--- loncom/interface/loncreateuser.pm	2017/08/07 20:22:13	1.444
+++ loncom/interface/loncreateuser.pm	2019/04/29 22:19:24	1.451
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Create a user
 #
-# $Id: loncreateuser.pm,v 1.444 2017/08/07 20:22:13 raeburn Exp $
+# $Id: loncreateuser.pm,v 1.451 2019/04/29 22:19:24 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -78,6 +78,7 @@ my $authformkrb;
 my $authformint;
 my $authformfsys;
 my $authformloc;
+my $authformlti;
 
 sub initialize_authen_forms {
     my ($dom,$formname,$curr_authtype,$mode) = @_;
@@ -88,7 +89,7 @@ sub initialize_authen_forms {
                   domain => $dom,
                 );
     my %abv_auth = &auth_abbrev();
-    if ($curr_authtype =~ /^(krb4|krb5|internal|localauth|unix):(.*)$/) {
+    if ($curr_authtype =~ /^(krb4|krb5|internal|localauth|unix|lti):(.*)$/) {
         my $long_auth = $1;
         my $curr_autharg = $2;
         my %abv_auth = &auth_abbrev();
@@ -107,6 +108,7 @@ sub initialize_authen_forms {
     $authformint  = &Apache::loncommon::authform_internal(%param);
     $authformfsys = &Apache::loncommon::authform_filesystem(%param);
     $authformloc  = &Apache::loncommon::authform_local(%param);
+    $authformlti  = &Apache::loncommon::authform_lti(%param);
 }
 
 sub auth_abbrev {
@@ -116,6 +118,7 @@ sub auth_abbrev {
                      internal  => 'int',
                      localauth => 'loc',
                      unix      => 'fsys',
+                     lti       => 'lti',
                    );
     return %abv_auth;
 }
@@ -253,14 +256,15 @@ sub build_tools_display {
                    'community'  => 'Can request creation of communities',
                    'textbook'   => 'Can request creation of textbook courses',
                    'placement'  => 'Can request creation of placement tests',
+                   'lti'        => 'Can request creation of LTI courses',
                    'requestauthor'  => 'Can request author space',
     );
     if ($context eq 'requestcourses') {
         %userenv = &Apache::lonnet::userenvironment($ccdomain,$ccuname,
                       'requestcourses.official','requestcourses.unofficial',
                       'requestcourses.community','requestcourses.textbook',
-                      'requestcourses.placement');
-        @usertools = ('official','unofficial','community','textbook','placement');
+                      'requestcourses.placement','requestcourses.lti');
+        @usertools = ('official','unofficial','community','textbook','placement','lti');
         @options =('norequest','approval','autolimit','validate');
         %validations = &Apache::lonnet::auto_courserequest_checks($ccdomain);
         %reqtitles = &courserequest_titles();
@@ -543,6 +547,7 @@ sub courserequest_titles {
                                    community  => 'Communities',
                                    textbook   => 'Textbook',
                                    placement  => 'Placement Tests',
+                                   lti        => 'LTI Provider',
                                    norequest  => 'Not allowed',
                                    approval   => 'Approval by Dom. Coord.',
                                    validate   => 'With validation',
@@ -886,15 +891,15 @@ ENDBLOCK
         (!(($env{'form.action'} eq 'singleuser') && ($context eq 'domain') &&
         (!&Apache::lonnet::allowed('mau',$env{'request.role.domain'}))))) {
         my $defdom=$env{'request.role.domain'};
-        my ($trustedref,$untrustedref);
+        my ($trusted,$untrusted);
         if ($context eq 'course') {
-            ($trustedref,$untrustedref) = &Apache::lonnet::trusted_domains('enroll',$defdom);
+            ($trusted,$untrusted) = &Apache::lonnet::trusted_domains('enroll',$defdom);
         } elsif ($context eq 'author') {
-            ($trustedref,$untrustedref) = &Apache::lonnet::trusted_domains('othcoau',$defdom);
+            ($trusted,$untrusted) = &Apache::lonnet::trusted_domains('othcoau',$defdom);
         } elsif ($context eq 'domain') {
-            ($trustedref,$untrustedref) = &Apache::lonnet::trusted_domains('domroles',$defdom); 
+            ($trusted,$untrusted) = &Apache::lonnet::trusted_domains('domroles',$defdom); 
         }
-        my $domform = &Apache::loncommon::select_dom_form($defdom,'srchdomain',undef,undef,undef,$trustedref,$untrustedref);
+        my $domform = &Apache::loncommon::select_dom_form($defdom,'srchdomain',undef,undef,undef,$trusted,$untrusted);
         my %lt=&Apache::lonlocal::texthash(
                   'enro' => 'Enroll one student',
                   'enrm' => 'Enroll one member',
@@ -1479,17 +1484,21 @@ ENDAUTH
                                          $inst_results{$ccuname.':'.$ccdomain}));
         if ((&Apache::lonnet::allowed('ccc',$env{'request.role.domain'})) ||
             (&Apache::lonnet::allowed('udp',$env{'request.role.domain'}))) {
-            $r->print('<br /><h3>'.&mt('User Can Request Creation of Courses/Communities in this Domain?').'</h3>'.
