[LON-CAPA-cvs] cvs: loncom(version_2_11_X) /interface domainprefs.pm

raeburn raeburn at source.lon-capa.org
Sun Dec 12 19:56:48 EST 2021


raeburn		Mon Dec 13 00:56:48 2021 EDT

  Modified files:              (Branch: version_2_11_X)
    /loncom/interface	domainprefs.pm 
  Log:
  - For 2.11
    Backport 1.373, 1.374, 1.376, 1.381, 1.382, 1.383, 1.385, 1.386, 1.387, 
             1.388, 1.389, 1.393, 1.394, 1.395, 1.396
  
  
-------------- next part --------------
Index: loncom/interface/domainprefs.pm
diff -u loncom/interface/domainprefs.pm:1.160.6.112 loncom/interface/domainprefs.pm:1.160.6.113
--- loncom/interface/domainprefs.pm:1.160.6.112	Sun Mar  7 01:13:14 2021
+++ loncom/interface/domainprefs.pm	Mon Dec 13 00:56:47 2021
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.160.6.112 2021/03/07 01:13:14 raeburn Exp $
+# $Id: domainprefs.pm,v 1.160.6.113 2021/12/13 00:56:47 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -174,6 +174,7 @@
 use Locale::Language;
 use DateTime::TimeZone;
 use DateTime::Locale;
+use Net::CIDR;
 
 my $registered_cleanup;
 my $modified_urls;
@@ -216,11 +217,12 @@
                 'contacts','defaults','scantron','coursecategories',
                 'serverstatuses','requestcourses','helpsettings',
                 'coursedefaults','usersessions','loadbalancing',
-                'requestauthor','selfenrollment','inststatus','passwords'],$dom);
-    my @prefs_order = ('rolecolors','login','defaults','passwords','quotas','autoenroll',
-                       'autoupdate','autocreate','directorysrch','contacts',
-                       'usercreation','selfcreation','usermodification','scantron',
-                       'requestcourses','requestauthor','coursecategories',
+                'requestauthor','selfenrollment','inststatus',
+                'passwords','wafproxy','ipaccess'],$dom);
+    my @prefs_order = ('rolecolors','login','ipaccess','defaults','wafproxy','passwords',
+                       'quotas','autoenroll','autoupdate','autocreate','directorysrch',
+                       'contacts','usercreation','selfcreation','usermodification',
+                       'scantron','requestcourses','requestauthor','coursecategories',
                        'serverstatuses','helpsettings','coursedefaults',
                        'selfenrollment','usersessions');
     my %existing;
@@ -253,7 +255,10 @@
                                  {col1 => 'Log-in Help',
                                   col2 => 'Value'},
                                  {col1 => 'Custom HTML in document head',
-                                  col2 => 'Value'}],
+                                  col2 => 'Value'},
+                                 {col1 => 'SSO',
+                                  col2 => 'Dual login: SSO and non-SSO options'},
+                                ],
                       print => \&print_login,
                       modify => \&modify_login,
                     },
@@ -267,6 +272,17 @@
                       print => \&print_defaults,
                       modify => \&modify_defaults,
                     },
+        'wafproxy' =>
+                    { text => 'Web Application Firewall/Reverse Proxy',
+                      help => 'Domain_Configuration_WAF_Proxy',
+                      header => [{col1 => 'Domain(s)',
+                                  col2 => 'Servers and WAF/Reverse Proxy alias(es)',
+                                 },
+                                 {col1 => 'Domain(s)',
+                                  col2 => 'WAF Configuration',}],
+                      print => \&print_wafproxy,
+                      modify => \&modify_wafproxy,
+                    },
         'passwords' =>
                     { text => 'Passwords (Internal authentication)',
                       help => 'Domain_Configuration_Passwords',
@@ -490,6 +506,14 @@
                   print => \&print_loadbalancing,
                   modify => \&modify_loadbalancing,
                  },
+         'ipaccess' =>
+                       {text => 'IP-based access control',
+                        help => 'Domain_Configuration_IP_Access',
+                        header => [{col1 => 'Setting',
+                                    col2 => 'Value'},],
+                        print  => \&print_ipaccess,
+                        modify => \&modify_ipaccess,
+                       },
     );
     if (keys(%servers) > 1) {
         $prefs{'login'}  = { text   => 'Log-in page options',
@@ -501,7 +525,10 @@
                                        {col1 => 'Log-in Help',
                                         col2 => 'Value'},
                                        {col1 => 'Custom HTML in document head',
-                                        col2 => 'Value'}],
+                                        col2 => 'Value'},
+                                       {col1 => 'SSO',
+                                        col2 => 'Dual login: SSO and non-SSO options'},
+                                      ],
                             print => \&print_login,
                             modify => \&modify_login,
                            };
@@ -542,6 +569,8 @@
 </script>
 $coursebrowserjs
 END
+        } elsif (grep(/^ipaccess$/, at actions)) {
+            $js .= &Apache::loncommon::coursebrowser_javascript($env{'request.role.domain'});
         }
         if (grep(/^selfcreation$/, at actions)) {
             $js .= &selfcreate_javascript();
@@ -674,6 +703,10 @@
         $output = &modify_loadbalancing($dom,%domconfig);
     } elsif ($action eq 'passwords') {
         $output = &modify_passwords($r,$dom,$confname,$lastactref,%domconfig);
+    } elsif ($action eq 'wafproxy') {
+        $output = &modify_wafproxy($dom,$action,$lastactref,%domconfig);
+    } elsif ($action eq 'ipaccess') {
+        $output = &modify_ipaccess($dom,$lastactref,%domconfig);
     }
     return $output;
 }
@@ -704,11 +737,19 @@
         $output =
             &Apache::lonuserutils::custom_roledefs_js($context,$crstype,$formname,\%full,
                                                       \@templateroles);
+    } elsif ($action eq 'wafproxy') {
+        $output .= &wafproxy_javascript($dom);
+    } elsif ($action eq 'autoupdate') {
+        $output .= &autoupdate_javascript();
+    } elsif ($action eq 'login') {
+        $output .= &saml_javascript();
+    } elsif ($action eq 'ipaccess') {
+        $output .= &ipaccess_javascript($settings);
     }
     $output .=
          '<table class="LC_nested_outer">
           <tr>
-           <th align="left" valign="middle"><span class="LC_nobreak">'.
+           <th class="LC_left_item LC_middle"><span class="LC_nobreak">'.
            &mt($item->{text}).' '.
            &Apache::loncommon::help_open_topic($item->{'help'}).'</span></th>'."\n".
           '</tr>';
@@ -723,7 +764,7 @@
         my $leftnobr = '';  
         if (($action eq 'rolecolors') || ($action eq 'defaults') ||
             ($action eq 'directorysrch') ||
-            (($action eq 'login') && ($numheaders < 4))) {
+            (($action eq 'login') && ($numheaders < 5))) {
             $colspan = ' colspan="2"';
         }
         if ($action eq 'usersessions') {
@@ -744,7 +785,7 @@
         if (($action eq 'autoupdate') || ($action eq 'usercreation') || ($action eq 'selfcreation') ||
             ($action eq 'usermodification') || ($action eq 'defaults') || ($action eq 'coursedefaults') ||
             ($action eq 'selfenrollment') || ($action eq 'usersessions') || ($action eq 'directorysrch') ||
-            ($action eq 'helpsettings') || ($action eq 'contacts')) {
+            ($action eq 'helpsettings') || ($action eq 'contacts') || ($action eq 'wafproxy')) {
             $output .= $item->{'print'}->('top',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'passwords') {
             $output .= $item->{'print'}->('top',$dom,$confname,$settings,\$rowtotal);
@@ -753,7 +794,7 @@
         } elsif ($action eq 'scantron') {
             $output .= $item->{'print'}->($r,'top',$dom,$confname,$settings,\$rowtotal);
         } elsif ($action eq 'login') {
-            if ($numheaders == 4) {
+            if ($numheaders == 5) {
                 $colspan = ' colspan="2"';
                 $output .= &print_login('service',$dom,$confname,$phase,$settings,\$rowtotal);
             } else {
@@ -796,7 +837,7 @@
            <td>
             <table class="LC_nested">
              <tr class="LC_info_row">
-              <td class="LC_left_item'.$leftnobr.'"'.$colspan.'>'.&mt($item->{'header'}->[2]->{'col1'}).'</td>
+              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[2]->{'col1'}).'</td>
               <td class="LC_right_item">'.&mt($item->{'header'}->[2]->{'col2'}).'</td>
              </tr>'."\n";
             if ($action eq 'coursecategories') {
@@ -816,7 +857,7 @@
            <td>
             <table class="LC_nested">
              <tr class="LC_info_row">
-              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
+              <td class="LC_left_item'.$leftnobr.'"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
               <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td></tr>'."\n";
                 if ($action eq 'passwords') {
                     $output .= $item->{'print'}->('bottom',$dom,$confname,$settings,\$rowtotal);
@@ -834,12 +875,12 @@
             $rowtotal ++;
         } elsif (($action eq 'usermodification') || ($action eq 'coursedefaults') ||
                  ($action eq 'defaults') || ($action eq 'directorysrch') ||
-                 ($action eq 'helpsettings')) {
+                 ($action eq 'helpsettings') || ($action eq 'wafproxy')) {
             $output .= $item->{'print'}->('bottom',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'scantron') {
             $output .= $item->{'print'}->($r,'bottom',$dom,$confname,$settings,\$rowtotal);
         } elsif ($action eq 'login') {
-            if ($numheaders == 4) {
+            if ($numheaders == 5) {
                 $output .= &print_login('page',$dom,$confname,$phase,$settings,\$rowtotal).'
            </table>
           </td>
@@ -863,7 +904,7 @@
            <td>
             <table class="LC_nested">
              <tr class="LC_info_row">';
-            if ($numheaders == 4) {
+            if ($numheaders == 5) {
                 $output .= '
               <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
               <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td>
@@ -875,7 +916,27 @@
              </tr>';
             }
             $rowtotal ++;
-            $output .= &print_login('headtag',$dom,$confname,$phase,$settings,\$rowtotal);
+            $output .= &print_login('headtag',$dom,$confname,$phase,$settings,\$rowtotal).'
+           </table>
+          </td>
+         </tr>
+         <tr>
+           <td>
+            <table class="LC_nested">
+             <tr class="LC_info_row">';
+            if ($numheaders == 5) {
+                $output .= '
+              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[4]->{'col1'}).'</td>
+              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[4]->{'col2'}).'</td>
+             </tr>';
+            } else {
+                $output .= '
+              <td class="LC_left_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col1'}).'</td>
+              <td class="LC_right_item"'.$colspan.'>'.&mt($item->{'header'}->[3]->{'col2'}).'</td>
+             </tr>';
+            }
+            $rowtotal ++;
+            $output .= &print_login('saml',$dom,$confname,$phase,$settings,\$rowtotal);
         } elsif ($action eq 'requestcourses') {
             $output .= &print_requestmail($dom,$action,$settings,\$rowtotal);
             $rowtotal ++;
@@ -994,7 +1055,8 @@
         if ($action eq 'quotas') {
             $output .= &print_quotas($dom,$settings,\$rowtotal,$action);
         } elsif (($action eq 'autoenroll') || ($action eq 'autocreate') || 
-                 ($action eq 'serverstatuses') || ($action eq 'loadbalancing')) {
+                 ($action eq 'serverstatuses') || ($action eq 'loadbalancing') ||
+                 ($action eq 'ipaccess')) {
             $output .= $item->{'print'}->($dom,$settings,\$rowtotal);
         }
     }
@@ -1008,8 +1070,12 @@
 
