li>';
+                        } elsif ($confighash{'passwords'}{'captcha'} eq 'recaptcha') {
+                            $resulttext .= '<li>'.&mt('CAPTCHA validation set to use: reCAPTCHA').' '.
+                                           &mt('version: [_1]',$confighash{'passwords'}{'recaptchaversion'}).'<br />';
+                            if (ref($confighash{'passwords'}{'recaptchakeys'}) eq 'HASH') {
+                                $resulttext .= &mt('Public key: [_1]',$confighash{'passwords'}{'recaptchakeys'}{'public'}).'</br>'.
+                                               &mt('Private key: [_1]',$confighash{'passwords'}{'recaptchakeys'}{'private'}).'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('No CAPTCHA validation').'</li>';
+                        }
+                        if ($confighash{'passwords'}{'resetlink'}) {
+                            $resulttext .= '<li>'.&mt('Reset link expiration set to [quant,_1,hour]',$confighash{'passwords'}{'resetlink'}).'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('No reset link expiration set.').' '.
+                                                  &mt('Will default to 2 hours').'</li>';
+                        }
+                        if (ref($confighash{'passwords'}{'resetcase'}) eq 'ARRAY') {
+                            if (@{$confighash{'passwords'}{'resetcase'}} == 0) {
+                                $resulttext .= '<li>'.&mt('User input for username and/or e-mail address not case sensitive for "Forgot Password" web form').'</li>';
+                            } else {
+                                my $casesens;
+                                foreach my $type (@{$confighash{'passwords'}{'resetcase'}}) {
+                                    if ($type eq 'default') {
+                                        $casesens .= $othertitle.', ';
+                                    } elsif ($usertypes->{$type} ne '') {
+                                        $casesens .= $usertypes->{$type}.', ';
+                                    }
+                                }
+                                $casesens =~ s/\Q, \E$//;
+                                $resulttext .= '<li>'.&mt('"Forgot Password" web form input for username and/or e-mail address is case-sensitive for: [_1]',$casesens).'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('Case-sensitivity not set for "Forgot Password" web form').' '.&mt('Will default to case-sensitive for username and/or e-mail address for all').'</li>';
+                        }
+                        if ($confighash{'passwords'}{'resetprelink'} eq 'either') {
+                            $resulttext .= '<li>'.&mt('Users can enter either a username or an e-mail address in "Forgot Password" web form').'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('Users can enter both a username and an e-mail address in "Forgot Password" web form').'</li>';
+                        }
+                        if (ref($confighash{'passwords'}{'resetpostlink'}) eq 'HASH') {
+                            my $output;
+                            if (ref($types) eq 'ARRAY') {
+                                foreach my $type (@{$types}) {
+                                    if (ref($confighash{'passwords'}{'resetpostlink'}{$type}) eq 'ARRAY') {
+                                        if (@{$confighash{'passwords'}{'resetpostlink'}{$type}} == 0) {
+                                            $output .= $usertypes->{$type}.' -- '.&mt('none');
+                                        } else {
+                                            $output .= $usertypes->{$type}.' -- '.
+                                                       join(', ',map { $titles{$_}; } (@{$confighash{'passwords'}{'resetpostlink'}{$type}})).'; ';
+                                        }
+                                    }
+                                }
+                            }
+                            if (ref($confighash{'passwords'}{'resetpostlink'}{'default'}) eq 'ARRAY') {
+                                if (@{$confighash{'passwords'}{'resetpostlink'}{'default'}} == 0) {
+                                    $output .= $othertitle.' -- '.&mt('none');
+                                } else {
+                                    $output .= $othertitle.' -- '.
