--- loncom/interface/domainprefs.pm	2020/12/18 15:23:02	1.373
+++ loncom/interface/domainprefs.pm	2021/09/27 03:26:24	1.387
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.373 2020/12/18 15:23:02 raeburn Exp $
+# $Id: domainprefs.pm,v 1.387 2021/09/27 03:26:24 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -223,7 +223,7 @@ sub handler {
                 'ltitools','ssl','trust','lti','privacy','passwords',
                 'proctoring','wafproxy'],$dom);
     my %encconfig =
-        &Apache::lonnet::get_dom('encconfig',['ltitools','lti','proctoring'],$dom);
+        &Apache::lonnet::get_dom('encconfig',['ltitools','lti','proctoring'],$dom,undef,1);
     if (ref($domconfig{'ltitools'}) eq 'HASH') {
         if (ref($encconfig{'ltitools'}) eq 'HASH') {
             foreach my $id (keys(%{$domconfig{'ltitools'}})) {
@@ -263,7 +263,7 @@ sub handler {
     my @prefs_order = ('rolecolors','login','defaults','wafproxy','passwords','quotas',
                        'autoenroll','autoupdate','autocreate','directorysrch',
                        'contacts','privacy','usercreation','selfcreation',
-                       'usermodification','scantron','requestcourses','requestauthor'
+                       'usermodification','scantron','requestcourses','requestauthor',
                        'coursecategories','serverstatuses','helpsettings','coursedefaults',
                        'ltitools','proctoring','selfenrollment','usersessions','ssl',
                        'trust','lti');
@@ -297,7 +297,10 @@ sub handler {
                                  {col1 => 'Log-in Help',
                                   col2 => 'Value'},
                                  {col1 => 'Custom HTML in document head',
-                                  col2 => 'Value'}],
+                                  col2 => 'Value'},
+                                 {col1 => 'SSO',
+                                  col2 => 'Dual login: SSO and non-SSO options'},
+                                ],
                       print => \&print_login,
                       modify => \&modify_login,
                     },
@@ -311,16 +314,16 @@ sub handler {
                       print => \&print_defaults,
                       modify => \&modify_defaults,
                     },
-        'wafproxy' =>  
-                    { text => 'Web Application Firewall/Reverse Proxy',  
+        'wafproxy' =>
+                    { text => 'Web Application Firewall/Reverse Proxy',
                       help => 'Domain_Configuration_WAF_Proxy',
-                      header => [{col1 => 'Domain server',
-                                  col2 => 'Alias for WAF/Reverse Proxy',
+                      header => [{col1 => 'Domain(s)',
+                                  col2 => 'Servers and WAF/Reverse Proxy alias(es)',
                                  },
-                                 {col1 => 'Setting',
-                                  col2 => 'Value',}],
+                                 {col1 => 'Domain(s)',
+                                  col2 => 'WAF Configuration',}],
                       print => \&print_wafproxy,
-                      modify => \&modify_wafproxy, 
+                      modify => \&modify_wafproxy,
                     },
         'passwords' =>
                     { text => 'Passwords (Internal authentication)',
@@ -632,7 +635,10 @@ sub handler {
                                        {col1 => 'Log-in Help',
                                         col2 => 'Value'},
                                        {col1 => 'Custom HTML in document head',
-                                        col2 => 'Value'}],
+                                        col2 => 'Value'},
+                                       {col1 => 'SSO',
+                                        col2 => 'Dual login: SSO and non-SSO options'},
+                                      ],
                             print => \&print_login,
                             modify => \&modify_login,
                            };
@@ -855,6 +861,12 @@ sub print_config_box {
         $output .= &lti_javascript($settings);
     } elsif ($action eq 'proctoring') {
         $output .= &proctoring_javascript($settings);
+    } elsif ($action eq 'wafproxy') {
+        $output .= &wafproxy_javascript($dom);
+    } elsif ($action eq 'autoupdate') {
+        $output .= &autoupdate_javascript();
+    } elsif ($action eq 'login') {
+        $output .= &saml_javascript();
     }
     $output .=
          '<table class="LC_nested_outer">
@@ -874,7 +886,7 @@ sub print_config_box {
         my $leftnobr = '';
         if (($action eq 'rolecolors') || ($action eq 'defaults') ||
             ($action eq 'directorysrch') ||
-            (($action eq 'login') && ($numheaders < 4))) {
+            (($action eq 'login') && ($numheaders < 5))) {
             $colspan = ' colspan="2"';
         }
         if ($action eq 'usersessions') {
@@ -905,7 +917,7 @@ sub print_config_box {
         } elsif ($action eq 'scantron') {
             $output .= $item->{'print'}->($r,'top',$dom,$confname,$settings,\$rowtotal);
         } elsif ($action eq 'login') {
-            if ($numheaders == 4) {
+            if ($numheaders == 5) {
                 $colspan = ' colspan="2"';
                 $output .= &print_login('service',$dom,$confname,$phase,$settings,\$rowtotal);
             } else {
@@ -1046,7 +1058,7 @@ sub print_config_box {
               <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td></tr>'.
                            $item->{'print'}->('bottom',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'login') {
-            if ($numheaders == 4) {
+            if ($numheaders == 5) {
                 $output .= &print_login('page',$dom,$confname,$phase,$settings,\$rowtotal).'
            </table>
           </td>
@@ -1070,7 +1082,7 @@ sub print_config_box {
            <td>
             <table class="LC_nested">
              <tr class="LC_info_row">';
-            if ($numheaders == 4) {
+            if ($numheaders == 5) {
                 $output .= '
               <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
               <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td>
@@ -1082,7 +1094,27 @@ sub print_config_box {
              </tr>';
             }
             $rowtotal ++;
-            $output .= &print_login('headtag',$dom,$confname,$phase,$settings,\$rowtotal);
+            $output .= &print_login('headtag',$dom,$confname,$phase,$settings,\$rowtotal).'
+           </table>
+          </td>
+         </tr>
+         <tr>
+           <td>
+            <table class="LC_nested">
+             <tr class="LC_info_row">';
+            if ($numheaders == 5) {
+                $output .= '
+              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[4]->{'col1'}).'</td>
+              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[4]->{'col2'}).'</td>
+             </tr>';
+            } else {
+                $output .= '
+              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
+              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td>
+             </tr>';
+            }
+            $rowtotal ++;
+            $output .= &print_login('saml',$dom,$confname,$phase,$settings,\$rowtotal);
         } elsif ($action eq 'requestcourses') {
             $output .= &print_requestmail($dom,$action,$settings,\$rowtotal);
             $rowtotal ++;
@@ -1217,9 +1249,12 @@ sub print_config_box {
 
 sub print_login {
     my ($caller,$dom,$confname,$phase,$settings,$rowtotal) = @_;
-    my ($css_class,$datatable);
+    my ($css_class,$datatable,$switchserver,%lt);
     my %choices = &login_choices();
-
+    if (($caller eq 'help') || ($caller eq 'headtag') || ($caller eq 'saml')) {
+        %lt = &login_file_options();
+        $switchserver = &check_switchserver($dom,$confname);
+    }
     if ($caller eq 'service') {
         my %servers = &Apache::lonnet::internet_dom_servers($dom);
         my $choice = $choices{'disallowlogin'};
@@ -1413,18 +1448,10 @@ sub print_login {
         $datatable .= &display_color_options($dom,$confname,$phase,'login',$itemcount,\%choices,\%is_custom,\%defaults,\%designs,\@images,\@bgs,\@links,\%alt_text,$rowtotal,\@logintext);
         $datatable .= '</tr></table></td></tr>';
     } elsif ($caller eq 'help') {
-        my ($defaulturl,$defaulttype,%url,%type,%lt,%langchoices);
-        my $switchserver = &check_switchserver($dom,$confname);
+        my ($defaulturl,$defaulttype,%url,%type,%langchoices);
         my $itemcount = 1;
         $defaulturl = '/adm/loginproblems.html';
         $defaulttype = 'default';
-        %lt = &Apache::lonlocal::texthash (
-                     del     => 'Delete?',
-                     rep     => 'Replace:',
-                     upl     => 'Upload:',
-                     default => 'Default',
-                     custom  => 'Custom',
-                                             );
         %langchoices = &Apache::lonlocal::texthash(&get_languages_hash());
         my @currlangs;
         if (ref($settings) eq 'HASH') {
@@ -1521,14 +1548,6 @@ sub print_login {
                 }
             }
         }
-        my %lt = &Apache::lonlocal::texthash(
-                                               del  => 'Delete?',
-                                               rep  => 'Replace:',
-                                               upl  => 'Upload:',
-                                               curr => 'View contents',
-                                               none => 'None',
-        );
-        my $switchserver = &check_switchserver($dom,$confname);
         foreach my $lonhost (sort(keys(%domservers))) {
             my $exempt = &check_exempt_addresses($currexempt{$lonhost});
             $datatable .= '<tr><td>'.$domservers{$lonhost}.'</td>';
@@ -1552,6 +1571,88 @@ sub print_login {
             $datatable .= '</td><td><input type="text" name="loginheadtagexempt_'.$lonhost.'" value="'.$exempt.'" /></td></tr>';
         }
         $datatable .= '</table></td></tr>';
+    } elsif ($caller eq 'saml') {
+        my %domservers = &Apache::lonnet::get_servers($dom);
+        $datatable .= '<tr><td colspan="3" style="text-align: left">'.
+                      '<table><tr><th>'.$choices{'hostid'}.'</th>'.
+                      '<th>'.$choices{'samllanding'}.'</th>'.