 sub print_login {
     my ($caller,$dom,$confname,$phase,$settings,$rowtotal) = @_;
-    my ($css_class,$datatable);
+    my ($css_class,$datatable,$switchserver,%lt);
     my %choices = &login_choices();
+    if (($caller eq 'help') || ($caller eq 'headtag') || ($caller eq 'saml')) {
+        %lt = &login_file_options();
+        $switchserver = &check_switchserver($dom,$confname);
+    }
 
     if ($caller eq 'service') {
         my %servers = &Apache::lonnet::internet_dom_servers($dom);
@@ -1204,18 +1270,10 @@
         $datatable .= &display_color_options($dom,$confname,$phase,'login',$itemcount,\%choices,\%is_custom,\%defaults,\%designs,\@images,\@bgs,\@links,\%alt_text,$rowtotal,\@logintext);
         $datatable .= '</tr></table></td></tr>';
     } elsif ($caller eq 'help') {
-        my ($defaulturl,$defaulttype,%url,%type,%lt,%langchoices);
-        my $switchserver = &check_switchserver($dom,$confname);
+        my ($defaulturl,$defaulttype,%url,%type,%langchoices);
         my $itemcount = 1;
         $defaulturl = '/adm/loginproblems.html';
         $defaulttype = 'default';
-        %lt = &Apache::lonlocal::texthash (
-                     del     => 'Delete?',
-                     rep     => 'Replace:',
-                     upl     => 'Upload:',
-                     default => 'Default',
-                     custom  => 'Custom',
-                                             );
         %langchoices = &Apache::lonlocal::texthash(&get_languages_hash());
         my @currlangs;
         if (ref($settings) eq 'HASH') {
@@ -1312,14 +1370,6 @@
                 }
             }
         }
-        my %lt = &Apache::lonlocal::texthash(
-                                               del  => 'Delete?',
-                                               rep  => 'Replace:',
-                                               upl  => 'Upload:',
-                                               curr => 'View contents',
-                                               none => 'None',
-        );
-        my $switchserver = &check_switchserver($dom,$confname);
         foreach my $lonhost (sort(keys(%domservers))) {
             my $exempt = &check_exempt_addresses($currexempt{$lonhost});
             $datatable .= '<tr><td>'.$domservers{$lonhost}.'</td>';
@@ -1343,6 +1393,88 @@
             $datatable .= '</td><td><input type="text" name="loginheadtagexempt_'.$lonhost.'" value="'.$exempt.'" /></td></tr>';
         }
         $datatable .= '</table></td></tr>';
+    } elsif ($caller eq 'saml') {
+        my %domservers = &Apache::lonnet::get_servers($dom);
+        $datatable .= '<tr><td colspan="3" style="text-align: left">'.
+                      '<table><tr><th>'.$choices{'hostid'}.'</th>'.
+                      '<th>'.$choices{'samllanding'}.'</th>'.
+                      '<th>'.$choices{'samloptions'}.'</th></tr>'."\n";
+        my (%saml,%samltext,%samlimg,%samlalt,%samlurl,%samltitle,%samlnotsso,%styleon,%styleoff);
+        foreach my $lonhost (keys(%domservers)) {
+            $samlurl{$lonhost} = '/adm/sso';
+            $styleon{$lonhost} = 'display:none';
+            $styleoff{$lonhost} = '';
+        }
+        if (ref($settings->{'saml'}) eq 'HASH') {
+            foreach my $lonhost (keys(%{$settings->{'saml'}})) {
+                if (ref($settings->{'saml'}{$lonhost}) eq 'HASH') {
+                    $saml{$lonhost} = 1;
+                    $samltext{$lonhost} = $settings->{'saml'}{$lonhost}{'text'};
+                    $samlimg{$lonhost} = $settings->{'saml'}{$lonhost}{'img'};
+                    $samlalt{$lonhost} = $settings->{'saml'}{$lonhost}{'alt'};
+                    $samlurl{$lonhost} = $settings->{'saml'}{$lonhost}{'url'};
+                    $samltitle{$lonhost} = $settings->{'saml'}{$lonhost}{'title'};
+                    $samlnotsso{$lonhost} = $settings->{'saml'}{$lonhost}{'notsso'};
+                    $styleon{$lonhost} = '';
+                    $styleoff{$lonhost} = 'display:none';
+                } else {
+                    $styleon{$lonhost} = 'display:none';
+                    $styleoff{$lonhost} = '';
+                }
+            }
+        }
+        my $itemcount = 1;
+        foreach my $lonhost (sort(keys(%domservers))) {
+            my $samlon = ' ';
+            my $samloff = ' checked="checked" ';
+            if ($saml{$lonhost}) {
+                $samlon = $samloff;
+                $samloff = ' ';
+            }
+            my $css_class = $itemcount%2?' class="LC_odd_row"':'';
+            $datatable .= '<tr'.$css_class.'><td><span class="LC_nobreak">'.$domservers{$lonhost}.'</span></td>'.
+                          '<td><span class="LC_nobreak"><label><input type="radio" name="saml_'.$lonhost.'"'.$samloff.
+                          'onclick="toggleSamlOptions(this.form,'."'$lonhost'".');" value="0" />'.
+                          &mt('No').'</label>'.(' 'x2).
+                          '<label><input type="radio" name="saml_'.$lonhost.'"'.$samlon.
+                          'onclick="toggleSamlOptions(this.form,'."'$lonhost'".');" value="1" />'.
+                          &mt('Yes').'</label></span></td>'.
+                          '<td id="samloptionson_'.$lonhost.'" style="'.$styleon{$lonhost}.'" width="100%">'.
+                          '<table><tr><th colspan="5" align="center">'.&mt('SSO').'</th><th align="center">'.
+                          '<span class="LC_nobreak">'.&mt('Non-SSO').'</span></th></tr>'.
+                          '<tr><th>'.&mt('Text').'</th><th>'.&mt('Image').'</th>'.
+                          '<th>'.&mt('Alt Text').'</th><th>'.&mt('URL').'</th>'.
+                          '<th>'.&mt('Tool Tip').'</th><th>'.&mt('Text').'</th></tr>'.
+                          '<tr'.$css_class.'><td><input type="text" name="saml_text_'.$lonhost.'" size="8" value="'.
+                          $samltext{$lonhost}.'" /></td><td>';
+            if ($samlimg{$lonhost}) {
+                $datatable .= '<img src="'.$samlimg{$lonhost}.'" /><br />'.
+                              '<span class="LC_nobreak"><label>'.
+                              '<input type="checkbox" name="saml_img_del" value="'.$lonhost.'" />'.
+                              $lt{'del'}.'</label> '.$lt{'rep'}.'</span>';
+            } else {
+                $datatable .= $lt{'upl'};
+            }
+            $datatable .='<br />';
+            if ($switchserver) {
+                $datatable .= &mt('Upload to library server: [_1]',$switchserver);
+            } else {
+                $datatable .= '<input type="file" name="saml_img_'.$lonhost.'" />';
+            }
+            $datatable .= '</td>'.
+                          '<td><input type="text" name="saml_alt_'.$lonhost.'" size="20" '.
+                          'value="'.$samlalt{$lonhost}.'" /></td>'.
+                          '<td><input type="text" name="saml_url_'.$lonhost.'" size="8" '.
+                          'value="'.$samlurl{$lonhost}.'" /></td>'.
+                          '<td><textarea name="saml_title_'.$lonhost.'" rows="3" cols="15">'.
+                          $samltitle{$lonhost}.'</textarea></td>'.
+                          '<td><input type="text" name="saml_notsso_'.$lonhost.'" size="8" '.
+                          'value="'.$samlnotsso{$lonhost}.'" /></td></tr>'.
+                          '</table></td>'.
+                          '<td id="samloptionsoff_'.$lonhost.'" style="'.$styleoff{$lonhost}.'" width="100%"> </td></tr>';
+           $itemcount ++;
+        }
+        $datatable .= '</table></td></tr>';
     }
     return $datatable;
 }
@@ -1379,10 +1511,201 @@
             headtag       => "Custom markup",
             action        => "Action",
             current       => "Current",
+            samllanding   => "Dual login?",
+            samloptions   => "Options",
         );
     return %choices;
 }
 