-                      &Apache::loncommon::start_data_table());
-            if ($env{'request.role.domain'} eq $ccdomain) {
-                $r->print(&build_tools_display($ccuname,$ccdomain,'requestcourses'));
-            } else {
-                if (&Apache::lonnet::will_trust('reqcrs',$ccdomain,$env{'request.role.domain'})) {
+            $r->print('<br /><h3>'.&mt('User Can Request Creation of Courses/Communities in this Domain?').'</h3>'."\n");
+            if (($env{'request.role.domain'} eq $ccdomain) ||
+                (&Apache::lonnet::will_trust('reqcrs',$ccdomain,$env{'request.role.domain'}))) {
+                $r->print(&Apache::loncommon::start_data_table());
+                if ($env{'request.role.domain'} eq $ccdomain) {
+                    $r->print(&build_tools_display($ccuname,$ccdomain,'requestcourses'));
+                } else {
                     $r->print(&coursereq_externaluser($ccuname,$ccdomain,
                                                       $env{'request.role.domain'}));
                 }
+                $r->print(&Apache::loncommon::end_data_table());
+            } else {
+                $r->print(&mt('Domain configuration for this domain prohibits course creation by users from domain: "[_1]"',
+                              &Apache::lonnet::domain($ccdomain,'description')));
             }
-            $r->print(&Apache::loncommon::end_data_table());
         }
         $r->print('</div>');
         my @order = ('auth','quota','tools','requestauthor');
@@ -1502,7 +1511,7 @@ ENDAUTH
              ($env{'request.role.domain'} eq $ccdomain)) {
             $user_text{'requestauthor'} = &domainrole_req($ccuname,$ccdomain);
         }
-        $user_text{'auth'} =  &user_authentication($ccuname,$ccdomain,$formname);
+        $user_text{'auth'} =  &user_authentication($ccuname,$ccdomain,$formname,$crstype,$permission);
         if ((&Apache::lonnet::allowed('mpq',$ccdomain)) ||
             (&Apache::lonnet::allowed('mut',$ccdomain)) ||
             (&Apache::lonnet::allowed('udp',$ccdomain))) {
@@ -2145,11 +2154,20 @@ sub new_domain_roles {
     '<th>'.&mt('Start').'</th><th>'.&mt('End').'</th>'.