+                      '<th>'.$choices{'samloptions'}.'</th></tr>'."\n";
+        my (%saml,%samltext,%samlimg,%samlalt,%samlurl,%samltitle,%samlnotsso,%styleon,%styleoff);
+        foreach my $lonhost (keys(%domservers)) {
+            $samlurl{$lonhost} = '/adm/sso';
+            $styleon{$lonhost} = 'display:none';
+            $styleoff{$lonhost} = '';
+        }
+        if (ref($settings->{'saml'}) eq 'HASH') {
+            foreach my $lonhost (keys(%{$settings->{'saml'}})) {
+                if (ref($settings->{'saml'}{$lonhost}) eq 'HASH') {
+                    $saml{$lonhost} = 1;
+                    $samltext{$lonhost} = $settings->{'saml'}{$lonhost}{'text'};
+                    $samlimg{$lonhost} = $settings->{'saml'}{$lonhost}{'img'};
+                    $samlalt{$lonhost} = $settings->{'saml'}{$lonhost}{'alt'};
+                    $samlurl{$lonhost} = $settings->{'saml'}{$lonhost}{'url'};
+                    $samltitle{$lonhost} = $settings->{'saml'}{$lonhost}{'title'};
+                    $samlnotsso{$lonhost} = $settings->{'saml'}{$lonhost}{'notsso'};
+                    $styleon{$lonhost} = '';
+                    $styleoff{$lonhost} = 'display:none';
+                } else {
+                    $styleon{$lonhost} = 'display:none';
+                    $styleoff{$lonhost} = '';
+                }
+            }
+        }
+        my $itemcount = 1;
+        foreach my $lonhost (sort(keys(%domservers))) {
+            my $samlon = ' ';
+            my $samloff = ' checked="checked" ';
+            if ($saml{$lonhost}) {
+                $samlon = $samloff;
+                $samloff = ' ';
+            }
+            my $css_class = $itemcount%2?' class="LC_odd_row"':'';
+            $datatable .= '<tr'.$css_class.'><td><span class="LC_nobreak">'.$domservers{$lonhost}.'</span></td>'.
+                          '<td><span class="LC_nobreak"><label><input type="radio" name="saml_'.$lonhost.'"'.$samloff.
+                          'onclick="toggleSamlOptions(this.form,'."'$lonhost'".');" value="0" />'.
+                          &mt('No').'</label>'.('&nbsp;'x2).
+                          '<label><input type="radio" name="saml_'.$lonhost.'"'.$samlon.
+                          'onclick="toggleSamlOptions(this.form,'."'$lonhost'".');" value="1" />'.
+                          &mt('Yes').'</label></span></td>'.
+                          '<td id="samloptionson_'.$lonhost.'" style="'.$styleon{$lonhost}.'" width="100%">'.
+                          '<table><tr><th colspan="5" align="center">'.&mt('SSO').'</th><th align="center">'.
+                          '<span class="LC_nobreak">'.&mt('Non-SSO').'</span></th></tr>'.
+                          '<tr><th>'.&mt('Text').'</th><th>'.&mt('Image').'</th>'.
+                          '<th>'.&mt('Alt Text').'</th><th>'.&mt('URL').'</th>'.
+                          '<th>'.&mt('Tool Tip').'</th><th>'.&mt('Text').'</th></tr>'.
+                          '<tr'.$css_class.'><td><input type="text" name="saml_text_'.$lonhost.'" size="8" value="'.
+                          $samltext{$lonhost}.'" /></td><td>';
+            if ($samlimg{$lonhost}) {
+                $datatable .= '<img src="'.$samlimg{$lonhost}.'" /><br />'.
+                              '<span class="LC_nobreak"><label>'.
+                              '<input type="checkbox" name="saml_img_del" value="'.$lonhost.'" />'.
+                              $lt{'del'}.'</label>&nbsp;'.$lt{'rep'}.'</span>';
+            } else {
+                $datatable .= $lt{'upl'};
+            }
+            $datatable .='<br />';
+            if ($switchserver) {
+                $datatable .= &mt('Upload to library server: [_1]',$switchserver);
+            } else {
+                $datatable .= '<input type="file" name="saml_img_'.$lonhost.'" />';
+            }
+            $datatable .= '</td>'.
+                          '<td><input type="text" name="saml_alt_'.$lonhost.'" size="20" '.
+                          'value="'.$samlalt{$lonhost}.'" /></td>'.
+                          '<td><input type="text" name="saml_url_'.$lonhost.'" size="8" '.
+                          'value="'.$samlurl{$lonhost}.'" /></td>'.
+                          '<td><textarea name="saml_title_'.$lonhost.'" rows="3" cols="15">'.
+                          $samltitle{$lonhost}.'</textarea></td>'.
+                          '<td><input type="text" name="saml_notsso_'.$lonhost.'" size="8" '.
+                          'value="'.$samlnotsso{$lonhost}.'" /></td></tr>'.
+                          '</table></td>'.
+                          '<td id="samloptionsoff_'.$lonhost.'" style="'.$styleoff{$lonhost}.'" width="100%">&nbsp;</td></tr>';
+           $itemcount ++;
+        }
+        $datatable .= '</table></td></tr>';
     }
     return $datatable;
 }
@@ -1588,10 +1689,24 @@ sub login_choices {
             headtag       => "Custom markup",
             action        => "Action",
             current       => "Current",
+            samllanding   => "Dual login?",
+            samloptions   => "Options",
         );
     return %choices;
 }
 
+sub login_file_options {
+      return &Apache::lonlocal::texthash(
+                                           del     => 'Delete?',
+                                           rep     => 'Replace:',
+                                           upl     => 'Upload:',
+                                           curr    => 'View contents',
+                                           default => 'Default',
+                                           custom  => 'Custom',
+                                           none    => 'None',
+      );
+}
+
 sub print_rolecolors {
     my ($phase,$role,$dom,$confname,$settings,$rowtotal) = @_;
     my %choices = &color_font_choices();
@@ -2844,6 +2959,121 @@ function toggleLTITools(form,setting,ite
 ENDSCRIPT
 }
 
+sub wafproxy_javascript {
+    my ($dom) = @_;
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function updateWAF() {
+    if (document.getElementById('wafproxy_remoteip')) {
+        var wafremote = 0;
+        if (document.display.wafproxy_remoteip.options[document.display.wafproxy_remoteip.selectedIndex].value == 'h') {
+            wafremote = 1;
+        }
+        var fields = new Array('header','trust');
+        for (var i=0; i<fields.length; i++) {
+            if (document.getElementById('wafproxy_'+fields[i])) {
+                if (wafremote == 1) {
+                    document.getElementById('wafproxy_'+fields[i]).style.display = 'table-row';
+                }
+                else {
+                    document.getElementById('wafproxy_'+fields[i]).style.display = 'none';
+                }
+            }
+        }
+        if (document.getElementById('wafproxyranges_$dom')) {
+            if (wafremote == 1) {
+                document.getElementById('wafproxyranges_$dom').style.display = 'inline-block';
+            } else {
+                for (var i=0; i<document.display.wafproxy_vpnaccess.length; i++) {
+                    if (document.display.wafproxy_vpnaccess[i].checked) {
+                        if (document.display.wafproxy_vpnaccess[i].value == 0) {
+                            document.getElementById('wafproxyranges_$dom').style.display = 'none';
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return;
+}
+
+function checkWAF() {
+    if (document.getElementById('wafproxy_remoteip')) {
+        var wafvpn = 0;
+        for (var i=0; i<document.display.wafproxy_vpnaccess.length; i++) {
+            if (document.display.wafproxy_vpnaccess[i].checked) {
+                if (document.display.wafproxy_vpnaccess[i].value == 1) {
+                    wafvpn = 1;
+                }
+                break;
+            }
+        }
+        var vpn = new Array('vpnint','vpnext');
+        for (var i=0; i<vpn.length; i++) {
+            if (document.getElementById('wafproxy_show_'+vpn[i])) {
+                if (wafvpn == 1) {
+                    document.getElementById('wafproxy_show_'+vpn[i]).style.display = 'table-row';
+                }
+                else {
+                    document.getElementById('wafproxy_show_'+vpn[i]).style.display = 'none';
+                }
+            }
+        }
+        if (document.getElementById('wafproxyranges_$dom')) {
+            if (wafvpn == 1) {
+                document.getElementById('wafproxyranges_$dom').style.display = 'inline-block';
+            }
+            else if (document.display.wafproxy_remoteip.options[document.display.wafproxy_remoteip.selectedIndex].value != 'h') {
+                document.getElementById('wafproxyranges_$dom').style.display = 'none';
+            }
+        }
+    }
+    return;
+}
+
+function toggleWAF() {
+    if (document.getElementById('wafproxy_table')) {
+        var wafproxy = 0;
+        for (var i=0; i<document.display.wafproxy_${dom}.length; i++) {
+             if (document.display.wafproxy_${dom}[i].checked) {
+                 if (document.display.wafproxy_${dom}[i].value == 1) {
+                     wafproxy = 1;
+                     break;
+                }
+            }
+        }
+        if (wafproxy == 1) {
+            document.getElementById('wafproxy_table').style.display='inline';
+        }
+        else {
+           document.getElementById('wafproxy_table').style.display='none';
+        }
+        if (document.getElementById('wafproxyrow_${dom}')) {
+            if (wafproxy == 1) {
+                document.getElementById('wafproxyrow_${dom}').style.display = 'table-row';
+            }
+            else {
+                document.getElementById('wafproxyrow_${dom}').style.display = 'none';
+            }
+        }
+        if (document.getElementById('nowafproxyrow_$dom')) {
+            if (wafproxy == 1) {
+                document.getElementById('nowafproxyrow_${dom}').style.display = 'none';
+            }
+            else {
+                document.getElementById('nowafproxyrow_${dom}').style.display = 'table-row';