+sub login_file_options {
+      return &Apache::lonlocal::texthash(
+                                           del     => 'Delete?',
+                                           rep     => 'Replace:',
+                                           upl     => 'Upload:',
+                                           curr    => 'View contents',
+                                           default => 'Default',
+                                           custom  => 'Custom',
+                                           none    => 'None',
+      );
+}
+
+sub print_ipaccess {
+    my ($dom,$settings,$rowtotal) = @_;
+    my $css_class;
+    my $itemcount = 0;
+    my $datatable;
+    my %ordered;
+    if (ref($settings) eq 'HASH') {
+        foreach my $item (keys(%{$settings})) {
+            if (ref($settings->{$item}) eq 'HASH') {
+                my $num = $settings->{$item}{'order'};
+                if ($num eq '') {
+                    $num = scalar(keys(%{$settings}));
+                }
+                $ordered{$num} = $item;
+            }
+        }
+    }
+    my $maxnum = scalar(keys(%ordered));
+    if (keys(%ordered)) {
+        my @items = sort { $a <=> $b } keys(%ordered);
+        for (my $i=0; $i<@items; $i++) {
+            $css_class = $itemcount%2?' class="LC_odd_row"':'';
+            my $item = $ordered{$items[$i]};
+            my ($name,$ipranges,%commblocks,%courses);
+            if (ref($settings->{$item}) eq 'HASH') {
+                $name = $settings->{$item}->{'name'};
+                $ipranges = $settings->{$item}->{'ip'};
+                if (ref($settings->{$item}->{'commblocks'}) eq 'HASH') {
+                    %commblocks = %{$settings->{$item}->{'commblocks'}};
+                }
+                if (ref($settings->{$item}->{'courses'}) eq 'HASH') {
+                    %courses = %{$settings->{$item}->{'courses'}};
+                }
+            }
+            my $chgstr = ' onchange="javascript:reorderIPaccess(this.form,'."'ipaccess_pos_".$item."'".');"';
+            $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'
+                         .'<select name="ipaccess_pos_'.$item.'"'.$chgstr.'>';
+            for (my $k=0; $k<=$maxnum; $k++) {
+                my $vpos = $k+1;
+                my $selstr;
+                if ($k == $i) {
+                    $selstr = ' selected="selected" ';
+                }
+                $datatable .= '<option value="'.$k.'"'.$selstr.'>'.$vpos.'</option>';
+            }
+            $datatable .= '</select>'.(' 'x2).
+                '<label><input type="checkbox" name="ipaccess_del" value="'.$item.'" />'.
+                &mt('Delete?').'</label></span></td>'.
+                '<td colspan="2"><input type="hidden" name="ipaccess_id_'.$i.'" value="'.$item.'" />'.
+                &ipaccess_options($i,$itemcount,$dom,$name,$ipranges,\%commblocks,\%courses).
+                '</td></tr>';
+            $itemcount ++;
+        }
+    }
+    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    my $chgstr = ' onchange="javascript:reorderIPaccess(this.form,'."'ipaccess_pos_add'".');"';
+    $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'."\n".
+                  '<input type="hidden" name="ipaccess_maxnum" value="'.$maxnum.'" />'."\n".
+                  '<select name="ipaccess_pos_add"'.$chgstr.'>';
+    for (my $k=0; $k<$maxnum+1; $k++) {
+        my $vpos = $k+1;
+        my $selstr;
+        if ($k == $maxnum) {
+            $selstr = ' selected="selected" ';
+        }
+        $datatable .= '<option value="'.$k.'"'.$selstr.'>'.$vpos.'</option>';
+    }
+    $datatable .= '</select> '."\n".
+                  '<input type="checkbox" name="ipaccess_add" value="1" />'.&mt('Add').'</span></td>'."\n".
+                  '<td colspan="2">'.
+                  &ipaccess_options('add',$itemcount,$dom).
+                  '</td>'."\n".
+                  '</tr>'."\n";
+    $$rowtotal ++;
+    return $datatable;
+}
+
+sub ipaccess_options {
+    my ($num,$itemcount,$dom,$name,$ipranges,$blocksref,$coursesref) = @_;
+    my (%currblocks,%currcourses,$output);
+    if (ref($blocksref) eq 'HASH') {
+        %currblocks = %{$blocksref};
+    }
+    if (ref($coursesref) eq 'HASH') {
+        %currcourses = %{$coursesref};
+    }
+    $output = '<fieldset><legend>'.&mt('Location(s)').'</legend>'.
+              '<span class="LC_nobreak">'.&mt('Name').': '.
+              '<input type="text" name="ipaccess_name_'.$num.'" value="'.$name.'" />'.
+              '</span></fieldset>'.
+              '<fieldset><legend>'.&mt('IP Range(s)').'</legend>'.
+              &mt('Format for each IP range').': '.&mt('A.B.C.D/N or A.B.C.D-E.F.G.H').'<br />'.
+              &mt('Range(s) will be stored as IP netblock(s) in CIDR notation (comma separated)').'<br />'.
+              '<textarea name="ipaccess_range_'.$num.'" rows="3" cols="80">'.
+              $ipranges.'</textarea></fieldset>'.
+              '<fieldset><legend>'.&mt('Functionality Blocked?').'</legend>'.
+              &blocker_checkboxes($num,$blocksref).'</fieldset>'.
+              '<fieldset><legend>'.&mt('Courses/Communities allowed').'</legend>'.
+              '<table>';
+    foreach my $cid (sort(keys(%currcourses))) {
+        my %courseinfo = &Apache::lonnet::coursedescription($cid,{'one_time' => 1});
+        $output .= '<tr><td><span class="LC_nobreak">'.
+                   '<label><input type="checkbox" name="ipaccess_course_delete_'.$num.'" value="'.$cid.'" />'.
+                   &mt('Delete?').' <span class="LC_cusr_emph">'.$courseinfo{'description'}.'</span></label></span>'.
+                   ' <span class="LC_fontsize_medium">('.$cid.')</span></td></tr>';
+    }
+    $output .= '<tr><td><span class="LC_nobreak">'.&mt('Add').': '.
+               '<input type="text" name="ipaccess_cdesc_'.$num.'" value="" onfocus="this.blur();opencrsbrowser('."'display','ipaccess_cnum_$num','ipaccess_cdom_$num','ipaccess_cdesc_$num'".');" />'.
+                &Apache::loncommon::selectcourse_link('display','ipaccess_cnum_'.$num,'ipaccess_cdom_'.$num,'ipaccess_cdesc_'.$num,$dom,undef,'Course/Community').
+               '<input type="hidden" name="ipaccess_cnum_'.$num.'" value="" />'.
+               '<input type="hidden" name="ipaccess_cdom_'.$num.'" value="" />'.
+               '</span></td></tr></table>'."\n".
+               '</fieldset>';
+    return $output;
+}
+
+sub blocker_checkboxes {
+    my ($num,$blocks) = @_;
+    my ($typeorder,$types) = &commblocktype_text();
+    my $numinrow = 6;
+    my $output = '<table>';
+    for (my $i=0; $i<@{$typeorder}; $i++) {
+        my $block = $typeorder->[$i];
+        my $blockstatus;
+        if (ref($blocks) eq 'HASH') {
+            if ($blocks->{$block} eq 'on') {
+                $blockstatus = 'checked="checked"';
+            }
+        }
+        my $rem = $i%($numinrow);
+        if ($rem == 0) {
+            if ($i > 0) {
+                $output .= '</tr>';
+            }
+            $output .= '<tr>';
+        }
+        if ($i == scalar(@{$typeorder})-1) {
+            my $colsleft = $numinrow-$rem;
+            if ($colsleft > 1) {
+                $output .= '<td colspan="'.$colsleft.'">';
+            } else {
+                $output .= '<td>';
+            }
+        } else {
+            $output .= '<td>';
+        }
+        my $item = 'ipaccess_block_'.$num;
+        if ($blockstatus) {
+            $blockstatus = ' '.$blockstatus;
+        }
+        $output .= '<span class="LC_nobreak"><label>'."\n".
+                   '<input type="checkbox" name="'.$item.'"'.
+                   $blockstatus.' value="'.$block.'"'.' />'.
+                   $types->{$block}.'</label></span>'."\n".
+                   '<br /></td>';
+    }
+    $output .= '</tr></table>';
+    return $output;
+}
+
+sub commblocktype_text {
+    my %types = &Apache::lonlocal::texthash(
+        'com' => 'Messaging',
+        'chat' => 'Chat Room',
+        'boards' => 'Discussion',
+        'port' => 'Portfolio',
+        'groups' => 'Groups',
+        'blogs' => 'Blogs',
+        'about' => 'User Information',
+        'printout' => 'Printouts',
+        'passwd' => 'Change Password',
+        'grades' => 'Gradebook',
+    );
+    my $typeorder = ['com','chat','boards','port','groups','blogs','about','printout','grades','passwd'];
+    return ($typeorder,\%types);
+}
+
 sub print_rolecolors {
     my ($phase,$role,$dom,$confname,$settings,$rowtotal) = @_;
     my %choices = &color_font_choices();
@@ -2510,6 +2833,266 @@
 ENDSCRIPT
 }
 
+sub wafproxy_javascript {
+    my ($dom) = @_;
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function updateWAF() {
+    if (document.getElementById('wafproxy_remoteip')) {
+        var wafremote = 0;
+        if (document.display.wafproxy_remoteip.options[document.display.wafproxy_remoteip.selectedIndex].value == 'h') {
+            wafremote = 1;
+        }
+        var fields = new Array('header','trust');
+        for (var i=0; i<fields.length; i++) {
+            if (document.getElementById('wafproxy_'+fields[i])) {
+                if (wafremote == 1) {
+                    document.getElementById('wafproxy_'+fields[i]).style.display = 'table-row';
+                }
+                else {
+                    document.getElementById('wafproxy_'+fields[i]).style.display = 'none';
+                }
+            }
+        }
+        if (document.getElementById('wafproxyranges_$dom')) {
+            if (wafremote == 1) {
+                document.getElementById('wafproxyranges_$dom').style.display = 'inline-block';
+            } else {
+                for (var i=0; i<document.display.wafproxy_vpnaccess.length; i++) {
+                    if (document.display.wafproxy_vpnaccess[i].checked) {
+                        if (document.display.wafproxy_vpnaccess[i].value == 0) {
+                            document.getElementById('wafproxyranges_$dom').style.display = 'none';
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return;
+}
+
+function checkWAF() {
+    if (document.getElementById('wafproxy_remoteip')) {
+        var wafvpn = 0;
+        for (var i=0; i<document.display.wafproxy_vpnaccess.length; i++) {
+            if (document.display.wafproxy_vpnaccess[i].checked) {
+                if (document.display.wafproxy_vpnaccess[i].value == 1) {
+                    wafvpn = 1;
+                }
+                break;
+            }
+        }
+        var vpn = new Array('vpnint','vpnext');
+        for (var i=0; i<vpn.length; i++) {
+            if (document.getElementById('wafproxy_show_'+vpn[i])) {
+                if (wafvpn == 1) {
+                    document.getElementById('wafproxy_show_'+vpn[i]).style.display = 'table-row';
+                }
+                else {
+                    document.getElementById('wafproxy_show_'+vpn[i]).style.display = 'none';
+                }
+            }
+        }
+        if (document.getElementById('wafproxyranges_$dom')) {
+            if (wafvpn == 1) {
+                document.getElementById('wafproxyranges_$dom').style.display = 'inline-block';
+            }
+            else if (document.display.wafproxy_remoteip.options[document.display.wafproxy_remoteip.selectedIndex].value != 'h') {
+                document.getElementById('wafproxyranges_$dom').style.display = 'none';
+            }
+        }
+    }
+    return;
+}
+
+function toggleWAF() {
+    if (document.getElementById('wafproxy_table')) {
+        var wafproxy = 0;
+        for (var i=0; i<document.display.wafproxy_${dom}.length; i++) {
+             if (document.display.wafproxy_${dom}[i].checked) {
+                 if (document.display.wafproxy_${dom}[i].value == 1) {
+                     wafproxy = 1;
+                     break;
+                }
+            }
+        }
+        if (wafproxy == 1) {
+            document.getElementById('wafproxy_table').style.display='inline';
+        }
+        else {
+           document.getElementById('wafproxy_table').style.display='none';
+        }
+        if (document.getElementById('wafproxyrow_${dom}')) {
+            if (wafproxy == 1) {
+                document.getElementById('wafproxyrow_${dom}').style.display = 'table-row';
+            }
+            else {
+                document.getElementById('wafproxyrow_${dom}').style.display = 'none';
+            }
+        }
+        if (document.getElementById('nowafproxyrow_$dom')) {
+            if (wafproxy == 1) {
+                document.getElementById('nowafproxyrow_${dom}').style.display = 'none';
+            }
+            else {
+                document.getElementById('nowafproxyrow_${dom}').style.display = 'table-row';
+            }
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
+sub autoupdate_javascript {
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function toggleLastActiveDays(form) {
+    var radioname = 'lastactive';
+    var divid = 'lastactive_div';
+    var num = form.elements[radioname].length;
+    if (num) {
+        var setvis = '';
+        for (var i=0; i<num; i++) {
+            if (form.elements[radioname][i].checked) {
+                if (form.elements[radioname][i].value == '1') {
+                    if (document.getElementById(divid)) {
+                        document.getElementById(divid).style.display = 'inline-block';
+                    }
+                    setvis = 1;
+                }
+                break;
+            }
+        }
+        if (!setvis) {
+            if (document.getElementById(divid)) {
+                document.getElementById(divid).style.display = 'none';
+            }
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
+sub saml_javascript {
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function toggleSamlOptions(form,hostid) {
+    var radioname = 'saml_'+hostid;
+    var tablecellon = 'samloptionson_'+hostid;
+    var tablecelloff = 'samloptionsoff_'+hostid;
+    var num = form.elements[radioname].length;
+    if (num) {
+        var setvis = '';
+        for (var i=0; i<num; i++) {
+            if (form.elements[radioname][i].checked) {
+                if (form.elements[radioname][i].value == '1') {
+                    if (document.getElementById(tablecellon)) {
+                        document.getElementById(tablecellon).style.display='';
+                    }
+                    if (document.getElementById(tablecelloff)) {
+                        document.getElementById(tablecelloff).style.display='none';
+                    }
+                    setvis = 1;
+                }
+                break;
+            }
+        }
+        if (!setvis) {
+            if (document.getElementById(tablecellon)) {
+                document.getElementById(tablecellon).style.display='none';
+            }
+            if (document.getElementById(tablecelloff)) {
+                document.getElementById(tablecelloff).style.display='';
+            }
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
+sub ipaccess_javascript {
+    my ($settings) = @_;
+    my (%ordered,$total,%jstext);
+    $total = 0;
+    if (ref($settings) eq 'HASH') {
+        foreach my $item (keys(%{$settings})) {
+            if (ref($settings->{$item}) eq 'HASH') {
+                my $num = $settings->{$item}{'order'};
+                $ordered{$num} = $item;
+            }
+        }
+        $total = scalar(keys(%{$settings}));
+    }
+    my @jsarray = ();
+    foreach my $item (sort {$a <=> $b } (keys(%ordered))) {
+        push(@jsarray,$ordered{$item});
+    }
+    my $jstext = '    var ipaccess = Array('."'".join("','", at jsarray)."'".');'."\n";
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function reorderIPaccess(form,item) {
+    var changedVal;
+$jstext
+    var newpos = 'ipaccess_pos_add';
+    var maxh = 1 + $total;
+    var current = new Array;
+    var newitemVal = form.elements[newpos].options[form.elements[newpos].selectedIndex].value;
+    if (item == newpos) {
+        changedVal = newitemVal;
+    } else {
+        changedVal = form.elements[item].options[form.elements[item].selectedIndex].value;
+        current[newitemVal] = newpos;
+    }
+    for (var i=0; i<ipaccess.length; i++) {
+        var elementName = 'ipaccess_pos_'+ipaccess[i];
+        if (elementName != item) {
+            if (form.elements[elementName]) {
+                var currVal = form.elements[elementName].options[form.elements[elementName].selectedIndex].value;
+                current[currVal] = elementName;
+            }
+        }
+    }
+    var oldVal;
+    for (var j=0; j<maxh; j++) {
+        if (current[j] == undefined) {
+            oldVal = j;
+        }
+    }
+    if (oldVal < changedVal) {
+        for (var k=oldVal+1; k<=changedVal ; k++) {
+           var elementName = current[k];
+           form.elements[elementName].selectedIndex = form.elements[elementName].selectedIndex - 1;
+        }
+    } else {
+        for (var k=changedVal; k<oldVal; k++) {
+            var elementName = current[k];
+            form.elements[elementName].selectedIndex = form.elements[elementName].selectedIndex + 1;
+        }
+    }
+    return;
+}
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
 sub print_autoenroll {
     my ($dom,$settings,$rowtotal) = @_;
     my $autorun = &Apache::lonnet::auto_run(undef,$dom),
@@ -2596,42 +3179,69 @@
 