     &Apache::loncommon::end_data_table_header_row();
     my @allroles = &Apache::lonuserutils::roles_by_context('domain');
+    my $uprimary = &Apache::lonnet::domain($env{'request.role.domain'},'primary');
+    my $uintdom = &Apache::lonnet::internet_dom($uprimary);
     foreach my $thisdomain (sort(&Apache::lonnet::all_domains())) {
         foreach my $role (@allroles) {
             next if ($role eq 'ad');
             next if (($role eq 'au') && ($ccdomain ne $thisdomain));
             if (&Apache::lonnet::allowed('c'.$role,$thisdomain)) {
+               if ($role eq 'dc') {
+                   unless ($thisdomain eq $env{'request.role.domain'}) {
+                       my $domprim = &Apache::lonnet::domain($thisdomain,'primary');
+                       my $intdom = &Apache::lonnet::internet_dom($domprim);
+                       next unless ($uintdom eq $intdom);
+                   }
+               }
                my $plrole=&Apache::lonnet::plaintext($role);
                my %lt=&Apache::lonlocal::texthash(
                     'ssd'  => "Set Start Date",
@@ -2180,7 +2198,7 @@ sub new_domain_roles {
 }
 
 sub user_authentication {
-    my ($ccuname,$ccdomain,$formname) = @_;
+    my ($ccuname,$ccdomain,$formname,$crstype,$permission) = @_;
     my $currentauth=&Apache::lonnet::queryauthenticate($ccuname,$ccdomain);
     my $outcome;
     my %lt=&Apache::lonlocal::texthash(
@@ -2191,7 +2209,7 @@ sub user_authentication {
                    'ld'    => "Login Data"
     );
     # Check for a bad authentication type
-    if ($currentauth !~ /^(krb4|krb5|unix|internal|localauth):/) {
+    if ($currentauth !~ /^(krb4|krb5|unix|internal|localauth|lti):/) {
         # bad authentication scheme
         if (&Apache::lonnet::allowed('mau',$ccdomain)) {
             &initialize_authen_forms($ccdomain,$formname);
@@ -2253,6 +2271,43 @@ ENDBADAUTH
             }
             $outcome .= &Apache::loncommon::end_data_table();
         } else {
+            if (($currentauth =~ /^internal:/) &&
+                (&Apache::lonuserutils::can_change_internalpass($ccuname,$ccdomain,$crstype,$permission))) {
+                $outcome = <<"ENDJS";
+<script type="text/javascript">
+// <![CDATA[
+function togglePwd(form) {
+    if (form.newintpwd.length) {
+        if (document.getElementById('LC_ownersetpwd')) {
+            for (var i=0; i<form.newintpwd.length; i++) {
+                if (form.newintpwd[i].checked) {
+                    if (form.newintpwd[i].value == 1) {
+                        document.getElementById('LC_ownersetpwd').style.display = 'inline-block';
+                    } else {
+                        document.getElementById('LC_ownersetpwd').style.display = 'none';
+                    }
+                }
+            }
+        }
+    }
+}
+// ]]>
+</script>
+ENDJS
+
+                $outcome .= '<h3>'.$lt{'ld'}.'</h3>'.
+                            &Apache::loncommon::start_data_table().
+                            &Apache::loncommon::start_data_table_row().
+                            '<td>'.&mt('Internally authenticated').'<br />'.&mt("Change user's password?").
+                            '<label><input type="radio" name="newintpwd" value="0" checked="checked" onclick="togglePwd(this.form);" />'.
+                            &mt('No').'</label>'.('&nbsp;'x2).
+                            '<label><input type="radio" name="newintpwd" value="1" onclick="togglePwd(this.form);" />'.&mt('Yes').'</label>'.
+                            '<div id="LC_ownersetpwd" style="display:none">'.
+                            '&nbsp;&nbsp;'.&mt('Password').' <input type="password" size="15" name="intarg" value="" />'.
+                            '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.intarg.type='."'text'".' } else { this.form.intarg.type='."'password'".' }" />'.&mt('Visible input').'</label></div></td>'.
+                            &Apache::loncommon::end_data_table_row().
+                            &Apache::loncommon::end_data_table();
+            }
             if (&Apache::lonnet::allowed('udp',$ccdomain)) {
                 # Current user has rights to view domain preferences for user's domain
                 my $result;
@@ -2270,6 +2325,8 @@ ENDBADAUTH
                     $result = &mt('Currently using local (institutional) authentication.');
                 } elsif ($currentauth =~ /^unix:/) {
                     $result = &mt('Currently Filesystem Authenticated.');
+                } elsif ($currentauth =~ /^lti:/) {
+                    $result = &mt('Currently LTI authenticated.');
                 }
                 $outcome = '<h3>'.$lt{'ld'}.'</h3>'.
                            &Apache::loncommon::start_data_table().