+            }
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
 sub proctoring_javascript {
     my ($settings) = @_;
     my (%ordered,$total,%jstext);
@@ -3194,6 +3424,83 @@ function toggleLTI(form,setting,item) {
 ENDSCRIPT
 }
 
+sub autoupdate_javascript {
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function toggleLastActiveDays(form) {
+    var radioname = 'lastactive';
+    var divid = 'lastactive_div';
+    var num = form.elements[radioname].length;
+    if (num) {
+        var setvis = '';
+        for (var i=0; i<num; i++) {
+            if (form.elements[radioname][i].checked) {
+                if (form.elements[radioname][i].value == '1') {
+                    if (document.getElementById(divid)) {
+                        document.getElementById(divid).style.display = 'inline-block';
+                    }
+                    setvis = 1;
+                }
+                break;
+            }
+        }
+        if (!setvis) {
+            if (document.getElementById(divid)) {
+                document.getElementById(divid).style.display = 'none';
+            }
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
+sub saml_javascript {
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function toggleSamlOptions(form,hostid) { 
+    var radioname = 'saml_'+hostid;
+    var tablecellon = 'samloptionson_'+hostid;
+    var tablecelloff = 'samloptionsoff_'+hostid;
+    var num = form.elements[radioname].length;
+    if (num) {
+        var setvis = ''; 
+        for (var i=0; i<num; i++) {
+            if (form.elements[radioname][i].checked) {
+                if (form.elements[radioname][i].value == '1') { 
+                    if (document.getElementById(tablecellon)) {
+                        document.getElementById(tablecellon).style.display='';
+                    }
+                    if (document.getElementById(tablecelloff)) {
+                        document.getElementById(tablecelloff).style.display='none';
+                    }
+                    setvis = 1;
+                }
+                break;
+            }
+        }
+        if (!setvis) {
+            if (document.getElementById(tablecellon)) {
+                document.getElementById(tablecellon).style.display='none';
+            }
+            if (document.getElementById(tablecelloff)) {
+                document.getElementById(tablecelloff).style.display='';
+            }
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
 sub print_autoenroll {
     my ($dom,$settings,$rowtotal) = @_;
     my $autorun = &Apache::lonnet::auto_run(undef,$dom),
@@ -3280,42 +3587,69 @@ sub print_autoenroll {
 
 sub print_autoupdate {
     my ($position,$dom,$settings,$rowtotal) = @_;
-    my $datatable;
+    my ($enable,$datatable);
     if ($position eq 'top') {
+        my %choices = &Apache::lonlocal::texthash (
+                          run        => 'Auto-update active?',
+                          classlists => 'Update information in classlists?',
+                          unexpired  => 'Skip updates for users without active or future roles?',
+                          lastactive => 'Skip updates for inactive users?',
+        );
+        my $itemcount = 0;
         my $updateon = ' ';
         my $updateoff = ' checked="checked" ';
-        my $classlistson = ' ';
-        my $classlistsoff = ' checked="checked" ';
         if (ref($settings) eq 'HASH') {
             if ($settings->{'run'} eq '1') {
                 $updateon = $updateoff;
                 $updateoff = ' ';
             }
-            if ($settings->{'classlists'} eq '1') {
-                $classlistson = $classlistsoff;
-                $classlistsoff = ' ';
-            }
         }
-        my %title = (
-                   run => 'Auto-update active?',
-                   classlists => 'Update information in classlists?',
-                    );
-        $datatable = '<tr class="LC_odd_row">'. 
-                  '<td>'.&mt($title{'run'}).'</td>'.
-                  '<td class="LC_right_item"><span class="LC_nobreak"><label>'.
+        $enable = '<tr class="LC_odd_row">'.
+                  '<td>'.$choices{'run'}.'</td>'.
+                  '<td class="LC_left_item"><span class="LC_nobreak"><label>'.
                   '<input type="radio" name="autoupdate_run"'.
-                  $updateon.' value="1" />'.&mt('Yes').'</label>&nbsp;'.
+                  $updateoff.' value="0" />'.&mt('No').'</label>&nbsp;'.
                   '<label><input type="radio" name="autoupdate_run"'.
-                  $updateoff.'value="0" />'.&mt('No').'</label></span></td>'.
-                  '</tr><tr>'.
-                  '<td>'.&mt($title{'classlists'}).'</td>'.
-                  '<td class="LC_right_item"><span class="LC_nobreak">'.
-                  '<label><input type="radio" name="classlists"'.
-                  $classlistson.' value="1" />'.&mt('Yes').'</label>&nbsp;'.
-                  '<label><input type="radio" name="classlists"'.
-                  $classlistsoff.'value="0" />'.&mt('No').'</label></span></td>'.
+                  $updateon.'value="1" />'.&mt('Yes').'</label></span></td>'.
                   '</tr>';
-        $$rowtotal += 2;
+        my @toggles = ('classlists','unexpired');
+        my %defaultchecked = ('classlists' => 'off',
+                              'unexpired'  => 'off'
+                              );
+        $$rowtotal ++;
+        ($datatable,$itemcount) = &radiobutton_prefs($settings,\@toggles,\%defaultchecked,
+                                                     \%choices,$itemcount,'','','left','no');
+        $datatable = $enable.$datatable;
+        $$rowtotal += $itemcount;
+        my $lastactiveon = ' ';
+        my $lastactiveoff = ' checked="checked" ';
+        my $lastactivestyle = 'none';
+        my $lastactivedays;
+        my $onclick = ' onclick="javascript:toggleLastActiveDays(this.form);"';
+        if (ref($settings) eq 'HASH') {
+            if ($settings->{'lastactive'} =~ /^\d+$/) {
+                $lastactiveon = $lastactiveoff;
+                $lastactiveoff = ' ';
+                $lastactivestyle = 'inline-block';
+                $lastactivedays = $settings->{'lastactive'};
+            }
+        }
+        my $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'>'.
+                      '<td>'.$choices{'lastactive'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak"><label>'.
+                      '<input type="radio" name="lastactive"'.
+                      $lastactiveoff.'value="0"'.$onclick.' />'.&mt('No').'</label>'.
+                      '&nbsp;<label>'.
+                      '<input type="radio" name="lastactive"'.
+                      $lastactiveon.' value="1"'.$onclick.' />'.&mt('Yes').'</label>'.
+                      '<div id="lastactive_div" style="display:'.$lastactivestyle.';">'.
+                      ':&nbsp;'.&mt('inactive = no activity in last [_1] days',
+                          '<input type="text" size="5" name="lastactivedays" value="'.
+                          $lastactivedays.'" />').
+                      '</span></td>'.
+                      '</tr>';
+        $$rowtotal ++;
     } elsif ($position eq 'middle') {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
         my $numinrow = 3;
@@ -3781,18 +4115,17 @@ sub print_contacts {
                                                    \%choices,$rownum);
         $datatable .= $reports;
     } elsif ($position eq 'lower') {
-        $css_class = $rownum%2?' class="LC_odd_row"':'';
-        my ($threshold,$sysmail,%excluded,%weights);
+        my (%current,%excluded,%weights);
         my ($defaults,$names) = &Apache::loncommon::lon_status_items();
         if ($lonstatus{'threshold'} =~ /^\d+$/) {
-            $threshold = $lonstatus{'threshold'};
+            $current{'errorthreshold'} = $lonstatus{'threshold'};
         } else {
-            $threshold = $defaults->{'threshold'};
+            $current{'errorthreshold'} = $defaults->{'threshold'};
         }
         if ($lonstatus{'sysmail'} =~ /^\d+$/) {
-            $sysmail = $lonstatus{'sysmail'};
+            $current{'errorsysmail'} = $lonstatus{'sysmail'};
         } else {
-            $sysmail = $defaults->{'sysmail'};
+            $current{'errorsysmail'} = $defaults->{'sysmail'};
         }
         if (ref($lonstatus{'weights'}) eq 'HASH') {
             foreach my $type ('E','W','N','U') {
@@ -3812,13 +4145,16 @@ sub print_contacts {
                 map {$excluded{$_} = 1; } @{$lonstatus{'excluded'}};
             }
         }
-        $datatable .= '<tr'.$css_class.'>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      $titles->{'errorthreshold'}.
-                      '</span></td><td class="LC_left_item">'.
-                      '<input type="text" name="errorthreshold" value="'.
-                      $threshold.'" size="5" /></td></tr>';
-        $rownum ++;
+        foreach my $item ('errorthreshold','errorsysmail') { 
+            $css_class = $rownum%2?' class="LC_odd_row"':'';
+            $datatable .= '<tr'.$css_class.'>'.
+                          '<td class="LC_left_item"><span class="LC_nobreak">'.
+                          $titles->{$item}.
+                          '</span></td><td class="LC_left_item">'.
+                          '<input type="text" name="'.$item.'" value="'.
+                          $current{$item}.'" size="5" /></td></tr>';
+            $rownum ++;
+        }
         $css_class = $rownum%2?' class="LC_odd_row"':'';
         $datatable .= '<tr'.$css_class.'>'.
                       '<td class="LC_left_item">'.
@@ -3864,14 +4200,6 @@ sub print_contacts {
         }
         $datatable .= '</tr></table></td></tr>';
         $rownum ++;
-        $css_class = $rownum%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      $titles->{'errorsysmail'}.
-                      '</span></td><td class="LC_left_item">'.
-                      '<input type="text" name="errorsysmail" value="'.