 sub print_autoupdate {
     my ($position,$dom,$settings,$rowtotal) = @_;
-    my $datatable;
+    my ($enable,$datatable);
     if ($position eq 'top') {
+        my %choices = &Apache::lonlocal::texthash (
+                          run        => 'Auto-update active?',
+                          classlists => 'Update information in classlists?',
+                          unexpired  => 'Skip updates for users without active or future roles?',
+                          lastactive => 'Skip updates for inactive users?',
+        );
+        my $itemcount = 0;
         my $updateon = ' ';
         my $updateoff = ' checked="checked" ';
-        my $classlistson = ' ';
-        my $classlistsoff = ' checked="checked" ';
         if (ref($settings) eq 'HASH') {
             if ($settings->{'run'} eq '1') {
                 $updateon = $updateoff;
                 $updateoff = ' ';
             }
-            if ($settings->{'classlists'} eq '1') {
-                $classlistson = $classlistsoff;
-                $classlistsoff = ' ';
-            }
         }
-        my %title = (
-                   run => 'Auto-update active?',
-                   classlists => 'Update information in classlists?',
-                    );
-        $datatable = '<tr class="LC_odd_row">'. 
-                  '<td>'.&mt($title{'run'}).'</td>'.
-                  '<td class="LC_right_item"><span class="LC_nobreak"><label>'.
+        $enable = '<tr class="LC_odd_row">'. 
+                  '<td>'.&mt($choices{'run'}).'</td>'.
+                  '<td class="LC_left_item"><span class="LC_nobreak"><label>'.
                   '<input type="radio" name="autoupdate_run"'.
-                  $updateon.' value="1" />'.&mt('Yes').'</label> '.
+                  $updateoff.'value="0" />'.&mt('No').'</label> '.
                   '<label><input type="radio" name="autoupdate_run"'.
-                  $updateoff.'value="0" />'.&mt('No').'</label></span></td>'.
-                  '</tr><tr>'.
-                  '<td>'.&mt($title{'classlists'}).'</td>'.
-                  '<td class="LC_right_item"><span class="LC_nobreak">'.
-                  '<label><input type="radio" name="classlists"'.
-                  $classlistson.' value="1" />'.&mt('Yes').'</label> '.
-                  '<label><input type="radio" name="classlists"'.
-                  $classlistsoff.'value="0" />'.&mt('No').'</label></span></td>'.
+                  $updateon.'value="1" />'.&mt('Yes').'</label></span></td>'.
                   '</tr>';
-        $$rowtotal += 2;
+        my @toggles = ('classlists','unexpired');
+        my %defaultchecked = ('classlists' => 'off',
+                              'unexpired'  => 'off'
+                              );
+        $$rowtotal ++;
+        ($datatable,$itemcount) = &radiobutton_prefs($settings,\@toggles,\%defaultchecked,
+                                                     \%choices,$itemcount,'','','left','no');
+        $datatable = $enable.$datatable;
+        $$rowtotal += $itemcount;
+        my $lastactiveon = ' ';
+        my $lastactiveoff = ' checked="checked" ';
+        my $lastactivestyle = 'none';
+        my $lastactivedays;
+        my $onclick = ' onclick="javascript:toggleLastActiveDays(this.form);"';
+        if (ref($settings) eq 'HASH') {
+            if ($settings->{'lastactive'} =~ /^\d+$/) {
+                $lastactiveon = $lastactiveoff;
+                $lastactiveoff = ' ';
+                $lastactivestyle = 'inline-block';
+                $lastactivedays = $settings->{'lastactive'};
+            }
+        }
+        my $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'>'.
+                      '<td>'.$choices{'lastactive'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak"><label>'.
+                      '<input type="radio" name="lastactive"'.
+                      $lastactiveoff.'value="0"'.$onclick.' />'.&mt('No').'</label>'.
+                      ' <label>'.
+                      '<input type="radio" name="lastactive"'.
+                      $lastactiveon.' value="1"'.$onclick.' />'.&mt('Yes').'</label>'.
+                      '<div id="lastactive_div" style="display:'.$lastactivestyle.';">'.
+                      ': '.&mt('inactive = no activity in last [_1] days',
+                          '<input type="text" size="5" name="lastactivedays" value="'.
+                          $lastactivedays.'" />').
+                      '</span></td>'.
+                      '</tr>';
+        $$rowtotal ++;
     } elsif ($position eq 'middle') {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
         my $numinrow = 3;
@@ -3760,7 +4370,7 @@
 
 sub radiobutton_prefs {
     my ($settings,$toggles,$defaultchecked,$choices,$itemcount,$onclick,
-        $additional,$align) = @_;
+        $additional,$align,$firstval) = @_;
     return unless ((ref($toggles) eq 'ARRAY') && (ref($defaultchecked) eq 'HASH') &&
                    (ref($choices) eq 'HASH'));
 
@@ -3800,15 +4410,21 @@
         } else {
             $datatable .= '<td class="LC_right_item">';
         }
-        $datatable .=
-            '<span class="LC_nobreak">'.
+        $datatable .= '<span class="LC_nobreak">';
+        if ($firstval eq 'no') {
+            $datatable .=
+                '<label><input type="radio" name="'.
+                $item.'" '.$checkedoff{$item}.' value="0"'.$onclick.' />'.&mt('No').
+                '</label> <label><input type="radio" name="'.$item.'" '.
+                $checkedon{$item}.' value="1"'.$onclick.' />'.&mt('Yes').'</label>';
+        } else {
+            $datatable .=
             '<label><input type="radio" name="'.
             $item.'" '.$checkedon{$item}.' value="1"'.$onclick.' />'.&mt('Yes').
             '</label> <label><input type="radio" name="'.$item.'" '.
-            $checkedoff{$item}.' value="0"'.$onclick.' />'.&mt('No').'</label>'.
-            '</span>'.$additional.
-            '</td>'.
-            '</tr>';
+            $checkedoff{$item}.' value="0"'.$onclick.' />'.&mt('No').'</label>';
+        }
+        $datatable .= '</span>'.$additional.'</td></tr>';
         $itemcount ++;
     }
     return ($datatable,$itemcount);
@@ -4748,6 +5364,295 @@
     return $datatable;
 }
 
