--- loncom/lond	2017/02/28 05:42:06	1.532
+++ loncom/lond	2017/03/13 18:30:02	1.533
@@ -2,7 +2,7 @@
 # The LearningOnline Network
 # lond "LON Daemon" Server (port "LOND" 5663)
 #
-# $Id: lond,v 1.532 2017/02/28 05:42:06 raeburn Exp $
+# $Id: lond,v 1.533 2017/03/13 18:30:02 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -65,7 +65,7 @@ my $DEBUG = 0;		       # Non zero to ena
 my $status='';
 my $lastlog='';
 
-my $VERSION='$Revision: 1.532 $'; #' stupid emacs
+my $VERSION='$Revision: 1.533 $'; #' stupid emacs
 my $remoteVERSION;
 my $currenthostid="default";
 my $currentdomainid;
@@ -2323,12 +2323,8 @@ sub hash_passwd {
         my $plainsalt = substr($rest[1],0,22);
         $salt = Crypt::Eksblowfish::Bcrypt::de_base64($plainsalt);
     } else {
-        my $defaultcost;
-        my %domconfig =
-            &Apache::lonnet::get_dom('configuration',['password'],$domain);
-        if (ref($domconfig{'password'}) eq 'HASH') {
-            $defaultcost = $domconfig{'password'}{'cost'};
-        }
+        my %domdefaults = &Apache::lonnet::get_domain_defaults($domain);
+        my $defaultcost = $domdefaults{'intauth_cost'};
         if (($defaultcost eq '') || ($defaultcost =~ /D/)) {
             $cost = 10;
         } else {
@@ -7372,7 +7368,6 @@ sub make_new_child {
 				  ."Attempted insecure connection disallowed </font>");
 			close $client;
 			$clientok = 0;
-			
 		    }
 		}
 	    } else {
@@ -7381,7 +7376,6 @@ sub make_new_child {
 			 ."$clientip failed to initialize: >$remotereq< </font>");
 		&status('No init '.$clientip);
 	    }
-	    
 	} else {
 	    &logthis(
 		     "<font color='blue'>WARNING: Unknown client $clientip</font>");
@@ -7618,15 +7612,25 @@ sub password_filename {
 #    domain    - domain of the user.
 #    name      - User's name.
 #    contents  - New contents of the file.
+#    saveold   - (optional). If true save old file in a passwd.bak file.
 # Returns:
 #   0    - Failed.
 #   1    - Success.
 #
 sub rewrite_password_file {
-    my ($domain, $user, $contents) = @_;
+    my ($domain, $user, $contents, $saveold) = @_;
 
     my $file = &password_filename($domain, $user);
     if (defined $file) {
+        if ($saveold) {
+            my $bakfile = $file.'.bak';
+            if (CopyFile($file,$bakfile)) {
+                chmod(0400,$bakfile);
+                &logthis("Old password saved in passwd.bak for internally authenticated user: $user:$domain");
+            } else {
+                &logthis("Failed to save old password in passwd.bak for internally authenticated user: $user:$domain");
+            }
+        }
 	my $pf = IO::File->new(">$file");
 	if($pf) {
 	    print $pf "$contents\n";
@@ -7717,20 +7721,27 @@ sub validate_user {
                 $contentpwd = $domdefaults{'auth_arg_def'}; 
             }
         }
-    } 
+    }
     if ($howpwd ne 'nouser') {
 	if($howpwd eq "internal") { # Encrypted is in local password file.
             if (length($contentpwd) == 13) {
                 $validated = (crypt($password,$contentpwd) eq $contentpwd);
                 if ($validated) {
-                    my $ncpass = &hash_passwd($domain,$password);
-                    if (&rewrite_password_file($domain,$user,"$howpwd:$ncpass")) {
-                        &update_passwd_history($user,$domain,$howpwd,'conversion');
-                        &logthis("Validated password hashed with bcrypt for $user:$domain");
+                    my %domdefaults = &Apache::lonnet::get_domain_defaults($domain);
+                    if ($domdefaults{'intauth_switch'}) {
+                        my $ncpass = &hash_passwd($domain,$password);
+                        my $saveold;
+                        if ($domdefaults{'intauth_switch'} == 2) {
+                            $saveold = 1;
+                        }
+                        if (&rewrite_password_file($domain,$user,"$howpwd:$ncpass",$saveold)) {
+                            &update_passwd_history($user,$domain,$howpwd,'conversion');
+                            &logthis("Validated password hashed with bcrypt for $user:$domain");
+                        }
                     }
                 }
             } else {
-                $validated = &check_internal_passwd($password,$contentpwd,$domain);
+                $validated = &check_internal_passwd($password,$contentpwd,$domain,$user);
             }
 	}
 	elsif ($howpwd eq "unix") { # User is a normal unix user.
@@ -7800,24 +7811,35 @@ sub validate_user {
 }
 
 sub check_internal_passwd {
-    my ($plainpass,$stored,$domain) = @_;
+    my ($plainpass,$stored,$domain,$user) = @_;
     my (undef,$method,@rest) = split(/!/,$stored);
-    if ($method eq "bcrypt") {
+    if ($method eq 'bcrypt') {
         my $result = &hash_passwd($domain,$plainpass,@rest);
         if ($result ne $stored) {
             return 0;
         }
-        # Upgrade to a larger number of rounds if necessary
-        my $defaultcost;
-        my %domconfig =
-            &Apache::lonnet::get_dom('configuration',['password'],$domain);
-        if (ref($domconfig{'password'}) eq 'HASH') {
-            $defaultcost = $domconfig{'password'}{'cost'};
-        }
-        if (($defaultcost eq '') || ($defaultcost =~ /D/)) {
-            $defaultcost = 10;
+        my %domdefaults = &Apache::lonnet::get_domain_defaults($domain);
+        if ($domdefaults{'intauth_check'}) {
+            # Upgrade to a larger number of rounds if necessary
+            my $defaultcost = $domdefaults{'intauth_cost'};
+            if (($defaultcost eq '') || ($defaultcost =~ /D/)) {
+                $defaultcost = 10;
+            }
+            if (int($rest[0])<int($defaultcost)) {
+                if ($domdefaults{'intauth_check'} == 1) { 
+                    my $ncpass = &hash_passwd($domain,$plainpass);
+                    if (&rewrite_password_file($domain,$user,"internal:$ncpass")) {
+                        &update_passwd_history($user,$domain,'internal','update cost');
+                        &logthis("Validated password hashed with bcrypt for $user:$domain");
+                    }
+                    return 1;
+                } elsif ($domdefaults{'intauth_check'} == 2) {
+                    return 0;
+                }
+            }
+        } else {
+            return 1;
         }
-        return 1 unless($rest[0]<$defaultcost);
     }
     return 0;
 }