+                                               join(', ',map { $titles{$_}; } (@{$confighash{'passwords'}{'resetpostlink'}{'default'}}));
+                                }
+                            }
+                            if ($output) {
+                                $resulttext .= '<li>'.&mt('Information required for new password form (by user type) set to: [_1]',$output).'</li>';
+                            } else {
+                                $resulttext .= '<li>'.&mt('Information required for new password form not set.').' '.&mt('Will default to requiring both the username and an e-mail address').'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('Information required for new password form not set.').' '.&mt('Will default to requiring both the username and an e-mail address').'</li>';
+                        }
+                        if (ref($confighash{'passwords'}{'resetemail'}) eq 'ARRAY') {
+                            if (@{$confighash{'passwords'}{'resetemail'}} > 0) {
+                                $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA used for verification will include: [_1]',join(', ',map { $titles{$_}; } @{$confighash{'passwords'}{'resetemail'}})).'</li>';
+                            } else {
+                                $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA used for verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA usedfor verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
+                        }
+                        if ($confighash{'passwords'}{'resetremove'}) {
+                            $resulttext .= '<li>'.&mt('Preamble to "Forgot Password" web form not shown').'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('Preamble to "Forgot Password" web form is shown').'</li>';
+                        }
+                        if ($confighash{'passwords'}{'resetcustom'}) {
+                            my $customlink = &Apache::loncommon::modal_link($confighash{'passwords'}{'resetcustom'},
+                                                                            &mt('custom text'),600,500,undef,undef,
+                                                                            undef,undef,'background-color:#ffffff');
+                            $resulttext .= '<li>'.&mt('Preamble to "Forgot Password" form includes: [_1]',$customlink).'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('No custom text included in preamble to "Forgot Password" form').'</li>';
+                        }
+                    } elsif ($key eq 'intauth') {
+                        foreach my $item ('cost','switch','check') {
+                            my $value = $save_defaults{$key.'_'.$item};
+                            if ($item eq 'switch') {
+                                my %optiondesc = &Apache::lonlocal::texthash (
+                                                     0 => 'No',
+                                                     1 => 'Yes',
+                                                     2 => 'Yes, and copy existing passwd file to passwd.bak file',
+                                                 );
+                                if ($value =~ /^(0|1|2)$/) {
+                                    $value = $optiondesc{$value};
+                                } else {
+                                    $value = &mt('none -- defaults to No');
+                                }
+                            } elsif ($item eq 'check') {
+                                my %optiondesc = &Apache::lonlocal::texthash (
+                                                     0 => 'No',
+                                                     1 => 'Yes, allow login then update passwd file using default cost (if higher)',
+                                                     2 => 'Yes, disallow login if stored cost is less than domain default',
+                                                 );
+                                if ($value =~ /^(0|1|2)$/) {
+                                    $value = $optiondesc{$value};
+                                } else {
+                                    $value = &mt('none -- defaults to No');
+                                }
+                            }
+                            $resulttext .= '<li>'.&mt('[_1] set to "[_2]"',$titles{$key.'_'.$item},$value).'</li>';
+                        }
+                    } elsif ($key eq 'rules') {
+                        foreach my $rule ('min','max','expire','numsaved') {
+                            if ($confighash{'passwords'}{$rule} eq '') {
+                                if ($rule eq 'min') {
+                                    $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
+                                                   ' '.&mt('Default of [_1] will be used',
+                                                           $Apache::lonnet::passwdmin).'</li>';
+                                } else {
+                                    $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
+                                }
+                            } else {
+                                $resulttext .= '<li>'.&mt('[_1] set to [_2]',$titles{$rule},$confighash{'passwords'}{$rule}).'</li>';
+                            }
+                        }
+                    } elsif ($key eq 'crsownerchg') {
+                        if (ref($confighash{'passwords'}{'crsownerchg'}) eq 'HASH') {
+                            if ((@{$confighash{'passwords'}{'crsownerchg'}{'by'}} == 0) ||
+                                (@{$confighash{'passwords'}{'crsownerchg'}{'for'}} == 0)) {
+                                $resulttext .= '<li>'.&mt('Course owner may not change student passwords.').'</li>';
+                            } else {
+                                my %crsownerstr;
+                                foreach my $item ('by','for') {
+                                    if (ref($confighash{'passwords'}{'crsownerchg'}{$item}) eq 'ARRAY') {
+                                        foreach my $type (@{$confighash{'passwords'}{'crsownerchg'}{$item}}) {
+                                            if ($type eq 'default') {
+                                                $crsownerstr{$item} .= $othertitle.', ';
+                                            } elsif ($usertypes->{$type} ne '') {
+                                                $crsownerstr{$item} .= $usertypes->{$type}.', ';
+                                            }
+                                        }
+                                        $crsownerstr{$item} =~ s/\Q, \E$//;
+                                    }
+                                }
+                                $resulttext .= '<li>'.&mt('Course owner (with status: [_1]) may change passwords for students (with status: [_2]).',
+                                           $crsownerstr{'by'},$crsownerstr{'for'}).'</li>';
+                            }
+                        } else {
+                            $resulttext .= '<li>'.&mt('Course owner may not change student passwords.').'</li>';
+                        }
+                    }
+                    $resulttext .= '</ul></li>';
+                }
+            }
+            $resulttext .= '</ul>';
+        } else {
+            $resulttext = &mt('No changes made to password settings');
+        }
+        my $cachetime = 24*60*60;
+        if ($updatedefaults) {
+            &Apache::lonnet::do_cache_new('domdefaults',$dom,\%domdefaults,$cachetime);
+            if (ref($lastactref) eq 'HASH') {
+                $lastactref->{'domdefaults'} = 1;
+            }
+        }
+        if ($updateconf) {
+            &Apache::lonnet::do_cache_new('passwdconf',$dom,$confighash{'passwords'},$cachetime);
+            if (ref($lastactref) eq 'HASH') {
+                $lastactref->{'passwdconf'} = 1;
+            }
+        }
+    } else {
+        $resulttext = '<span class="LC_error">'.