+sub print_wafproxy {
+    my ($position,$dom,$settings,$rowtotal) = @_;
+    my $css_class;
+    my $itemcount = 0;
+    my $datatable;
+    my %servers = &Apache::lonnet::internet_dom_servers($dom);
+    my (%othercontrol,%otherdoms,%aliases,%saml,%values,$setdom,$showdom);
+    my %lt = &wafproxy_titles();
+    foreach my $server (sort(keys(%servers))) {
+        my $serverhome = &Apache::lonnet::get_server_homeID($servers{$server});
+        next if ($serverhome eq '');
+        my $serverdom;
+        if ($serverhome ne $server) {
+            $serverdom = &Apache::lonnet::host_domain($serverhome);
+            if (($serverdom ne '') && (&Apache::lonnet::domain($serverdom) ne '')) {
+                $othercontrol{$server} = $serverdom;
+            }
+        } else {
+            $serverdom = &Apache::lonnet::host_domain($server);
+            next if (($serverdom eq '') || (&Apache::lonnet::domain($serverdom) eq ''));
+            if ($serverdom ne $dom) {
+                $othercontrol{$server} = $serverdom;
+            } else {
+                $setdom = 1;
+                if (ref($settings) eq 'HASH') {
+                    if (ref($settings->{'alias'}) eq 'HASH') {
+                        $aliases{$dom} = $settings->{'alias'};
+                        if ($aliases{$dom} ne '') {
+                            $showdom = 1;
+                        }
+                    }
+                    if (ref($settings->{'saml'}) eq 'HASH') {
+                        $saml{$dom} = $settings->{'saml'};
+                    }
+                }
+            }
+        }
+    }
+    if ($setdom) {
+        %{$values{$dom}} = ();
+        if (ref($settings) eq 'HASH') {
+            foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext') {
+                $values{$dom}{$item} = $settings->{$item};
+            }
+        }
+    }
+    if (keys(%othercontrol)) {
+        %otherdoms = reverse(%othercontrol);
+        foreach my $domain (keys(%otherdoms)) {
+            %{$values{$domain}} = ();
+            my %config = &Apache::lonnet::get_dom('configuration',['wafproxy'],$domain);
+            if (ref($config{'wafproxy'}) eq 'HASH') {
+                $aliases{$domain} = $config{'wafproxy'}{'alias'};
+                if (exists($config{'wafproxy'}{'saml'})) {
+                    $saml{$domain} = $config{'wafproxy'}{'saml'};
+                }
+                foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext') {
+                    $values{$domain}{$item} = $config{'wafproxy'}{$item};
+                }
+            }
+        }
+    }
+    if ($position eq 'top') {
+        my %servers = &Apache::lonnet::internet_dom_servers($dom);
+        my %aliasinfo;
+        foreach my $server (sort(keys(%servers))) {
+            $itemcount ++;
+            my $dom_in_effect;
+            my $aliasrows = '<tr>'.
+                            '<td class="LC_left_item" style="vertical-align: baseline;">'.
+                            &mt('Hostname').': '.
+                            '<i>'.&Apache::lonnet::hostname($server).'</i></td><td> </td>';
+            if ($othercontrol{$server}) {
+                $dom_in_effect = $othercontrol{$server};
+                my ($current,$forsaml);
+                if (ref($aliases{$dom_in_effect}) eq 'HASH') {
+                    $current = $aliases{$dom_in_effect}{$server};
+                }
+                if (ref($saml{$dom_in_effect}) eq 'HASH') {
+                    if ($saml{$dom_in_effect}{$server}) {
+                        $forsaml = 1;
+                    }
+                }
+                $aliasrows .= '<td class="LC_left_item" style="vertical-align: baseline;">'.
+                              &mt('Alias').':&nbsp';
+                if ($current) {
+                    $aliasrows .= $current;
+                    if ($forsaml) {
+                         $aliasrows .= ' ('.&mt('also for SSO Auth').')';
+                    }
+                } else {
+                    $aliasrows .= &mt('None');
+                }
+                $aliasrows .= ' <span class="LC_small">('.
+                              &mt('controlled by domain: [_1]',
+                                  '<b>'.$dom_in_effect.'</b>').')</span></td>';
+            } else {
+                $dom_in_effect = $dom;
+                my ($current,$samlon,$samloff);
+                $samloff = ' checked="checked"';
+                if (ref($aliases{$dom}) eq 'HASH') {
+                    if ($aliases{$dom}{$server}) {
+                        $current = $aliases{$dom}{$server};
+                    }
+                }
+                if (ref($saml{$dom}) eq 'HASH') {
+                    if ($saml{$dom}{$server}) {
+                        $samlon = $samloff;
+                        undef($samloff);
+                    }
+                }
+                $aliasrows .= '<td class="LC_left_item" style="vertical-align: baseline;">'.
+                              &mt('Alias').': '.
+                              '<input type="text" name="wafproxy_alias_'.$server.'" '.
+                              'value="'.$current.'" size="30" />'.
+                              (' 'x2).'<span class="LC_nobreak">'.
+                              &mt('Alias used for SSO Auth').': <label>'.
+                              '<input type="radio" value="0"'.$samloff.' name="wafproxy_alias_saml_'.$server.'" />'.
+                              &mt('No').'</label> <label>'.
+                              '<input type="radio" value="1"'.$samlon.' name="wafproxy_alias_saml_'.$server.'" />'.
+                              &mt('Yes').'</label></span>'.
+                              '</td>';
+            }
+            $aliasrows .= '</tr>';
+            $aliasinfo{$dom_in_effect} .= $aliasrows;
+        }
+        if ($aliasinfo{$dom}) {
+            my ($onclick,$wafon,$wafoff,$showtable);
+            $onclick = ' onclick="javascript:toggleWAF();"';
+            $wafoff = ' checked="checked"';
+            $showtable = ' style="display:none";';
+            if ($showdom) {
+                $wafon = $wafoff;
+                $wafoff = '';
+                $showtable = ' style="display:inline;"';
+            }
+            $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+            $datatable = '<tr'.$css_class.'>'.
+                         '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'<br />'.
+                         '<span class="LC_nobreak">'.&mt('WAF in use?').' <label>'.
+                         '<input type="radio" name="wafproxy_'.$dom.'" value="1"'.$wafon.$onclick.' />'.
+                         &mt('Yes').'</label>'.(' 'x2).'<label>'.
+                         '<input type="radio" name="wafproxy_'.$dom.'" value="0"'.$wafoff.$onclick.' />'.
+                         &mt('No').'</label></span></td>'.
+                         '<td class="LC_left_item">'.
+                         '<table id="wafproxy_table"'.$showtable.'>'.$aliasinfo{$dom}.
+                         '</table></td></tr>';
+            $itemcount++;
+        }
+        if (keys(%otherdoms)) {
+            foreach my $key (sort(keys(%otherdoms))) {
+                $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+                $datatable .= '<tr'.$css_class.'>'.
+                              '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$key.'</b>').'</td>'.
+                              '<td class="LC_left_item"><table>'.$aliasinfo{$key}.
+                              '</table></td></tr>';
+                $itemcount++;
+            }
+        }
+    } else {
+        my %ip_methods = &remoteip_methods();
+        if ($setdom) {
+            $itemcount ++;
+            $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+            my ($nowafstyle,$wafstyle,$curr_remotip,$currwafdisplay,$vpndircheck,$vpnaliascheck,
+                $currwafvpn,$wafrangestyle,$alltossl,$ssltossl);
+            $wafstyle = ' style="display:none;"';
+            $nowafstyle = ' style="display:table-row;"';
+            $currwafdisplay = ' style="display: none"';
+            $wafrangestyle = ' style="display: none"';
+            $curr_remotip = 'n';
+            $ssltossl = ' checked="checked"';
+            if ($showdom) {
+                $wafstyle = ' style="display:table-row;"';
+                $nowafstyle =  ' style="display:none;"';
+                if (keys(%{$values{$dom}})) {
+                    if ($values{$dom}{remoteip} =~ /^[nmh]$/) {
+                        $curr_remotip = $values{$dom}{remoteip};
+                    }
+                    if ($curr_remotip eq 'h') {
+                        $currwafdisplay = ' style="display:table-row"';
+                        $wafrangestyle = ' style="display:inline-block;"';
+                    }
+                    if ($values{$dom}{'sslopt'}) {
+                        $alltossl = ' checked="checked"';
+                        $ssltossl = '';
+                    }
+                }
+                if (($values{$dom}{'vpnint'} ne '') || ($values{$dom}{'vpnext'} ne '')) {
+                    $vpndircheck = ' checked="checked"';
+                    $currwafvpn = ' style="display:table-row;"';
+                    $wafrangestyle = ' style="display:inline-block;"';
+                } else {
+                    $vpnaliascheck = ' checked="checked"';
+                    $currwafvpn = ' style="display:none;"';
+                }
+            }
+            $datatable .= '<tr'.$css_class.' id="nowafproxyrow_'.$dom.'"'.$wafstyle.'>'.
+                          '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'</td>'.
+                          '<td class="LC_right_item">'.&mt('WAF not in use, nothing to set').'</td>'.
+                          '</tr>'.
+                          '<tr'.$css_class.' id="wafproxyrow_'.$dom.'"'.$wafstyle.'>'.
+                          '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$dom.'</b>').'<br /><br />'.
+                          '<div id="wafproxyranges_'.$dom.'">'.&mt('Format for comma separated IP ranges').':<br />'.
+                          &mt('A.B.C.D/N or A.B.C.D-E.F.G.H').'<br />'.
+                          &mt('Range(s) stored in CIDR notation').'</div></td>'.
+                          '<td class="LC_left_item"><table>'.
+                          '<tr>'.
+                          '<td valign="top">'.$lt{'remoteip'}.': '.
+                          '<select name="wafproxy_remoteip" id="wafproxy_remoteip" onchange="javascript:updateWAF();">';
+            foreach my $option ('m','h','n') {
+                my $sel;
+ '<tr>'.
+                          '<td valign="top">'.$lt{'vpnaccess'}.':<br /><span class="LC_nobreak">'.
+                          '<label><input type="radio" name="wafproxy_vpnaccess"'.$vpndircheck.' value="1" onclick="javascript:checkWAF();" />'.
+                          $lt{'vpndirect'}.'</label>'.(' 'x2).
+                          '<label><input type="radio" name="wafproxy_vpnaccess"'.$vpnaliascheck.' value="0" onclick="javascript:checkWAF();" />'.
+                          $lt{'vpnaliased'}.'</label></span></td></tr>';
+            foreach my $item ('vpnint','vpnext') {
+                $datatable .= '<tr id="wafproxy_show_'.$item.'"'.$currwafvpn.'>'.
+                              '<td valign="top">'.$lt{$item}.':<br />'.
+                              '<textarea name="wafproxy_'.$item.'" rows="3" cols="80">'.
+                              $values{$dom}{$item}.'</textarea>'.
+                              '</td></tr>'."\n";
+            }
+            $datatable .= '<tr><td><hr /></td></tr>'."\n".
+                          '<tr>'.
+                          '<td valign="top">'.$lt{'sslopt'}.':<br /><span class="LC_nobreak">'.
+                          '<label><input type="radio" name="wafproxy_sslopt"'.$alltossl.' value="1" />'.
+                          $lt{'alltossl'}.'</label>'.(' 'x2).
+                          '<label><input type="radio" name="wafproxy_sslopt"'.$ssltossl.' value="0" />'.
+                          $lt{'ssltossl'}.'</label></span></td></tr>'."\n".
+                          '</table></td></tr>';
+        }
+        if (keys(%otherdoms)) {
+            foreach my $domain (sort(keys(%otherdoms))) {
+                $itemcount ++;
+                $css_class = $itemcount%2 ? ' class="LC_odd_row"' : '';
+                $datatable .= '<tr'.$css_class.'>'.
+                              '<td class="LC_left_item">'.&mt('Domain: [_1]','<b>'.$domain.'</b>').'</td>'.
+                              '<td class="LC_left_item"><table>';
+                foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
+                    my $showval = &mt('None');
+                    if ($item eq 'ssl') {
+                        $showval = $lt{'ssltossl'};
+                    }
+                    if ($values{$domain}{$item}) {
+                        $showval = $values{$domain}{$item};
+                        if ($item eq 'ssl') {
+                            $showval = $lt{'alltossl'};
+                        } elsif ($item eq 'remoteip') {
+                            $showval = $ip_methods{$values{$domain}{$item}};
+                        }
+                    }
+                    $datatable .= '<tr>'.
+                                  '<td>'.$lt{$item}.': '.$showval.'</td></tr>';
+                }
+                $datatable .= '</table></td></tr>';
+            }
+        }
+    }
+    $$rowtotal += $itemcount;
+    return $datatable;
+}
+
+sub wafproxy_titles {
+    return &Apache::lonlocal::texthash(
+               remoteip   => "Method for determining user's IP",
+               ipheader   => 'Request header containing remote IP',
+               trusted    => 'Trusted IP range(s)',
+               vpnaccess  => 'Access from institutional VPN',