-                      $sysmail.'" size="5" /></td></tr>';
-        $rownum ++;
     } elsif ($position eq 'bottom') {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
         my (@posstypes,%usertypeshash);
@@ -4450,7 +4778,7 @@ sub helpdeskroles_access {
 
 sub radiobutton_prefs {
     my ($settings,$toggles,$defaultchecked,$choices,$itemcount,$onclick,
-        $additional,$align) = @_;
+        $additional,$align,$firstval) = @_;
     return unless ((ref($toggles) eq 'ARRAY') && (ref($defaultchecked) eq 'HASH') &&
                    (ref($choices) eq 'HASH'));
 
@@ -4490,15 +4818,21 @@ sub radiobutton_prefs {
         } else {
             $datatable .= '<td class="LC_right_item">';
         }
-        $datatable .=
-            '<span class="LC_nobreak">'.
-            '<label><input type="radio" name="'.
-            $item.'" '.$checkedon{$item}.' value="1"'.$onclick.' />'.&mt('Yes').
-            '</label>&nbsp;<label><input type="radio" name="'.$item.'" '.
-            $checkedoff{$item}.' value="0"'.$onclick.' />'.&mt('No').'</label>'.
-            '</span>'.$additional.
-            '</td>'.
-            '</tr>';
+        $datatable .= '<span class="LC_nobreak">';
+        if ($firstval eq 'no') {
+            $datatable .=
+                '<label><input type="radio" name="'.
+                $item.'" '.$checkedoff{$item}.' value="0"'.$onclick.' />'.&mt('No').
+                '</label>&nbsp;<label><input type="radio" name="'.$item.'" '.
+                $checkedon{$item}.' value="1"'.$onclick.' />'.&mt('Yes').'</label>';
+        } else {
+            $datatable .=
+                '<label><input type="radio" name="'.
+                $item.'" '.$checkedon{$item}.' value="1"'.$onclick.' />'.&mt('Yes').
+                '</label>&nbsp;<label><input type="radio" name="'.$item.'" '.
+                $checkedoff{$item}.' value="0"'.$onclick.' />'.&mt('No').'</label>';
+        }
+        $datatable .= '</span>'.$additional.'</td></tr>';
         $itemcount ++;
     }
     return ($datatable,$itemcount);
@@ -6161,7 +6495,7 @@ sub print_coursedefaults {
         my $currcanclone = 'none';
         my $onclick;
         my @cloneoptions = ('none','domain');
-        my %clonetitles = (
+        my %clonetitles = &Apache::lonlocal::texthash (
                              none     => 'No additional course requesters',
                              domain   => "Any course requester in course's domain",
                              instcode => 'Course requests for official courses ...',
@@ -7184,113 +7518,247 @@ sub print_wafproxy {
     my $itemcount = 0;
     my $datatable;
     my %servers = &Apache::lonnet::internet_dom_servers($dom);
-    my (%othercontrol,%otherdoms,%aliases,%values,$setdom);
+    my (%othercontrol,%otherdoms,%aliases,%values,$setdom,$showdom);
+    my %lt = &wafproxy_titles();
     foreach my $server (sort(keys(%servers))) {
         my $serverhome = &Apache::lonnet::get_server_homeID($servers{$server});
+        next if ($serverhome eq '');
         my $serverdom;
         if ($serverhome ne $server) {
             $serverdom = &Apache::lonnet::host_domain($serverhome);
-            $othercontrol{$server} = $serverdom;
+            if (($serverdom ne '') && (&Apache::lonnet::domain($serverdom) ne '')) {
+                $othercontrol{$server} = $serverdom;
+            }
         } else {
             $serverdom = &Apache::lonnet::host_domain($server);
+            next if (($serverdom eq '') || (&Apache::lonnet::domain($serverdom) eq ''));
             if ($serverdom ne $dom) {
                 $othercontrol{$server} = $serverdom;
             } else {
                 $setdom = 1;
                 if (ref($settings) eq 'HASH') {
-                    %{$values{$dom}} = ();
                     if (ref($settings->{'alias'}) eq 'HASH') {
                         $aliases{$dom} = $settings->{'alias'};
-                    }
-                    foreach my $item ('ipheader','trusted','exempt') {
-                        $values{$dom}{$item} = $settings->{$item};
+                        if ($aliases{$dom} ne '') {
+                            $showdom = 1;
+                        }
                     }
                 }
             }
         }
     }
+    if ($setdom) {
+        %{$values{$dom}} = ();
+        if (ref($settings) eq 'HASH') {
+            foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext') {
+                $values{$dom}{$item} = $settings->{$item};
+            }
+        }
+    }
     if (keys(%othercontrol)) {
         %otherdoms = reverse(%othercontrol);
         foreach my $domain (keys(%otherdoms)) {
             %{$values{$domain}} = ();
             my %config = &Apache::lonnet::get_dom('configuration',['wafproxy'],$domain);
-            if (ref($config{$domain}) eq 'HASH') {
-                if (ref($config{$domain}{'wafproxy'}) eq 'HASH') {
-                    $aliases{$domain} = $config{$domain}{'wafproxy'}{'alias'};
-                    foreach my $item ('exempt','trusted','ipheader') {
-                        $values{$domain}{$item} = $config{$domain}{'wafproxy'}{$item};
-                    }
+            if (ref($config{'wafproxy'}) eq 'HASH') {
+                $aliases{$domain} = $config{'wafproxy'}{'alias'};
+                foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext') {
+                    $values{$domain}{$item} = $config{'wafproxy'}{$item};
                 }
             }
         }
     }
     if ($position eq 'top') {
         my %servers = &Apache::lonnet::internet_dom_servers($dom);
+        my %aliasinfo;
         foreach my $server (sort(keys(%servers))) {
-            $itemcount ++; 
-            $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
-            $datatable .= '<tr'.$css_class.'>'.
-                          '<td>'.&mt('Hostname').':&nbsp;'.
-                                &Apache::lonnet::hostname($server).'</td>'.
-                          '<td>';
+            $itemcount ++;
+            my $dom_in_effect;
+            my $aliasrows = '<tr>'.
+                            '<td class="LC_left_item" style="vertical-align: baseline;">'.
+                            &mt('Hostname').':&nbsp;'.
+                            '<i>'.&Apache::lonnet::hostname($server).'</i></td><td>&nbsp;</td>';
             if ($othercontrol{$server}) {
+                $dom_in_effect = $othercontrol{$server};
                 my $current;
-                if (ref($aliases{$othercontrol{$server}}) eq 'HASH') {
-                    $current = $aliases{$othercontrol{$server}{$server}};
+                if (ref($aliases{$dom_in_effect}) eq 'HASH') {
+                    $current = $aliases{$dom_in_effect}{$server};
                 }
+                $aliasrows .= '<td class="LC_left_item" style="vertical-align: baseline;">'.
+                              &mt('Alias').':&nbsp';
                 if ($current) {
-                    $datatable .= $current;
+                    $aliasrows .= $current;
                 } else {
-                    $datatable .= &mt('None in effect');
+                    $aliasrows .= &mt('None');
                 }
-                $datatable .= '<br /><span class="LC_small">('.
-                              &mt('WAF/Reverse Proxy controlled by domain: [_1]',
-                                  '<b>'.$othercontrol{$server}.'</b>').'</span>';
+                $aliasrows .= '&nbsp;<span class="LC_small">('.
+                              &mt('controlled by domain: [_1]',
+                                  '<b>'.$dom_in_effect.'</b>').')</span></td>';
             } else {
+                $dom_in_effect = $dom;
                 my $current;
                 if (ref($aliases{$dom}) eq 'HASH') {
                     if ($aliases{$dom}{$server}) {
                         $current = $aliases{$dom}{$server};
                     }
                 }
-                $datatable .= '<input type="text" name="wafproxy_alias_'.$server.'" '.
-                              'value="'.$current.'" size="20" />';
+                $aliasrows .= '<td class="LC_left_item" style="vertical-align: baseline;">'.
+                              &mt('Alias').':&nbsp;'.
+                              '<input type="text" name="wafproxy_alias_'.$server.'" '.
+                              'value="'.$current.'" size="30" /></td>';
+            }
+            $aliasrows .= '</tr>';
+            $aliasinfo{$dom_in_effect} .= $aliasrows;
+        }
+        if ($aliasinfo{$dom}) {
+            my ($onclick,$wafon,$wafoff,$showtable);
+            $onclick = ' onclick="javascript:toggleWAF();"';
+            $wafoff = ' checked="checked"';
+            $showtable = ' style="display:none";';
+            if ($showdom) {
+                $wafon = $wafoff;
+                $wafoff = '';
+                $showtable = ' style="display:inline;"';
+            }
+            $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+            $datatable = '<tr'.$css_class.'>'.
+                         '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'<br />'.
+                         '<span class="LC_nobreak">'.&mt('WAF in use?').'&nbsp;<label>'.
+                         '<input type="radio" name="wafproxy_'.$dom.'" value="1"'.$wafon.$onclick.' />'.
+                         &mt('Yes').'</label>'.('&nbsp;'x2).'<label>'.
+                         '<input type="radio" name="wafproxy_'.$dom.'" value="0"'.$wafoff.$onclick.' />'.
+                         &mt('No').'</label></span></td>'.
+                         '<td class="LC_left_item">'.
+                         '<table id="wafproxy_table"'.$showtable.'>'.$aliasinfo{$dom}.
+                         '</table></td></tr>';
+            $itemcount++;
+        }
+        if (keys(%otherdoms)) {
+            foreach my $key (sort(keys(%otherdoms))) {
+                $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+                $datatable .= '<tr'.$css_class.'>'.
+                              '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$key.'</b>').'</td>'.
+                              '<td class="LC_left_item"><table>'.$aliasinfo{$key}.