+            &mt('An error occurred: [_1]',$putresult).'</span>';
+    }
+    if ($errors) {
+        $resulttext .= '<p>'.&mt('The following errors occurred: ').'<ul>'.
+                       $errors.'</ul></p>';
+    }
+    return $resulttext;
+}
+
 sub modify_usercreation {
     my ($dom,%domconfig) = @_;
     my ($resulttext,%curr_usercreation,%changes,%authallowed,%cancreate,%save_usercreate);
@@ -14429,7 +15842,7 @@ sub modify_selfcreation {
                                 $chgtext .= &mt('For self-created accounts verified by e-mail address, username is set as follows:').
                                             '<ul>';
                                 foreach my $status (@statuses) {
-                                    if ($type eq 'default') {
+                                    if ($status eq 'default') {
                                         $chgtext .= '<li>'.$othertitle.' -- '.$options{$cancreate{'emailverified'}{$status}}.'</li>';
                                     } else {
                                         $chgtext .= '<li>'.$usertypes{$status}.' -- '.$options{$cancreate{'emailverified'}{$status}}.'</li>';
@@ -14698,19 +16111,25 @@ sub modify_selfcreation {
 }
 
 sub process_captcha {
-    my ($container,$changes,$newsettings,$current) = @_;
-    return unless ((ref($changes) eq 'HASH') && (ref($newsettings) eq 'HASH') || (ref($current) eq 'HASH'));
+    my ($container,$changes,$newsettings,$currsettings) = @_;
+    return unless ((ref($changes) eq 'HASH') && (ref($newsettings) eq 'HASH'));
     $newsettings->{'captcha'} = $env{'form.'.$container.'_captcha'};
     unless ($newsettings->{'captcha'} eq 'recaptcha' || $newsettings->{'captcha'} eq 'notused') {
         $newsettings->{'captcha'} = 'original';
     }
-    if ($current->{'captcha'} ne $newsettings->{'captcha'}) {
+    my %current;
+    if (ref($currsettings) eq 'HASH') {
+        %current = %{$currsettings};
+    }
+    if ($current{'captcha'} ne $newsettings->{'captcha'}) {
         if ($container eq 'cancreate') {
             if (ref($changes->{'cancreate'}) eq 'ARRAY') {
                 push(@{$changes->{'cancreate'}},'captcha');
             } elsif (!defined($changes->{'cancreate'})) {
                 $changes->{'cancreate'} = ['captcha'];
             }
+        } elsif ($container eq 'passwords') {
+            $changes->{'reset'} = 1;
         } else {
             $changes->{'captcha'} = 1;
         }
@@ -14732,9 +16151,9 @@ sub process_captcha {
         }
         $newsettings->{'recaptchaversion'} = $newversion;
     }
-    if (ref($current->{'recaptchakeys'}) eq 'HASH') {
-        $currpub = $current->{'recaptchakeys'}{'public'};
-        $currpriv = $current->{'recaptchakeys'}{'private'};
+    if (ref($current{'recaptchakeys'}) eq 'HASH') {
+        $currpub = $current{'recaptchakeys'}{'public'};
+        $currpriv = $current{'recaptchakeys'}{'private'};
         unless ($newsettings->{'captcha'} eq 'recaptcha') {
             $newsettings->{'recaptchakeys'} = {
                                                  public  => '',
@@ -14742,8 +16161,8 @@ sub process_captcha {
                                               }
         }
     }
-    if ($current->{'captcha'} eq 'recaptcha') {
-        $currversion = $current->{'recaptchaversion'};
+    if ($current{'captcha'} eq 'recaptcha') {
+        $currversion = $current{'recaptchaversion'};
         if ($currversion ne '2') {
             $currversion = 1;
         }
@@ -14755,6 +16174,8 @@ sub process_captcha {
             } elsif (!defined($changes->{'cancreate'})) {
                 $changes->{'cancreate'} = ['recaptchaversion'];
             }
+        } elsif ($container eq 'passwords') {
+            $changes->{'reset'} = 1;
         } else {
             $changes->{'recaptchaversion'} = 1;
         }
@@ -14766,6 +16187,8 @@ sub process_captcha {
             } elsif (!defined($changes->{'cancreate'})) {
                 $changes->{'cancreate'} = ['recaptchakeys'];
             }
+        } elsif ($container eq 'passwords') {
+            $changes->{'reset'} = 1;
         } else {
             $changes->{'recaptchakeys'} = 1;
         }
@@ -14881,7 +16304,7 @@ sub modify_defaults {
     my ($resulttext,$mailmsgtxt,%newvalues,%changes,@errors);
     my %domdefaults = &Apache::lonnet::get_domain_defaults($dom,1);
     my @items = ('auth_def','auth_arg_def','lang_def','timezone_def','datelocale_def',
-                 'portal_def','intauth_cost','intauth_check','intauth_switch');
+                 'portal_def');
     my @authtypes = ('internal','krb4','krb5','localauth','lti');
     foreach my $item (@items) {
         $newvalues{$item} = $env{'form.'.$item};
@@ -14923,24 +16346,6 @@ sub modify_defaults {