@@ -2308,6 +2365,9 @@ sub modify_login_block {
         if ($can_assign{'loc'}) {
             push(@authform_others,$authformloc);
         }
+        if ($can_assign{'lti'}) {
+            push(@authform_others,$authformlti);
+        }
         if (($can_assign{'krb4'}) || ($can_assign{'krb5'})) {
             $show_override_msg = 1;
         }
@@ -2319,6 +2379,9 @@ sub modify_login_block {
         if ($can_assign{'loc'}) {
             push(@authform_others,$authformloc);
         }
+        if ($can_assign{'lti'}) {
+            push(@authform_others,$authformlti);
+        }
         if ($can_assign{'int'}) {
             $show_override_msg = 1;
         }
@@ -2333,6 +2396,9 @@ sub modify_login_block {
         if ($can_assign{'loc'}) {
             push(@authform_others,$authformloc);
         }
+        if ($can_assign{'lti'}) {
+            push(@authform_others,$authformlti);
+        }
         if ($can_assign{'fsys'}) {
             $show_override_msg = 1;
         }
@@ -2344,9 +2410,23 @@ sub modify_login_block {
         if ($can_assign{'int'}) {
             push(@authform_others,$authformint);
         }
+        if ($can_assign{'lti'}) {
+            push(@authform_others,$authformlti);
+        }
         if ($can_assign{'loc'}) {
             $show_override_msg = 1;
         }
+    } elsif ($currentauth=~/^lti:/) {
+        $authformcurrent=$authformlti;
+        if (($can_assign{'krb4'}) || ($can_assign{'krb5'})) {
+            push(@authform_others,$authformkrb);
+        }
+        if ($can_assign{'int'}) {
+            push(@authform_others,$authformint);
+        }
+        if ($can_assign{'loc'}) {
+            push(@authform_others,$authformloc);
+        }
     }
     if ($show_override_msg) {
         $authformcurrent = '<table><tr><td colspan="3">'.$authformcurrent.
@@ -2687,7 +2767,7 @@ sub get_inststatuses {
 
 # ================================================================= Phase Three
 sub update_user_data {
-    my ($r,$context,$crstype,$brcrum,$showcredits) = @_; 
+    my ($r,$context,$crstype,$brcrum,$showcredits,$permission) = @_; 
     my $uhome=&Apache::lonnet::homeserver($env{'form.ccuname'},
                                           $env{'form.ccdomain'});
     # Error messages
@@ -2805,6 +2885,9 @@ sub update_user_data {
 	$amode='localauth';
 	$genpwd=$env{'form.locarg'};
 	$genpwd=" " if (!$genpwd);
+    } elsif ($env{'form.login'} eq 'lti') {
+        $amode='lti';
+        $genpwd=" ";
     } elsif (($env{'form.login'} eq 'nochange') ||
              ($env{'form.login'} eq ''        )) { 
         # There is no need to tell the user we did not change what they
@@ -2824,7 +2907,7 @@ sub update_user_data {
     my (%alerts,%rulematch,%inst_results,%curr_rules);
     my @userinfo = ('firstname','middlename','lastname','generation','permanentemail','id');
     my @usertools = ('aboutme','blog','webdav','portfolio');
-    my @requestcourses = ('official','unofficial','community','textbook','placement');
+    my @requestcourses = ('official','unofficial','community','textbook','placement','lti');
     my @requestauthor = ('requestauthor');
     my ($othertitle,$usertypes,$types) = 
         &Apache::loncommon::sorted_inst_types($env{'form.ccdomain'});
@@ -2974,6 +3057,13 @@ sub update_user_data {
 	    # Okay, this is a non-fatal error.
 	    $r->print($error.&mt('You do not have the authority to modify this users authentication information.').$end);    
 	}
+    } elsif (($env{'form.intarg'} ne '') &&
+             (&Apache::lonnet::queryauthenticate($env{'form.ccuname'},$env{'form.ccdomain'}) =~ /^internal:/) &&
+             (&Apache::lonuserutils::can_change_internalpass($env{'form.ccuname'},$env{'form.ccdomain'},$crstype,$permission))) {
+        $r->print('Modifying authentication: '.