+               vpndirect  => 'via regular hostname (no WAF)',
+               vpnaliased => 'via aliased hostname (WAF)',
+               vpnint     => 'Internal IP Range(s) for VPN sessions',
+               vpnext     => 'IP Range(s) for backend WAF connections',
+               sslopt     => 'Forwarding http/https',
+               alltossl   => 'WAF forwards both http and https requests to https',
+               ssltossl   => 'WAF forwards http requests to http and https to https',
+           );
+}
+
+sub remoteip_methods {
+    return &Apache::lonlocal::texthash(
+              m => 'Use Apache mod_remoteip',
+              h => 'Use headers parsed by LON-CAPA',
+              n => 'Not in use',
+           );
+}
+
 sub print_usersessions {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my ($css_class,$datatable,%checked,%choices);
@@ -8084,12 +8989,14 @@
 sub modify_login {
     my ($r,$dom,$confname,$lastactref,%domconfig) = @_;
     my ($resulttext,$errors,$colchgtext,%changes,%colchanges,%newfile,%newurl,
-        %curr_loginvia,%loginhash, at currlangs, at newlangs,$addedfile,%title, at offon);
+        %curr_loginvia,%loginhash, at currlangs, at newlangs,$addedfile,%title, at offon,
+        %currsaml,%saml,%samltext,%samlimg,%samlalt,%samlurl,%samltitle,%samlnotsso);
     %title = ( coursecatalog => 'Display course catalog',
                adminmail => 'Display administrator E-mail address',
                helpdesk  => 'Display "Contact Helpdesk" link',
                newuser => 'Link for visitors to create a user account',
-               loginheader => 'Log-in box header');
+               loginheader => 'Log-in box header',
+               saml => 'Dual SSO and non-SSO login');
     @offon = ('off','on');
     if (ref($domconfig{login}) eq 'HASH') {
         if (ref($domconfig{login}{loginvia}) eq 'HASH') {
@@ -8097,6 +9004,20 @@
                 $curr_loginvia{$lonhost} = $domconfig{login}{loginvia}{$lonhost};
             }
         }
+        if (ref($domconfig{login}{'saml'}) eq 'HASH') {
+            foreach my $lonhost (keys(%{$domconfig{login}{'saml'}})) {
+                if (ref($domconfig{login}{'saml'}{$lonhost}) eq 'HASH') {
+                    $currsaml{$lonhost} = $domconfig{login}{'saml'}{$lonhost};
+                    $saml{$lonhost} = 1;
+                    $samltext{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'text'};
+                    $samlurl{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'url'};
+                    $samlalt{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'alt'};
+                    $samlimg{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'img'};
+                    $samltitle{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'title'};
+                    $samlnotsso{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'notsso'};
+                }
+            }
+        }
     }
     ($errors,%colchanges) = &modify_colors($r,$dom,$confname,['login'],
                                            \%domconfig,\%loginhash);
@@ -8317,26 +9238,109 @@
                                                                           "login/headtag/$lonhost",'','',
                                                                           $env{'form.loginheadtag_'.$lonhost.'.filename'});
                     if ($result eq 'ok') {
-                        $loginhash{'login'}{'headtag'}{$lonhost}{'url'} = $newheadtagurls{$lonhost};
-                        $changes{'headtag'}{$lonhost} = 1;
-                        if ($possexempt{$lonhost}) {
-                            $loginhash{'login'}{'headtag'}{$lonhost}{'exempt'} = $possexempt{$lonhost};
-                        }
+                        $loginhash{'login'}{'headtag'}{$lonhost}{'url'} = $newheadtagurls{$lonhost};
+                        $changes{'headtag'}{$lonhost} = 1;
+                        if ($possexempt{$lonhost}) {
+                            $loginhash{'login'}{'headtag'}{$lonhost}{'exempt'} = $possexempt{$lonhost};
+                        }
+                    } else {
+                        my $puberror = &mt("Upload of [_1] failed because an error occurred publishing the file in RES space. Error was: [_2].",
+                                           $newheadtagurls{$lonhost},$result);
+                        $errors .= '<li><span class="LC_error">'.$puberror.'</span></li>';
+                        if ((grep(/^\Q$lonhost\E$/,keys(%currheadtagurls))) &&
+                            (!grep(/^\Q$lonhost\E$/, at delheadtagurls))) {
+                            $loginhash{'login'}{'headtag'}{$lonhost} = $currheadtagurls{$lonhost};
+                        }
+                    }
+                }
+            } else {
+                $error = &mt("Upload of custom markup file(s) failed because an author role could not be assigned to a Domain Configuration user ([_1]) in domain: [_2].  Error was: [_3].",$confname,$dom,$author_ok);
+            }
+        } else {
+            $error = &mt("Upload of custom markup file(s) failed because a Domain Configuration user ([_1]) could not be created in domain: [_2].  Error was: [_3].",$confname,$dom,$configuserok);
+        }
+        if ($error) {
+            &Apache::lonnet::logthis($error);
+            $errors .= '<li><span class="LC_error">'.$error.'</span></li>';
+        }
+    }
+    my @delsamlimg = &Apache::loncommon::get_env_multiple('form.saml_img_del');
+    my @newsamlimgs;
+    foreach my $lonhost (keys(%domservers)) {
+        if ($env{'form.saml_'.$lonhost}) {
+            if ($env{'form.saml_img_'.$lonhost.'.filename'}) {
+                push(@newsamlimgs,$lonhost);
+            }
+            foreach my $item ('text','alt','url','title','notsso') {
+                $env{'form.saml_'.$item.'_'.$lonhost} =~ s/^\s+|\s+$//g;
+            }
+            if ($saml{$lonhost}) {
+                if (grep(/^\Q$lonhost\E$/, at delsamlimg)) {
+#FIXME Need to obsolete published image
+                    delete($currsaml{$lonhost}{'img'});
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_alt_'.$lonhost} ne $samlalt{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_text_'.$lonhost} ne $samltext{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_url_'.$lonhost} ne $samlurl{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_title_'.$lonhost} ne $samltitle{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+                if ($env{'form.saml_notsso_'.$lonhost} ne $samlnotsso{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
+            } else {
+                $changes{'saml'}{$lonhost} = 1;
+            }
+            foreach my $item ('text','alt','url','title','notsso') {
+                $currsaml{$lonhost}{$item} = $env{'form.saml_'.$item.'_'.$lonhost};
+            }
+        } else {
+            if ($saml{$lonhost}) {
+                $changes{'saml'}{$lonhost} = 1;
+                delete($currsaml{$lonhost});
+            }
+        }
+    }
+    foreach my $posshost (keys(%currsaml)) {
+        unless (exists($domservers{$posshost})) {
+            delete($currsaml{$posshost});
+        }
+    }
+    %{$loginhash{'login'}{'saml'}} = %currsaml;
+    if (@newsamlimgs) {
+        my $error;
+        my ($configuserok,$author_ok,$switchserver) = &config_check($dom,$confname,$servadm);
+        if ($configuserok eq 'ok') {
+            if ($switchserver) {
+                $error = &mt("Upload of SSO Button Image is not permitted to this server: [_1].",$switchserver);
+            } elsif ($author_ok eq 'ok') {
+                foreach my $lonhost (@newsamlimgs) {
+                    my $formelem = 'saml_img_'.$lonhost;
+                    my ($result,$imgurl) = &publishlogo($r,'upload',$formelem,$dom,$confname,
+                                                        "login/saml/$lonhost",'','',
+                                                        $env{'form.saml_img_'.$lonhost.'.filename'});
+                    if ($result eq 'ok') {
+                        $currsaml{$lonhost}{'img'} = $imgurl;
+                        $loginhash{'login'}{'saml'}{$lonhost}{'img'} = $imgurl;
+                        $changes{'saml'}{$lonhost} = 1;
                     } else {
-                        my $puberror = &mt("Upload of [_1] failed because an error occurred publishing the file in RES space. Error was: [_2].",
-                                           $newheadtagurls{$lonhost},$result);
+                        my $puberror = &mt("Upload of SSO button image failed for [_1] because an error occurred publishing the file in RES space. Error was: [_2].",
+                                           $lonhost,$result);
                         $errors .= '<li><span class="LC_error">'.$puberror.'</span></li>';
-                        if ((grep(/^\Q$lonhost\E$/,keys(%currheadtagurls))) &&
-                            (!grep(/^\Q$lonhost\E$/, at delheadtagurls))) {
-                            $loginhash{'login'}{'headtag'}{$lonhost} = $currheadtagurls{$lonhost};
-                        }
                     }
                 }
             } else {
-                $error = &mt("Upload of custom markup file(s) failed because an author role could not be assigned to a Domain Configuration user ([_1]) in domain: [_2].  Error was: [_3].",$confname,$dom,$author_ok);
+                $error = &mt("Upload of SSO button image file(s) failed because an author role could not be assigned to a Domain Configuration user ([_1]) in domain: [_2].  Error was: [_3].",$confname,$dom,$author_ok);
             }
         } else {
-            $error = &mt("Upload of custom markup file(s) failed because a Domain Configuration user ([_1]) could not be created in domain: [_2].  Error was: [_3].",$confname,$dom,$configuserok);
+            $error = &mt("Upload of SSO button image file(s) failed because a Domain Configuration user ([_1]) could not be created in domain: [_2].  Error was: [_3].",$confname,$dom,$configuserok);
         }
         if ($error) {
             &Apache::lonnet::logthis($error);
@@ -8383,6 +9387,31 @@
         }
         if (keys(%changes) > 0 || $colchgtext) {
             &Apache::loncommon::devalidate_domconfig_cache($dom);
+            if (exists($changes{'saml'})) {
+                my $hostid_in_use;
+                my @hosts = &Apache::lonnet::current_machine_ids();
+                if (@hosts > 1) {
+                    foreach my $hostid (@hosts) {
+                        if (&Apache::lonnet::host_domain($hostid) eq $dom) {
+                            $hostid_in_use = $hostid;
+                            last;
+                        }
+                    }
+                } else {
+                    $hostid_in_use = $r->dir_config('lonHostID');
+                }
+                if (($hostid_in_use) &&
+                    (&Apache::lonnet::host_domain($hostid_in_use) eq $dom)) {
+                    &Apache::lonnet::devalidate_cache_new('samllanding',$hostid_in_use);
+                }
+                if (ref($lastactref) eq 'HASH') {
+                    if (ref($changes{'saml'}) eq 'HASH') {
+                        my %updates;
+                        map { $updates{$_} = 1; } keys(%{$changes{'saml'}});
+                        $lastactref->{'samllanding'} = \%updates;
+                    }
+                }
+            }
             if (ref($lastactref) eq 'HASH') {
                 $lastactref->{'domainconfig'} = 1;
             }
@@ -8462,6 +9491,38 @@
                             }
                         }
                     }
+                } elsif ($item eq 'saml') {
+                    if (ref($changes{$item}) eq 'HASH') {
+                        my %notlt = (
+                                       text   => 'Text for log-in by SSO',
+                                       img    => 'SSO button image',
+                                       alt    => 'Alt text for button image',
+                                       url    => 'SSO URL',
+                                       title  => 'Tooltip for SSO link',
+                                       notsso => 'Text for non-SSO log-in',
+                                    );
+                        foreach my $lonhost (sort(keys(%{$changes{$item}}))) {
+                            if (ref($currsaml{$lonhost}) eq 'HASH') {
+                                $resulttext .= '<li>'.&mt("$title{$item} in use for [_1]","<b>$lonhost</b>").
+                                               '<ul>';
+                                foreach my $key ('text','img','alt','url','title','notsso') {
+                                    if ($currsaml{$lonhost}{$key} eq '') {
+                                        $resulttext .= '<li>'.&mt("$notlt{$key} not in use").'</li>';
+                                    } else {
+                                        my $value = "'$currsaml{$lonhost}{$key}'";
+                                        if ($key eq 'img') {
+                                            $value = '<img src="'.$currsaml{$lonhost}{$key}.'" />';
+                                        }
+                                        $resulttext .= '<li>'.&mt("$notlt{$key} set to: [_1]",
+                                                                  $value).'</li>';
+                                    }
+                                }
+                                $resulttext .= '</ul></li>';
+                            } else {
+                                $resulttext .= '<li>'.&mt("$title{$item} not in use for [_1]",$lonhost).'</li>';
+                            }
+                        }
+                    }
                 } elsif ($item eq 'captcha') {
                     if (ref($loginhash{'login'}) eq 'HASH') {
                         my $chgtxt;
@@ -8564,6 +9625,283 @@
     return %choices;
 }
 