                     push(@errors,$item);
                 }
             }
-        } elsif ($item eq 'intauth_cost') {
-            if ($newvalues{$item} ne '') {
-                if ($newvalues{$item} =~ /\D/) {
-                    push(@errors,$item);
-                }
-            }
-        } elsif ($item eq 'intauth_check') {
-            if ($newvalues{$item} ne '') {
-                unless ($newvalues{$item} =~ /^(0|1|2)$/) {
-                    push(@errors,$item);
-                }
-            }
-        } elsif ($item eq 'intauth_switch') {
-            if ($newvalues{$item} ne '') {
-                unless ($newvalues{$item} =~ /^(0|1|2)$/) {
-                    push(@errors,$item);
-                }
-            }
         }
         if (grep(/^\Q$item\E$/,@errors)) {
             $newvalues{$item} = $domdefaults{$item};
@@ -14949,6 +16354,18 @@ sub modify_defaults {
         }
         $domdefaults{$item} = $newvalues{$item};
     }
+    my %staticdefaults = (
+                           'intauth_cost'   => 10,
+                           'intauth_check'  => 0,
+                           'intauth_switch' => 0,
+                         );
+    foreach my $item ('intauth_cost','intauth_check','intauth_switch') {
+        if (exists($domdefaults{$item})) {
+            $newvalues{$item} = $domdefaults{$item};
+        } else {
+            $newvalues{$item} = $staticdefaults{$item};
+        }
+    }
     my %defaults_hash = (
                          defaults => \%newvalues,
                         );
@@ -15077,28 +16494,6 @@ sub modify_defaults {
                                           lti        => 'lti',
                         );
                         $value = $authnames{$shortauth{$value}};
-                    } elsif ($item eq 'intauth_switch') {
-                        my %optiondesc = &Apache::lonlocal::texthash (
-                                            0 => 'No',
-                                            1 => 'Yes',
-                                            2 => 'Yes, and copy existing passwd file to passwd.bak file',
-                                         );
-                        if ($value =~ /^(0|1|2)$/) {
-                            $value = $optiondesc{$value};
-                        } else {
-                            $value = &mt('none -- defaults to No');
-                        }
-                    } elsif ($item eq 'intauth_check') {
-                        my %optiondesc = &Apache::lonlocal::texthash (
-                                             0 => 'No',
-                                             1 => 'Yes, allow login then update passwd file using default cost (if higher)',
-                                             2 => 'Yes, disallow login if stored cost is less than domain default',
-                                         );
-                        if ($value =~ /^(0|1|2)$/) {
-                            $value = $optiondesc{$value};
-                        } else {
-                            $value = &mt('none -- defaults to No');
-                        }
                     }
                     $resulttext .= '<li>'.&mt('[_1] set to "[_2]"',$title->{$item},$value).'</li>';
                     $mailmsgtext .= "$title->{$item} set to $value\n";  
@@ -15313,8 +16708,8 @@ sub modify_scantron {
         $resulttext = &mt('No changes made to bubblesheet format file'); 
     }
     if ($errors) {
-        $resulttext .= &mt('The following errors occurred: ').'<ul>'.
-                       $errors.'</ul>';
+        $resulttext .= '<p>'.&mt('The following errors occurred: ').'<ul>'.
+                       $errors.'</ul></p>';
     }
     return $resulttext;
 }
@@ -15589,6 +16984,10 @@ sub modify_coursecategories {
                     }
                     $resulttext .= '</ul></li>';
                 }
+                &Apache::lonnet::do_cache_new('cats',$dom,$cathash,3600);
+                if (ref($lastactref) eq 'HASH') {
+                    $lastactref->{'cats'} = 1;
+                }
             }
             $resulttext .= '</ul>';
             if ($changes{'unauth'} || $changes{'auth'}) {
@@ -18368,7 +19767,8 @@ sub devalidate_remote_domconfs {
     my %servers = &Apache::lonnet::internet_dom_servers($dom);
     my %thismachine;
     map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
-    my @posscached = ('domainconfig','domdefaults','ltitools','usersessions','directorysrch');
+    my @posscached = ('domainconfig','domdefaults','ltitools','usersessions',
+                      'directorysrch','passwdconf','cats');
     if (keys(%servers)) {
         foreach my $server (keys(%servers)) {
             next if ($thismachine{$server});