+                  &Apache::lonnet::modifyuserauth(
+                  $env{'form.ccdomain'},$env{'form.ccuname'},
+                  'internal',$env{'form.intarg'}));
     }
     $r->rflush(); # Finish display of header before time consuming actions start
     &Apache::lonhtmlcommon::Increment_PrgWin($r,\%prog_state);
@@ -3290,7 +3380,7 @@ sub update_user_data {
                         foreach my $key (keys(%changed)) {
                             if (($key eq 'official') || ($key eq 'unofficial') ||
                                 ($key eq 'community') || ($key eq 'textbook') ||
-                                ($key eq 'placement')) {
+                                ($key eq 'placement') || ($key eq 'lti')) {
                                 $newenvhash{'environment.requestcourses.'.$key} =
                                     $changeHash{'requestcourses.'.$key};
                                 if ($changeHash{'requestcourses.'.$key}) {
@@ -3500,6 +3590,7 @@ sub display_userinfo {
          'community'      => 'Can Request Communities',
          'textbook'       => 'Can Request Textbook Courses',
          'placement'      => 'Can Request Placement Tests',
+         'lti'            => 'Can Request LTI Courses',
          'requestauthor'  => 'Can Request Author Role',
          'inststatus'     => "Affiliation",
          'prvs'           => 'Previous Value:',
@@ -4741,16 +4832,41 @@ sub handler {
         if (! exists($env{'form.state'})) {
             &Apache::lonuserutils::print_first_users_upload_form($r,$context);
         } elsif ($env{'form.state'} eq 'got_file') {
-            &Apache::lonuserutils::print_upload_manager_form($r,$context,$permission,
-                                                             $crstype,$showcredits);
+            my $result = 
+                &Apache::lonuserutils::print_upload_manager_form($r,$context,
+                                                                 $permission,
+                                                                 $crstype,$showcredits);
+            if ($result eq 'missingdata') {
+                delete($env{'form.state'});
+                &Apache::lonuserutils::print_first_users_upload_form($r,$context);
+            }
         } elsif ($env{'form.state'} eq 'enrolling') {
             if ($env{'form.datatoken'}) {
-                &Apache::lonuserutils::upfile_drop_add($r,$context,$permission,
-                                                       $showcredits);
+                my $result = &Apache::lonuserutils::upfile_drop_add($r,$context,
+                                                                    $permission,
+                                                                    $showcredits);
+                if ($result eq 'missingdata') {
+                    delete($env{'form.state'});
+                    &Apache::lonuserutils::print_first_users_upload_form($r,$context);
+                } elsif ($result eq 'invalidhome') {
+                    $env{'form.state'} = 'got_file';
+                    delete($env{'form.lcserver'});
+                    my $result =
+                        &Apache::lonuserutils::print_upload_manager_form($r,$context,$permission,
+                                                                         $crstype,$showcredits);
+                    if ($result eq 'missingdata') {
+                        delete($env{'form.state'});
+                        &Apache::lonuserutils::print_first_users_upload_form($r,$context);
+                    }
+                }
+            } else {
+                delete($env{'form.state'});
+                &Apache::lonuserutils::print_first_users_upload_form($r,$context);
             }
         } else {
             &Apache::lonuserutils::print_first_users_upload_form($r,$context);
         }
+        $r->print('</form>');
     } elsif (((($env{'form.action'} eq 'singleuser') || ($env{'form.action'}
               eq 'singlestudent')) && ($permission->{'cusr'})) ||
              (($env{'form.action'} eq 'singleuser') && ($permission->{'view'})) ||
@@ -4856,7 +4972,7 @@ sub handler {
                 &print_useraccesslogs_display($r,$ccuname,$ccdomain,$permission,$brcrum);
             }
         } elsif ($env{'form.phase'} eq 'update_user_data') {
-            &update_user_data($r,$context,$crstype,$brcrum,$showcredits);
+            &update_user_data($r,$context,$crstype,$brcrum,$showcredits,$permission);
         } else {
             &print_username_entry_form($r,$context,undef,$srch,undef,$crstype,
                                        $brcrum,$permission);
@@ -6139,11 +6255,11 @@ ENDSCRIPT
                 } elsif ($curr_types eq '') {
                     $add_domtitle = &mt('Users in other domain:');
                 }
-                my ($trustedref,$untrustedref) = &Apache::lonnet::trusted_domains('enroll',$cdom);
+                my ($trusted,$untrusted) = &Apache::lonnet::trusted_domains('enroll',$cdom);
                 $output .= &Apache::loncommon::start_data_table_row()
                            .'<td colspan="2"><span class="LC_nobreak">'.$add_domtitle.'</span><br />'
                            .&Apache::loncommon::select_dom_form('','selfenroll_newdom',
-                                                                $includeempty,$showdomdesc,'',$trustedref,$untrustedref,$readonly)
+                                                                $includeempty,$showdomdesc,'',$trusted,$untrusted,$readonly)
                            .'<input type="hidden" name="selfenroll_types_total" value="'.$num.'" />'
                            .'</td>'.&Apache::loncommon::end_data_table_row()
                            .&Apache::loncommon::end_data_table();