+sub modify_ipaccess {
+    my ($dom,$lastactref,%domconfig) = @_;
+    my (@allpos,%changes,%confhash,$errors,$resulttext);
+    my (@items,%deletions,%itemids, at warnings);
+    my ($typeorder,$types) = &commblocktype_text();
+    if ($env{'form.ipaccess_add'}) {
+        my $name = $env{'form.ipaccess_name_add'};
+        my ($newid,$error) = &get_ipaccess_id($dom,$name);
+        if ($newid) {
+            $itemids{'add'} = $newid;
+            push(@items,'add');
+            $changes{$newid} = 1;
+        } else {
+            $error = &mt('Failed to acquire unique ID for new IP access control item');
+            $errors .= '<li><span class="LC_error">'.$error.'</span></li>';
+        }
+    }
+    if (ref($domconfig{'ipaccess'}) eq 'HASH') {
+        my @todelete = &Apache::loncommon::get_env_multiple('form.ipaccess_del');
+        if (@todelete) {
+            map { $deletions{$_} = 1; } @todelete;
+        }
+        my $maxnum = $env{'form.ipaccess_maxnum'};
+        for (my $i=0; $i<$maxnum; $i++) {
+            my $itemid = $env{'form.ipaccess_id_'.$i};
+            $itemid =~ s/\D+//g;
+            if (ref($domconfig{'ipaccess'}{$itemid}) eq 'HASH') {
+                if ($deletions{$itemid}) {
+                    $changes{$itemid} = $domconfig{'ipaccess'}{$itemid}{'name'};
+                } else {
+                    push(@items,$i);
+                    $itemids{$i} = $itemid;
+                }
+            }
+        }
+    }
+    foreach my $idx (@items) {
+        my $itemid = $itemids{$idx};
+        next unless ($itemid);
+        my %current;
+        unless ($idx eq 'add') {
+            if (ref($domconfig{'ipaccess'}{$itemid}) eq 'HASH') {
+                %current = %{$domconfig{'ipaccess'}{$itemid}};
+            }
+        }
+        my $position = $env{'form.ipaccess_pos_'.$itemid};
+        $position =~ s/\D+//g;
+        if ($position ne '') {
+            $allpos[$position] = $itemid;
+        }
+        my $name = $env{'form.ipaccess_name_'.$idx};
+        $name =~ s/^\s+|\s+$//g;
+        $confhash{$itemid}{'name'} = $name;
+        my $possrange = $env{'form.ipaccess_range_'.$idx};
+        $possrange =~ s/^\s+|\s+$//g;
+        unless ($possrange eq '') {
+            $possrange =~ s/[\r\n]+/\s/g;
+            $possrange =~ s/\s*-\s*/-/g;
+            $possrange =~ s/\s+/,/g;
+            $possrange =~ s/,+/,/g;
+            if ($possrange ne '') {
+                my (@ok,$count);
+                $count = 0;
+                foreach my $poss (split(/\,/,$possrange)) {
+                    $count ++;
+                    $poss = &validate_ip_pattern($poss);
+                    if ($poss ne '') {
+                        push(@ok,$poss);
+                    }
+                }
+                my $diff = $count - scalar(@ok);
+                if ($diff) {
+                    $errors .= '<li><span class="LC_error">'.
+                               &mt('[quant,_1,IP] invalid and excluded from saved value for IP range(s) for [_2]',
+                                   $diff,$name).
+                               '</span></li>';
+                }
+                if (@ok) {
+                    my @cidr_list;
+                    foreach my $item (@ok) {
+                        @cidr_list = &Net::CIDR::cidradd($item, at cidr_list);
+                    }
+                    $confhash{$itemid}{'ip'} = join(',', at cidr_list);
+                }
+            }
+        }
+        foreach my $field ('name','ip') {
+            unless (($idx eq 'add') || ($changes{$itemid})) {
+                if ($current{$field} ne $confhash{$itemid}{$field}) {
+                    $changes{$itemid} = 1;
+                    last;
+                }
+            }
+        }
+        $confhash{$itemid}{'commblocks'} = {};
+
+        my %commblocks;
+        map { $commblocks{$_} = 1; } &Apache::loncommon::get_env_multiple('form.ipaccess_block_'.$idx);
+        foreach my $type (@{$typeorder}) {
+            if ($commblocks{$type}) {
+                $confhash{$itemid}{'commblocks'}{$type} = 'on';
+            }
+            unless (($idx eq 'add') || ($changes{$itemid})) {
+                if (ref($current{'commblocks'}) eq 'HASH') {
+                    if ($confhash{$itemid}{'commblocks'}{$type} ne $current{'commblocks'}{$type}) {
+                        $changes{$itemid} = 1;
+                    }
+                } elsif ($confhash{$itemid}{'commblocks'}{$type}) {
+                    $changes{$itemid} = 1;
+                }
+            }
+        }
+        $confhash{$itemid}{'courses'} = {};
+        my %crsdeletions;
+        my @delcrs = &Apache::loncommon::get_env_multiple('form.ipaccess_course_delete_'.$idx);
+        if (@delcrs) {
+            map { $crsdeletions{$_} = 1; } @delcrs;
+        }
+        if (ref($current{'courses'}) eq 'HASH') {
+            foreach my $cid (sort(keys(%{$current{'courses'}}))) {
+                if ($crsdeletions{$cid}) {
+                    $changes{$itemid} = 1;
+                } else {
+                    $confhash{$itemid}{'courses'}{$cid} = 1;
+                }
+            }
+        }
+        $env{'form.ipaccess_cnum_'.$idx} =~ s/^\s+|\s+$//g;
+        $env{'form.ipaccess_cdom_'.$idx} =~ s/^\s+|\s+$//g;
+        if (($env{'form.ipaccess_cnum_'.$idx} =~ /^$match_courseid$/) &&
+            ($env{'form.ipaccess_cdom_'.$idx} =~ /^$match_domain$/)) {
+            if (&Apache::lonnet::homeserver($env{'form.ipaccess_cnum_'.$idx},
+                                            $env{'form.ipaccess_cdom_'.$idx}) eq 'no_host') {
+                $errors .= '<li><span class="LC_error">'.
+                           &mt('Invalid courseID [_1] omitted from list of allowed courses',
+                               $env{'form.ipaccess_cdom_'.$idx}.'_'.$env{'form.ipaccess_cnum_'.$idx}).
+                           '</span></li>';
+            } else {
+                $confhash{$itemid}{'courses'}{$env{'form.ipaccess_cdom_'.$idx}.'_'.$env{'form.ipaccess_cnum_'.$idx}} = 1;
+                $changes{$itemid} = 1;
+            }
+        }
+    }
+    if (@allpos > 0) {
+        my $idx = 0;
+        foreach my $itemid (@allpos) {
+            if ($itemid ne '') {
+                $confhash{$itemid}{'order'} = $idx;
+                unless ($changes{$itemid}) {
+                    if (ref($domconfig{'ipaccess'}) eq 'HASH') {
+                        if (ref($domconfig{'ipaccess'}{$itemid}) eq 'HASH') {
+                            if ($domconfig{'ipaccess'}{$itemid}{'order'} ne $idx) {
+                                $changes{$itemid} = 1;
+                            }
+                        }
+                    }
+                }
+                $idx ++;
+            }
+        }
+    }
+    if (keys(%changes)) {
+        my %defaultshash = (
+                              ipaccess => \%confhash,
+                           );
+        my $putresult = &Apache::lonnet::put_dom('configuration',\%defaultshash,
+                                                 $dom);
+        if ($putresult eq 'ok') {
+            my $cachetime = 1800;
+            &Apache::lonnet::do_cache_new('ipaccess',$dom,\%confhash,$cachetime);
+            if (ref($lastactref) eq 'HASH') {
+                $lastactref->{'ipaccess'} = 1;
+            }
+            $resulttext = &mt('Changes made:').'<ul>';
+            my %bynum;
+            foreach my $itemid (sort(keys(%changes))) {
+                if (ref($confhash{$itemid}) eq 'HASH') {
+                    my $position = $confhash{$itemid}{'order'};
+                    if ($position =~ /^\d+$/) {
+                        $bynum{$position} = $itemid;
+                    }
+                }
+            }
+            if (keys(%deletions)) {
+                foreach my $itemid (sort { $a <=> $b } keys(%deletions)) {
+                    $resulttext .= '<li>'.&mt('Deleted: [_1]',$changes{$itemid}).'</li>';
+                }
+            }
+            foreach my $pos (sort { $a <=> $b } keys(%bynum)) {
+                my $itemid = $bynum{$pos};
+                if (ref($confhash{$itemid}) eq 'HASH') {
+                    $resulttext .= '<li><b>'.$confhash{$itemid}{'name'}.'</b><ul>';
+                    my $position = $pos + 1;
+                    $resulttext .= '<li>'.&mt('Order: [_1]',$position).'</li>';
+                    if ($confhash{$itemid}{'ip'} eq '') {
+                        $resulttext .= '<li>'.&mt('No IP Range(s) set').'</li>';
+                    } else {
+                        $resulttext .= '<li>'.&mt('IP Range(s): [_1]',$confhash{$itemid}{'ip'}).'</li>';
+                    }
+                    if (keys(%{$confhash{$itemid}{'commblocks'}})) {
+                        $resulttext .= '<li>'.&mt('Functionality Blocked: [_1]',
+                                                  join(', ', map { $types->{$_}; } sort(keys(%{$confhash{$itemid}{'commblocks'}})))).
+                                       '</li>';
+                    } else {
+                        $resulttext .= '<li>'.&mt('No functionality blocked').'</li>';
+                    }
+                    if (keys(%{$confhash{$itemid}{'courses'}})) {
+                        my @courses;
+                        foreach my $cid (sort(keys(%{$confhash{$itemid}{'courses'}}))) {
+                            my %courseinfo = &Apache::lonnet::coursedescription($cid,{'one_time' => 1});
+                            push(@courses,$courseinfo{'description'}.' ('.$cid.')');
+                        }
+                        $resulttext .= '<li>'.&mt('Courses/Communities allowed').':<ul><li>'.
+                                             join('</li><li>', at courses).'</li></ul>';
+                    } else {
+                        $resulttext .= '<li>'.&mt('No courses allowed').'</li>';
+                    }
+                    $resulttext .= '</ul></li>';
+                }
+            }
+            $resulttext .= '</ul>';
+        } else {
+            $errors .= '<li><span class="LC_error">'.&mt('Failed to save changes').'</span></li>';
+        }
+    } else {
+        $resulttext = &mt('No changes made');
+    }
+    if ($errors) {
+        $resulttext .= '<p>'.&mt('The following errors occurred: ').'<ul>'.
+                       $errors.'</ul></p>';
+    }
+    return $resulttext;
+}
+
+sub get_ipaccess_id {
+    my ($domain,$location) = @_;
+    # get lock on ipaccess db
+    my $lockhash = {
+                      lock => $env{'user.name'}.
+                              ':'.$env{'user.domain'},
+                   };
+    my $tries = 0;
+    my $gotlock = &Apache::lonnet::newput_dom('ipaccess',$lockhash,$domain);
+    my ($id,$error);
+
+    while (($gotlock ne 'ok') && ($tries<10)) {
+        $tries ++;
+        sleep (0.1);
+        $gotlock = &Apache::lonnet::newput_dom('ipaccess',$lockhash,$domain);
+    }
+    if ($gotlock eq 'ok') {
+        my %currids = &Apache::lonnet::dump_dom('ipaccess',$domain);
+        if ($currids{'lock'}) {
+            delete($currids{'lock'});
+            if (keys(%currids)) {
+                my @curr = sort { $a <=> $b } keys(%currids);
+                if ($curr[-1] =~ /^\d+$/) {
+                    $id = 1 + $curr[-1];
+                }
+            } else {
+                $id = 1;
+            }
+            if ($id) {
+                unless (&Apache::lonnet::newput_dom('ipaccess',{ $id => $location },$domain) eq 'ok') {
+                    $error = 'nostore';
+                }
+            } else {
+                $error = 'nonumber';
+            }
+        }
+        my $dellockoutcome = &Apache::lonnet::del_dom('ipaccess',['lock'],$domain);
+    } else {
+        $error = 'nolock';
+    }
+    return ($id,$error);
+}
+
 sub modify_rolecolors {
     my ($r,$dom,$confname,$roles,$lastactref,%domconfig) = @_;
     my ($resulttext,%rolehash);
@@ -10129,8 +11467,10 @@
     }
     my @offon = ('off','on');
     my %title = &Apache::lonlocal::texthash (
-                   run => 'Auto-update:',
-                   classlists => 'Updates to user information in classlists?'
+                    run        => 'Auto-update:',
+                    classlists => 'Updates to user information in classlists?',
+                    unexpired  => 'Skip updates for users without active or future roles?',
+                    lastactive => 'Skip updates for inactive users?',
                 );
     my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
     my %fieldtitles = &Apache::lonlocal::texthash (
@@ -10174,12 +11514,23 @@
     my %updatehash = (
                       autoupdate => { run => $env{'form.autoupdate_run'},
                                       classlists => $env{'form.classlists'},
+                                      unexpired  => $env{'form.unexpired'},
                                       fields => {%fields},
                                       lockablenames => \@lockablenames,
                                     }
                      );
+    my $lastactivedays;
+    if ($env{'form.lastactive'}) {
+        $lastactivedays = $env{'form.lastactivedays'};
+        $lastactivedays =~ s/^\s+|\s+$//g;
+        unless ($lastactivedays =~ /^\d+$/) {
+            undef($lastactivedays);
+            $env{'form.lastactive'} = 0;
+        }
+    }
+    $updatehash{'autoupdate'}{'lastactive'} = $lastactivedays;
     foreach my $key (keys(%currautoupdate)) {
-        if (($key eq 'run') || ($key eq 'classlists')) {
+        if (($key eq 'run') || ($key eq 'classlists') || ($key eq 'unexpired') || ($key eq 'lastactive')) {
             if (exists($updatehash{autoupdate}{$key})) {
                 if ($currautoupdate{$key} ne $updatehash{autoupdate}{$key}) {
                     $changes{$key} = 1;
@@ -10225,6 +11576,16 @@
             $changes{'lockablenames'} = 1;
         }
     }
+    unless (grep(/^unexpired$/,keys(%currautoupdate))) {
+        if ($updatehash{'autoupdate'}{'unexpired'}) {
+            $changes{'unexpired'} = 1;
+        }
+    }
+    unless (grep(/^lastactive$/,keys(%currautoupdate))) {
+        if ($updatehash{'autoupdate'}{'lastactive'} ne '') {
+            $changes{'lastactive'} = 1;
+        }
+    }
     foreach my $item (@{$types},'default') {
         if (defined($fields{$item})) {
             if (ref($currautoupdate{'fields'}) eq 'HASH') {
@@ -10287,6 +11648,11 @@
                     my $newvalue;
                     if ($key eq 'run') {
                         $newvalue = $offon[$env{'form.autoupdate_run'}];
+                    } elsif ($key eq 'lastactive') {
+                        $newvalue = $offon[$env{'form.lastactive'}];
+                        unless ($lastactivedays eq '') {
+                            $newvalue .= '; '.&mt('inactive = no activity in last [quant,_1,day]',$lastactivedays);
+                        }
                     } else {
                         $newvalue = $offon[$env{'form.'.$key}];
                     }
@@ -14755,6 +16121,344 @@
     return $resulttext;
 }
 