+                              '</table></td></tr>';
+                $itemcount++;
             }
-            $datatable .= '</td></tr>';
         }
     } else {
+        my %ip_methods = &remoteip_methods();
         if ($setdom) {
             $itemcount ++;
             $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
-            $datatable .= '<tr'.$css_class.'>'.
-                          '<td>'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'<br /><br />'.
-                          &mt('Format for comma separated IP blocks').':<br />'.
-                          &mt('A.B.C.D/N or A.B.C.D - E.F.G.H').'</td>'.
-                          '<td class="LC_left_item"><table>';
-            foreach my $item ('ipheader','trusted','exempt') {
-                $datatable .= '<tr>'.
-                              '<td>'.$lt{$item}.':&nbsp;'.
-                              '<input type="text" value="'.$values{$dom}{$item}.'" '.
-                              'name="wafproxy_'.$item.'" /></td></tr>';
-            }
-            $datatable .= '</table></td></tr>';
+            my ($nowafstyle,$wafstyle,$curr_remotip,$currwafdisplay,$vpndircheck,$vpnaliascheck,
+                $currwafvpn,$wafrangestyle,$alltossl,$ssltossl);
+            $wafstyle = ' style="display:none;"';
+            $nowafstyle = ' style="display:table-row;"';
+            $currwafdisplay = ' style="display: none"';
+            $wafrangestyle = ' style="display: none"';
+            $curr_remotip = 'n';
+            $ssltossl = ' checked="checked"';
+            if ($showdom) {
+                $wafstyle = ' style="display:table-row;"';
+                $nowafstyle =  ' style="display:none;"';
+                if (keys(%{$values{$dom}})) {
+                    if ($values{$dom}{remoteip} =~ /^[nmh]$/) {
+                        $curr_remotip = $values{$dom}{remoteip};
+                    }
+                    if ($curr_remotip eq 'h') {
+                        $currwafdisplay = ' style="display:table-row"';
+                        $wafrangestyle = ' style="display:inline-block;"';
+                    }
+                    if ($values{$dom}{'sslopt'}) {
+                        $alltossl = ' checked="checked"';
+                        $ssltossl = '';
+                    }
+                }
+                if (($values{$dom}{'vpnint'} ne '') || ($values{$dom}{'vpnext'} ne '')) {
+                    $vpndircheck = ' checked="checked"';
+                    $currwafvpn = ' style="display:table-row;"';
+                    $wafrangestyle = ' style="display:inline-block;"';
+                } else {
+                    $vpnaliascheck = ' checked="checked"';
+                    $currwafvpn = ' style="display:none;"';
+                }
+            }
+            $datatable .= '<tr'.$css_class.' id="nowafproxyrow_'.$dom.'"'.$wafstyle.'>'.
+                          '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'</td>'.
+                          '<td class="LC_right_item">'.&mt('WAF not in use, nothing to set').'</td>'.
+                          '</tr>'.
+                          '<tr'.$css_class.' id="wafproxyrow_'.$dom.'"'.$wafstyle.'>'.
+                          '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'<br /><br />'.
+                          '<div id="wafproxyranges_'.$dom.'">'.&mt('Format for comma separated IP ranges').':<br />'.
+                          &mt('A.B.C.D/N or A.B.C.D-E.F.G.H').'</div></td>'.
+                          '<td class="LC_left_item"><table>'.
+                          '<tr>'.
+                          '<td valign="top">'.$lt{'remoteip'}.':&nbsp;'.
+                          '<select name="wafproxy_remoteip" id="wafproxy_remoteip" onchange="javascript:updateWAF();">';
+            foreach my $option ('m','h','n') {
+                my $sel;
+                if ($option eq $curr_remotip) {
+                   $sel = ' selected="selected"';
+                }
+                $datatable .= '<option value="'.$option.'"'.$sel.'>'.
+                              $ip_methods{$option}.'</option>';
+            }
+            $datatable .= '</select></td></tr>'."\n".
+                          '<tr id="wafproxy_header"'.$currwafdisplay.'><td>'.
+                          $lt{'ipheader'}.':&nbsp;'.
+                          '<input type="text" value="'.$values{$dom}{'ipheader'}.'" '.
+                          'name="wafproxy_ipheader" />'.
+                          '</td></tr>'."\n".
+                          '<tr id="wafproxy_trust"'.$currwafdisplay.'><td>'.
+                          $lt{'trusted'}.':<br />'.
+                          '<textarea name="wafproxy_trusted" rows="3" cols="80">'.
+                          $values{$dom}{'trusted'}.'</textarea>'.
+                          '</td></tr>'."\n".
+                          '<tr><td><hr /></td></tr>'."\n".
+                          '<tr>'.
+                          '<td valign="top">'.$lt{'vpnaccess'}.':<br /><span class="LC_nobreak">'.
+                          '<label><input type="radio" name="wafproxy_vpnaccess"'.$vpndircheck.' value="1" onclick="javascript:checkWAF();" />'.
+                          $lt{'vpndirect'}.'</label>'.('&nbsp;'x2).
+                          '<label><input type="radio" name="wafproxy_vpnaccess"'.$vpnaliascheck.' value="0" onclick="javascript:checkWAF();" />'.
+                          $lt{'vpnaliased'}.'</label></span></td></tr>';
+            foreach my $item ('vpnint','vpnext') {
+                $datatable .= '<tr id="wafproxy_show_'.$item.'"'.$currwafvpn.'>'.
+                              '<td valign="top">'.$lt{$item}.':<br />'.
+                              '<textarea name="wafproxy_'.$item.'" rows="3" cols="80">'.
+                              $values{$dom}{$item}.'</textarea>'.
+                              '</td></tr>'."\n";
+            }
+            $datatable .= '<tr><td><hr /></td></tr>'."\n".
+                          '<tr>'.
+                          '<td valign="top">'.$lt{'sslopt'}.':<br /><span class="LC_nobreak">'.
+                          '<label><input type="radio" name="wafproxy_sslopt"'.$alltossl.' value="1" />'.
+                          $lt{'alltossl'}.'</label>'.('&nbsp;'x2).
+                          '<label><input type="radio" name="wafproxy_sslopt"'.$ssltossl.' value="0" />'.
+                          $lt{'ssltossl'}.'</label></span></td></tr>'."\n".
+                          '</table></td></tr>';
         }
         if (keys(%otherdoms)) {
             foreach my $domain (sort(keys(%otherdoms))) {
                 $itemcount ++;
                 $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
                 $datatable .= '<tr'.$css_class.'>'.
-                              '<td>'.&mt('Domain: [_1]',$domain).
-                              '<table>';
-                foreach my $item ('ipheader','trusted','exempt') {
+                              '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$domain.'</b>').'</td>'.
+                              '<td class="LC_left_item"><table>';
+                foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
                     my $showval = &mt('None');
+                    if ($item eq 'ssl') {
+                        $showval = $lt{'ssltossl'};
+                    }
                     if ($values{$domain}{$item}) {
-                        $showval = $values{$domain}{$item}; 
+                        $showval = $values{$domain}{$item};
+                        if ($item eq 'ssl') {
+                            $showval = $lt{'alltossl'};
+                        } elsif ($item eq 'remoteip') {
+                            $showval = $ip_methods{$values{$domain}{$item}};
+                        }
                     }
                     $datatable .= '<tr>'.
                                   '<td>'.$lt{$item}.':&nbsp;'.$showval.'</td></tr>';
                 }
-                $datatable .= '</table></td></tr>'; 
+                $datatable .= '</table></td></tr>';
             }
         }
     }
@@ -7300,9 +7768,25 @@ sub print_wafproxy {
 
 sub wafproxy_titles {
     return &Apache::lonlocal::texthash(
-               exempt => 'Exempt IP range(s)',
-               trusted => 'Trusted IP range(s)',
-               ipheader => 'Custom request header',
+               remoteip   => "Method for determining user's IP",
+               ipheader   => 'Request header containing remote IP',
+               trusted    => 'Trusted IP range(s)',
+               vpnaccess  => 'Access from institutional VPN',
+               vpndirect  => 'via regular hostname (no WAF)',
+               vpnaliased => 'via aliased hostname (WAF)',
+               vpnint     => 'Internal IP Range(s) for VPN sessions',
+               vpnext     => 'IP Range(s) for backend WAF connections',
+               sslopt     => 'Forwarding http/https',
+               alltossl   => 'WAF forwards both http and https requests to https',
+               ssltossl   => 'WAF forwards http requests to http and https to https',
+           );
+}
+
+sub remoteip_methods {
+    return &Apache::lonlocal::texthash(
+              m => 'Use Apache mod_remoteip',
+              h => 'Use headers parsed by LON-CAPA',
+              n => 'Not in use',
            );
 }
 
@@ -8341,8 +8825,8 @@ sub contact_titles {
                    'updatesmail'     => 'E-mail from nightly check of LON-CAPA module integrity/updates',
                    'idconflictsmail' => 'E-mail from bi-nightly check for multiple users sharing same student/employee ID',
                    'hostipmail'      => 'E-mail from nightly check of hostname/IP network changes',
-                   'errorthreshold'  => 'Error/warning threshold for status e-mail',
-                   'errorsysmail'    => 'Error threshold for e-mail to core group',
+                   'errorthreshold'  => 'Error count threshold for status e-mail to admin(s)',
+                   'errorsysmail'    => 'Error count threshold for e-mail to developer group',
                    'errorweights'    => 'Weights used to compute error count',
                    'errorexcluded'   => 'Servers with unsent updates excluded from count',
                  );
@@ -9392,7 +9876,7 @@ sub print_defaults {
                     $datatable .= '</select>&nbsp;'.&mt('Internal ID:').'&nbsp;<b>'.$item.'</b>&nbsp;'.
                                   '<input type="checkbox" name="inststatus_delete" value="'.$item.'" />'.
                                   &mt('delete').'</span></td>'.
-                                  '<td class="LC_left_item" colspan="2"><span class="LC_nobreak">'.&mt('Name displayed:').
+                                  '<td class="LC_left_item" colspan="2"><span class="LC_nobreak">'.&mt('Name displayed').':'.
                                   '<input type="text" size="20" name="inststatus_title_'.$item.'" value="'.$title.'" />'.
                                   '</span></td></tr>';
                 }
@@ -9412,7 +9896,7 @@ sub print_defaults {
                               '<input type="text" size="10" name="addinststatus" value="" />'.
                               '&nbsp;'.&mt('(new)').
                               '</span></td><td class="LC_left_item" colspan="2"><span class="LC_nobreak">'.
-                              &mt('Name displayed:').
+                              &mt('Name displayed').':'.
                               '<input type="text" size="20" name="addinststatus_title" value="" /></span></td>'.
                               '</tr>'."\n";
                 $rownum ++;
@@ -10421,7 +10905,7 @@ ENDSCRIPT
 sub initialize_categories {
     my ($itemcount) = @_;
     my ($datatable,$css_class,$chgstr);
-    my %default_names = (
+    my %default_names = &Apache::lonlocal::texthash (
                       instcode    => 'Official courses (with institutional codes)',
                       communities => 'Communities',
                       placement   => 'Placement Tests',
@@ -10920,12 +11404,14 @@ sub usertype_update_row {
 sub modify_login {
     my ($r,$dom,$confname,$lastactref,%domconfig) = @_;
     my ($resulttext,$errors,$colchgtext,%changes,%colchanges,%newfile,%newurl,
-        %curr_loginvia,%loginhash,@currlangs,@newlangs,$addedfile,%title,@offon);
+        %curr_loginvia,%loginhash,@currlangs,@newlangs,$addedfile,%title,@offon,
+        %currsaml,%saml,%samltext,%samlimg,%samlalt,%samlurl,%samltitle,%samlnotsso);
     %title = ( coursecatalog => 'Display course catalog',
                adminmail => 'Display administrator E-mail address',
                helpdesk  => 'Display "Contact Helpdesk" link',
                newuser => 'Link for visitors to create a user account',
-               loginheader => 'Log-in box header');
+               loginheader => 'Log-in box header',
+               saml => 'Dual SSO and non-SSO login');
     @offon = ('off','on');
     if (ref($domconfig{login}) eq 'HASH') {
         if (ref($domconfig{login}{loginvia}) eq 'HASH') {
@@ -10933,6 +11419,20 @@ sub modify_login {
                 $curr_loginvia{$lonhost} = $domconfig{login}{loginvia}{$lonhost};
             }
         }
+        if (ref($domconfig{login}{'saml'}) eq 'HASH') {
+            foreach my $lonhost (keys(%{$domconfig{login}{'saml'}})) {
+                if (ref($domconfig{login}{'saml'}{$lonhost}) eq 'HASH') {
+                    $currsaml{$lonhost} = $domconfig{login}{'saml'}{$lonhost};
+                    $saml{$lonhost} = 1;
+                    $samltext{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'text'};
+                    $samlurl{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'url'};
+                    $samlalt{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'alt'};
+                    $samlimg{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'img'};
+                    $samltitle{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'title'};
+                    $samlnotsso{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'notsso'};
+                }
+            }
+        }
     }
     ($errors,%colchanges) = &modify_colors($r,$dom,$confname,['login'],
                                            \%domconfig,\%loginhash);
@@ -11179,6 +11679,86 @@ sub modify_login {
             $errors .= '<li><span class="LC_error">'.$error.'</span></li>';
         }
     }
+    my @delsamlimg = &Apache::loncommon::get_env_multiple('form.saml_img_del');
+    my @newsamlimgs;
+    foreach my $lonhost (keys(%domservers)) {
+        if ($env{'form.saml_'.$lonhost}) {
+            if ($env{'form.saml_img_'.$lonhost.'.filename'}) {
+                push(@newsamlimgs,$lonhost);
+            }
+            foreach my $item ('text','alt','url','title','notsso') {
+                $env{'form.saml_'.$item.'_'.$lonhost} =~ s/^\s+|\s+$//g;
+            }
+            if ($saml{$lonhost}) {
+                if (grep(/^\Q$lonhost\E$/,@delsamlimg)) {
+#FIXME Need to obsolete published image
+                    delete($currsaml{$lonhost}{'img'});
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_alt_'.$lonhost} ne $samlalt{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_text_'.$lonhost} ne $samltext{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_url_'.$lonhost} ne $samlurl{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_title_'.$lonhost} ne $samltitle{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_notsso_'.$lonhost} ne $samlnotsso{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+            } else {
+                $changes{'saml'}{$lonhost} = 1;
+            }
+            foreach my $item ('text','alt','url','title','notsso') {
+                $currsaml{$lonhost}{$item} = $env{'form.saml_'.$item.'_'.$lonhost};
+            }
+        } else {
+            delete($currsaml{$lonhost});
+        }
+    }
+    foreach my $posshost (keys(%currsaml)) {
+        unless (exists($domservers{$posshost})) { 
+            delete($currsaml{$posshost}); 
+        }
+    }
+    %{$loginhash{'login'}{'saml'}} = %currsaml;
+    if (@newsamlimgs) {
+        my $error;
+        my ($configuserok,$author_ok,$switchserver) = &config_check($dom,$confname,$servadm);
+        if ($configuserok eq 'ok') {
+            if ($switchserver) {
+                $error = &mt("Upload of SSO Button Image is not permitted to this server: [_1].",$switchserver);
+            } elsif ($author_ok eq 'ok') {
+                foreach my $lonhost (@newsamlimgs) {
+                    my $formelem = 'saml_img_'.$lonhost;
+                    my ($result,$imgurl) = &publishlogo($r,'upload',$formelem,$dom,$confname,
+                                                        "login/saml/$lonhost",'','',
+                                                        $env{'form.saml_img_'.$lonhost.'.filename'});
+                    if ($result eq 'ok') {
+                        $currsaml{$lonhost}{'img'} = $imgurl;
+                        $loginhash{'login'}{'saml'}{$lonhost}{'img'} = $imgurl;
+                        $changes{'saml'}{$lonhost} = 1;
+                    } else {
+                        my $puberror = &mt("Upload of SSO button image failed for [_1] because an error occurred publishing the file in RES space. Error was: [_2].",
+                                           $lonhost,$result);
+                        $errors .= '<li><span class="LC_error">'.$puberror.'</span></li>';
+                    }
+                }
+            } else {
+                $error = &mt("Upload of SSO button image file(s) failed because an author role could not be assigned to a Domain Configuration user ([_1]) in domain: [_2].  Error was: [_3].",$confname,$dom,$author_ok);
+            }
+        } else {
+            $error = &mt("Upload of SSO button image file(s) failed because a Domain Configuration user ([_1]) could not be created in domain: [_2].  Error was: [_3].",$confname,$dom,$configuserok);
+        }
+        if ($error) {
+            &Apache::lonnet::logthis($error);
+            $errors .= '<li><span class="LC_error">'.$error.'</span></li>';
+        }
+    }
     &process_captcha('login',\%changes,$loginhash{'login'},$domconfig{'login'});
 
     my $defaulthelpfile = '/adm/loginproblems.html';
@@ -11219,6 +11799,31 @@ sub modify_login {
         }
         if (keys(%changes) > 0 || $colchgtext) {
             &Apache::loncommon::devalidate_domconfig_cache($dom);
+            if (exists($changes{'saml'})) {
+                my $hostid_in_use;
+                my @hosts = &Apache::lonnet::current_machine_ids();
+                if (@hosts > 1) {
+                    foreach my $hostid (@hosts) {
+                        if (&Apache::lonnet::host_domain($hostid) eq $dom) {
+                            $hostid_in_use = $hostid;
+                            last;
+                        }
+                    }
+                } else {
+                    $hostid_in_use = $r->dir_config('lonHostID');
+                }
+                if (($hostid_in_use) &&
+                    (&Apache::lonnet::host_domain($hostid_in_use) eq $dom)) {
+                    &Apache::lonnet::devalidate_cache_new('samllanding',$hostid_in_use);
+                }
+                if (ref($lastactref) eq 'HASH') {
+                    if (ref($changes{'saml'}) eq 'HASH') {
+                        my %updates;
+                        map { $updates{$_} = 1; } keys(%{$changes{'saml'}});
+                        $lastactref->{'samllanding'} = \%updates;
+                    }
+                }
+            }
             if (ref($lastactref) eq 'HASH') {
                 $lastactref->{'domainconfig'} = 1;
             }
@@ -11298,6 +11903,38 @@ sub modify_login {
                             }
                         }
                     }
+                } elsif ($item eq 'saml') {
+                    if (ref($changes{$item}) eq 'HASH') {
+                        my %notlt = (
+                                       text   => 'Text for log-in by SSO',
+                                       img    => 'SSO button image',
+                                       alt    => 'Alt text for button image',
+                                       url    => 'SSO URL',
+                                       title  => 'Tooltip for SSO link',
+                                       notsso => 'Text for non-SSO log-in',
+                                    );
+                        foreach my $lonhost (sort(keys(%{$changes{$item}}))) {
+                            if (ref($currsaml{$lonhost}) eq 'HASH') {
+                                $resulttext .= '<li>'.&mt("$title{$item} in use for [_1]","<b>$lonhost</b>").
+                                               '<ul>';
+                                foreach my $key ('text','img','alt','url','title','notsso') {
+                                    if ($currsaml{$lonhost}{$key} eq '') {
+                                        $resulttext .= '<li>'.&mt("$notlt{$key} not in use").'</li>';
+                                    } else {
+                                        my $value = "'$currsaml{$lonhost}{$key}'";
+                                        if ($key eq 'img') {
+                                            $value = '<img src="'.$currsaml{$lonhost}{$key}.'" />';
+                                        }
+                                        $resulttext .= '<li>'.&mt("$notlt{$key} set to: [_1]",
+                                                                  $value).'</li>';
+                                    }
+                                }
+                                $resulttext .= '</ul></li>';
+                            } else {
+                                $resulttext .= '<li>'.&mt("$title{$item} not in use for [_1]",$lonhost).'</li>';
+                            }
+                        }
+                    }
                 } elsif ($item eq 'captcha') {
                     if (ref($loginhash{'login'}) eq 'HASH') {
                         my $chgtxt;
@@ -13266,7 +13903,7 @@ sub modify_ltitools {
         my %ltienchash = (
                              $action => { %encconfig }
                          );
-        &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom);
+        &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom,undef,1);
         if (keys(%changes) > 0) {
             my $cachetime = 24*60*60;
             my %ltiall = %confhash;
@@ -13840,7 +14477,7 @@ sub modify_proctoring {
         my %proc_enchash = (
                              $action => { %encconfhash }
                          );
-        &Apache::lonnet::put_dom('encconfig',\%proc_enchash,$dom);
+        &Apache::lonnet::put_dom('encconfig',\%proc_enchash,$dom,undef,1);
         if (keys(%changes) > 0) {
             my $cachetime = 24*60*60;
             my %procall = %confhash;
@@ -14332,7 +14969,7 @@ sub modify_lti {
         my %ltienchash = (
                              $action => { %encconfig }
                          );
-        &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom);
+        &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom,undef,1);
         if (keys(%changes) > 0) {
             my $cachetime = 24*60*60;
             my %ltiall = %confhash;
@@ -14674,8 +15311,10 @@ sub modify_autoupdate {
     }
     my @offon = ('off','on');
     my %title = &Apache::lonlocal::texthash (
-                   run => 'Auto-update:',
-                   classlists => 'Updates to user information in classlists?'
+                    run        => 'Auto-update:',
+                    classlists => 'Updates to user information in classlists?',
+                    unexpired  => 'Skip updates for users without active or future roles?',
+                    lastactive => 'Skip updates for inactive users?',
                 );
     my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
     my %fieldtitles = &Apache::lonlocal::texthash (
@@ -14719,12 +15358,23 @@ sub modify_autoupdate {
     my %updatehash = (
                       autoupdate => { run => $env{'form.autoupdate_run'},
                                       classlists => $env{'form.classlists'},
+                                      unexpired  => $env{'form.unexpired'},
                                       fields => {%fields},
                                       lockablenames => \@lockablenames,
                                     }
                      );
+    my $lastactivedays;
+    if ($env{'form.lastactive'}) {
+        $lastactivedays = $env{'form.lastactivedays'};
+        $lastactivedays =~ s/^\s+|\s+$//g;
+        unless ($lastactivedays =~ /^\d+$/) {
+            undef($lastactivedays);
+            $env{'form.lastactive'} = 0;
+        }
+    }
+    $updatehash{'autoupdate'}{'lastactive'} = $lastactivedays;
     foreach my $key (keys(%currautoupdate)) {
-        if (($key eq 'run') || ($key eq 'classlists')) {
+        if (($key eq 'run') || ($key eq 'classlists') || ($key eq 'unexpired') || ($key eq 'lastactive')) {
             if (exists($updatehash{autoupdate}{$key})) {
                 if ($currautoupdate{$key} ne $updatehash{autoupdate}{$key}) {
                     $changes{$key} = 1;
@@ -14770,6 +15420,16 @@ sub modify_autoupdate {
             $changes{'lockablenames'} = 1;
         }
     }
+    unless (grep(/^unexpired$/,keys(%currautoupdate))) {
+        if ($updatehash{'autoupdate'}{'unexpired'}) {
+            $changes{'unexpired'} = 1;
+        }
+    }
+    unless (grep(/^lastactive$/,keys(%currautoupdate))) {
+        if ($updatehash{'autoupdate'}{'lastactive'} ne '') {
+            $changes{'lastactive'} = 1;
+        }
+    }
     foreach my $item (@{$types},'default') {
         if (defined($fields{$item})) {
             if (ref($currautoupdate{'fields'}) eq 'HASH') {
@@ -14832,6 +15492,11 @@ sub modify_autoupdate {
                     my $newvalue;
                     if ($key eq 'run') {
                         $newvalue = $offon[$env{'form.autoupdate_run'}];
+                    } elsif ($key eq 'lastactive') {
+                        $newvalue = $offon[$env{'form.lastactive'}];
+                        unless ($lastactivedays eq '') {
+                            $newvalue .= '; '.&mt('inactive = no activity in last [quant,_1,day]',$lastactivedays);
+                        }
                     } else {
                         $newvalue = $offon[$env{'form.'.$key}];
                     }
@@ -15196,7 +15861,7 @@ sub modify_contacts {
                 $contacts_hash{'contacts'}{'lonstatus'}{$item} = \@excluded;
             }
         } elsif ($item eq 'weights') {
-            foreach my $type ('E','W','N') {
+            foreach my $type ('E','W','N','U') {
                 $env{'form.error'.$item.'_'.$type} =~ s/^\s+|\s+$//g;
                 if ($env{'form.error'.$item.'_'.$type} =~ /^\d+$/) {
                     unless ($env{'form.error'.$item.'_'.$type} == $lonstatus_defs->{$type}) {
@@ -16363,7 +17028,7 @@ sub modify_passwords {
                                 $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA used for verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
                             }
                         } else {
-                            $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA usedfor verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
+                            $resulttext .= '<li>'.&mt('E-mail address(es) in LON-CAPA used for verification will include: [_1]',join(', ',map { $titles{$_}; } @{$staticdefaults{'resetemail'}})).'</li>';
                         }
                         if ($confighash{'passwords'}{'resetremove'}) {
                             $resulttext .= '<li>'.&mt('Preamble to "Forgot Password" web form not shown').'</li>';
@@ -19579,26 +20244,33 @@ sub modify_wafproxy {
             my $serverdom = &Apache::lonnet::host_domain($server);
             if ($serverdom eq $dom) {
                 $canset{$server} = 1;
-                if (ref($domconfig{'wafproxy'}) eq 'HASH') {
-                    %{$values{$dom}} = ();
-                    if (ref($domconfig{'wafproxy'}{'alias'}) eq 'HASH') {
-                        %curralias = %{$domconfig{'wafproxy'}{'alias'}};
-                    }
-                    foreach my $item ('ipheader','trusted','exempt') {
-                        $currvalue{$item} = $domconfig{'wafproxy'}{$item};
-                    }
-                }
             }
         }
     }
+    if (ref($domconfig{'wafproxy'}) eq 'HASH') {
+        %{$values{$dom}} = ();
+        if (ref($domconfig{'wafproxy'}{'alias'}) eq 'HASH') {
+            %curralias = %{$domconfig{'wafproxy'}{'alias'}};
+        }
+        foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
+            $currvalue{$item} = $domconfig{'wafproxy'}{$item};
+        }
+    }
     my $output;
     if (keys(%canset)) {
         %{$wafproxy{'alias'}} = ();
         foreach my $key (sort(keys(%canset))) {
-            $wafproxy{'alias'}{$key} = $env{'form.wafproxy_alias_'.$key};
-            $wafproxy{'alias'}{$key} =~ s/^\s+|\s+$//g;
-            if ($wafproxy{'alias'}{$key} ne $curralias{$key}) {
-                $changes{'alias'} = 1;
+            if ($env{'form.wafproxy_'.$dom}) {
+                $wafproxy{'alias'}{$key} = $env{'form.wafproxy_alias_'.$key};
+                $wafproxy{'alias'}{$key} =~ s/^\s+|\s+$//g;
+                if ($wafproxy{'alias'}{$key} ne $curralias{$key}) {
+                    $changes{'alias'} = 1;
+                }
+            } else {
+                $wafproxy{'alias'}{$key} = '';
+                if ($curralias{$key}) {
+                    $changes{'alias'} = 1;
+                }
             }
             if ($wafproxy{'alias'}{$key} eq '') {
                 if ($curralias{$key}) {
@@ -19613,21 +20285,43 @@ sub modify_wafproxy {
         # Localization for values in %warn occus in &mt() calls separately.
         my %warn = (
                      trusted => 'trusted IP range(s)',
-                     exempt => 'exempt IP range(s)', 
+                     vpnint => 'internal IP range(s) for VPN sessions(s)',
+                     vpnext => 'IP range(s) for backend WAF connections',
                    );
-        foreach my $item ('ipheader','trusted','exempt') {
+        foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
             my $possible = $env{'form.wafproxy_'.$item};
             $possible =~ s/^\s+|\s+$//g;
             if ($possible ne '') {
-                if ($item eq 'ipheader') {
-                    $wafproxy{$item} = $possible;
+                if ($item eq 'remoteip') {
+                    if ($possible =~ /^[mhn]$/) {
+                        $wafproxy{$item} = $possible;
+                    }
+                } elsif ($item eq 'ipheader') {
+                    if ($wafproxy{'remoteip'} eq 'h') {
+                        $wafproxy{$item} = $possible;
+                    }
+                } elsif ($item eq 'sslopt') {
+                    if ($possible =~ /^0|1$/) {
+                        $wafproxy{$item} = $possible;
+                    }
                 } else {
                     my (@ok,$count);
-                    $possible =~ s/[\r\n]+/\s/g;
-                    $possible =~ s/\s*-\s*/-/g;
-                    $possible =~ s/\s+/,/g;
+                    if (($item eq 'vpnint') || ($item eq 'vpnext')) {
+                        unless ($env{'form.wafproxy_vpnaccess'}) {
+                            $possible = '';
+                        }
+                    } elsif ($item eq 'trusted') {
+                        unless ($wafproxy{'remoteip'} eq 'h') {
+                            $possible = '';
+                        }
+                    }
+                    unless ($possible eq '') {
+                        $possible =~ s/[\r\n]+/\s/g;
+                        $possible =~ s/\s*-\s*/-/g;
+                        $possible =~ s/\s+/,/g;
+                    }
                     $count = 0;
-                    if ($possible) {
+                    if ($possible ne '') {
                         foreach my $poss (split(/\,/,$possible)) {
                             $count ++;
                             if (&validate_ip_pattern($poss)) {
@@ -19644,15 +20338,22 @@ sub modify_wafproxy {
                                      $diff,$warn{$item}).
                                  '</li>');
                         }
-                        if ($wafproxy{$item} ne $currvalue{$item}) {
-                            $changes{$item} = 1; 
-                        }
                     }
                 }
-            } else {
-                if ($currvalue{$item}) {
+                if ($wafproxy{$item} ne $currvalue{$item}) {
                     $changes{$item} = 1;
                 }
+            } elsif ($currvalue{$item}) {
+                $changes{$item} = 1;
+            } 
+        }
+    } else {
+        if (keys(%curralias)) {
+            $changes{'alias'} = 1;
+        } 
+        if (keys(%currvalue)) {
+            foreach my $key (keys(%currvalue)) {
+                $changes{$key} = 1;
             }
         }
     }
@@ -19665,7 +20366,7 @@ sub modify_wafproxy {
         if ($putresult eq 'ok') {
             my $cachetime = 24*60*60;
             my (%domdefaults,$updatedomdefs);
-            foreach my $item ('ipheader','trusted','exempt') {
+            foreach my $item ('ipheader','trusted','vpnint','vpnext','sslopt') {
                 if ($changes{$item}) {
                     unless ($updatedomdefs) {
                         %domdefaults = &Apache::lonnet::get_domain_defaults($dom);
@@ -19702,7 +20403,7 @@ sub modify_wafproxy {
                 }
             }
             $output = &mt('Changes were made to Web Application Firewall/Reverse Proxy').'<ul>';
-            foreach my $item ('alias','ipheader','trusted','exempt') {
+            foreach my $item ('alias','remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
                 if ($changes{$item}) {
                     if ($item eq 'alias') {
                         my $numaliased = 0;
@@ -19725,26 +20426,52 @@ sub modify_wafproxy {
                             $output .= '<li>'.&mt('Aliases deleted for hostnames').'</li>';
                         }
                     } else {
-                        if ($item eq 'ipheader') {
+                        if ($item eq 'remoteip') {
+                            my %ip_methods = &remoteip_methods();
+                            if ($wafproxy{$item} =~ /^[mh]$/) {
+                                $output .= '<li>'.&mt("Method for determining user's IP set to: [_1]",
+                                                      $ip_methods{$wafproxy{$item}}).'</li>';
+                            } else {
+                                if (($env{'form.wafproxy_'.$dom}) && (ref($wafproxy{'alias'}) eq 'HASH')) {
+                                    $output .= '<li>'.&mt("No method in use to get user's real IP (will report IP used by WAF).").
+                                               '</li>';
+                                } else {
+                                    $output .= '<li>'.&mt('WAF/Reverse Proxy not in use').'</li>';
+                                }
+                            }
+                        } elsif ($item eq 'ipheader') {
                             if ($wafproxy{$item}) {
-                                $output .= '<li>'.&mt('Custom request header set to [_1]',
+                                $output .= '<li>'.&mt('Request header with remote IP set to: [_1]',
                                                       $wafproxy{$item}).'</li>';
                             } else {
-                                $output .= '<li>'.&mt('Custom request header deleted').'</li>';
+                                $output .= '<li>'.&mt('Request header with remote IP deleted').'</li>';
                             }
                         } elsif ($item eq 'trusted') {
                             if ($wafproxy{$item}) {
-                                $output .= '<li>'.&mt('Trusted IP range(s) set to [_1]',
+                                $output .= '<li>'.&mt('Trusted IP range(s) set to: [_1]',
                                                       $wafproxy{$item}).'</li>';
                             } else {
                                 $output .= '<li>'.&mt('Trusted IP range(s) deleted').'</li>';
                             }
-                        } elsif ($item eq 'exempt') {
+                        } elsif ($item eq 'vpnint') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('Internal IP Range(s) for VPN sessions set to: [_1]',
+                                                       $wafproxy{$item}).'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('Internal IP Range(s) for VPN sessions deleted').'</li>';
+                            }
+                        } elsif ($item eq 'vpnext') {
                             if ($wafproxy{$item}) {
-                                $output .= '<li>'.&mt('Exempt IP range(s) set to [_1]',
+                                $output .= '<li>'.&mt('IP Range(s) for backend WAF connections set to: [_1]',
                                                        $wafproxy{$item}).'</li>';
                             } else {
-                                $output .= '<li>'.&mt('Exempt IP range(s) deleted').'</li>';
+                                $output .= '<li>'.&mt('IP Range(s) for backend WAF connections deleted').'</li>';
+                            }
+                        } elsif ($item eq 'sslopt') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('WAF/Reverse Proxy expected to forward requests to https on LON-CAPA node, regardless of original protocol in web browser (http or https).').'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('WAF/Reverse Proxy expected to preserve original protocol in web browser (either http or https) when forwarding to LON-CAPA node.').'</li>';
                             }
                         }
                     }
@@ -20713,24 +21440,24 @@ sub modify_loadbalancing {
                             $resulttext .= '<li>'.&mt('Load Balancer: [_1] -- cookie use enabled',
                                                       $balancer).'</li>'; 
                         }
-                        if (keys(%toupdate)) {
-                            my %thismachine;
-                            my $updatedhere;
-                            my $cachetime = 60*60*24;
-                            map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
-                            foreach my $lonhost (keys(%toupdate)) {
-                                if ($thismachine{$lonhost}) {
-                                    unless ($updatedhere) {
-                                        &Apache::lonnet::do_cache_new('loadbalancing',$dom,
-                                                                      $defaultshash{'loadbalancing'},
-                                                                      $cachetime);
-                                        $updatedhere = 1;
-                                    }
-                                } else {
-                                    my $cachekey = &escape('loadbalancing').':'.&escape($dom);
-                                    &Apache::lonnet::remote_devalidate_cache($lonhost,[$cachekey]);
-                                }
+                    }
+                }
+                if (keys(%toupdate)) {
+                    my %thismachine;
+                    my $updatedhere;
+                    my $cachetime = 60*60*24;
+                    map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
+                    foreach my $lonhost (keys(%toupdate)) {
+                        if ($thismachine{$lonhost}) {
+                            unless ($updatedhere) {
+                                &Apache::lonnet::do_cache_new('loadbalancing',$dom,
+                                                              $defaultshash{'loadbalancing'},
+                                                              $cachetime);
+                                $updatedhere = 1;
                             }
+                        } else {
+                            my $cachekey = &escape('loadbalancing').':'.&escape($dom);
+                            &Apache::lonnet::remote_devalidate_cache($lonhost,[$cachekey]);
                         }
                     }
                 }
@@ -21492,6 +22219,25 @@ sub devalidate_remote_domconfs {
     map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
     my @posscached = ('domainconfig','domdefaults','ltitools','usersessions',
                       'directorysrch','passwdconf','cats','proxyalias');
+    my %cache_by_lonhost;
+    if (exists($cachekeys->{'samllanding'})) {
+        if (ref($cachekeys->{'samllanding'}) eq 'HASH') {
+            my %landing = %{$cachekeys->{'samllanding'}};
+            my %domservers = &Apache::lonnet::get_servers($dom);
+            if (keys(%domservers)) {
+                foreach my $server (keys(%domservers)) {
+                    my @cached;
+                    next if ($thismachine{$server});
+                    if ($landing{$server}) {
+                        push(@cached,&escape('samllanding').':'.&escape($server));
+                    }
+                    if (@cached) {
+                        $cache_by_lonhost{$server} = \@cached;
+                    }
+                }
+            }
+        }
+    }
     if (keys(%servers)) {
         foreach my $server (keys(%servers)) {
             next if ($thismachine{$server});
@@ -21499,7 +22245,7 @@ sub devalidate_remote_domconfs {
             foreach my $name (@posscached) {
                 if ($cachekeys->{$name}) {
                     if ($name eq 'proxyalias') {
-                        if (ref($cachekeys->{$name}) eq 'HASH') {  
+                        if (ref($cachekeys->{$name}) eq 'HASH') {
                             foreach my $key (keys(%{$cachekeys->{$name}})) {
                                 push(@cached,&escape($name).':'.&escape($key));
                             }
@@ -21509,6 +22255,10 @@ sub devalidate_remote_domconfs {
                     }
                 }
             }
+            if ((exists($cache_by_lonhost{$server})) &&
+                (ref($cache_by_lonhost{$server}) eq 'ARRAY')) {
+                push(@cached,@{$cache_by_lonhost{$server}});
+            }
             if (@cached) {
                 &Apache::lonnet::remote_devalidate_cache($server,\@cached);
             }