+sub modify_wafproxy {
+    my ($dom,$action,$lastactref,%domconfig) = @_;
+    my %servers = &Apache::lonnet::internet_dom_servers($dom);
+    my (%othercontrol,%canset,%values,%curralias,%currsaml,%currvalue, at warnings,
+        %wafproxy,%changes,%expirecache,%expiresaml);
+    foreach my $server (sort(keys(%servers))) {
+        my $serverhome = &Apache::lonnet::get_server_homeID($servers{$server});
+        if ($serverhome eq $server) {
+            my $serverdom = &Apache::lonnet::host_domain($server);
+            if ($serverdom eq $dom) {
+                $canset{$server} = 1;
+            }
+        }
+    }
+    if (ref($domconfig{'wafproxy'}) eq 'HASH') {
+        %{$values{$dom}} = ();
+        if (ref($domconfig{'wafproxy'}{'alias'}) eq 'HASH') {
+            %curralias = %{$domconfig{'wafproxy'}{'alias'}};
+        }
+        if (ref($domconfig{'wafproxy'}{'saml'}) eq 'HASH') {
+            %currsaml = %{$domconfig{'wafproxy'}{'saml'}};
+        }
+        foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
+            $currvalue{$item} = $domconfig{'wafproxy'}{$item};
+        }
+    }
+    my $output;
+    if (keys(%canset)) {
+        %{$wafproxy{'alias'}} = ();
+        %{$wafproxy{'saml'}} = ();
+        foreach my $key (sort(keys(%canset))) {
+            if ($env{'form.wafproxy_'.$dom}) {
+                $wafproxy{'alias'}{$key} = $env{'form.wafproxy_alias_'.$key};
+                $wafproxy{'alias'}{$key} =~ s/^\s+|\s+$//g;
+                if ($wafproxy{'alias'}{$key} ne $curralias{$key}) {
+                    $changes{'alias'} = 1;
+                }
+                if ($env{'form.wafproxy_alias_saml_'.$key}) {
+                    $wafproxy{'saml'}{$key} = 1;
+                }
+                if ($wafproxy{'saml'}{$key} ne $currsaml{$key}) {
+                    $changes{'saml'} = 1;
+                }
+            } else {
+                $wafproxy{'alias'}{$key} = '';
+                $wafproxy{'saml'}{$key} = '';
+                if ($curralias{$key}) {
+                    $changes{'alias'} = 1;
+                }
+                if ($currsaml{$key}) {
+                    $changes{'saml'} = 1;
+                }
+            }
+            if ($wafproxy{'alias'}{$key} eq '') {
+                if ($curralias{$key}) {
+                    $expirecache{$key} = 1;
+                }
+                delete($wafproxy{'alias'}{$key});
+            }
+            if ($wafproxy{'saml'}{$key} eq '') {
+                if ($currsaml{$key}) {
+                    $expiresaml{$key} = 1;
+                }
+                delete($wafproxy{'saml'}{$key});
+            }
+        }
+        unless (keys(%{$wafproxy{'alias'}})) {
+            delete($wafproxy{'alias'});
+        }
+        unless (keys(%{$wafproxy{'saml'}})) {
+            delete($wafproxy{'saml'});
+        }
+        # Localization for values in %warn occurs in &mt() calls separately.
+        my %warn = (
+                     trusted => 'trusted IP range(s)',
+                     vpnint => 'internal IP range(s) for VPN sessions(s)',
+                     vpnext => 'IP range(s) for backend WAF connections',
+                   );
+        foreach my $item ('remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
+            my $possible = $env{'form.wafproxy_'.$item};
+            $possible =~ s/^\s+|\s+$//g;
+            if ($possible ne '') {
+                if ($item eq 'remoteip') {
+                    if ($possible =~ /^[mhn]$/) {
+                        $wafproxy{$item} = $possible;
+                    }
+                } elsif ($item eq 'ipheader') {
+                    if ($wafproxy{'remoteip'} eq 'h') {
+                        $wafproxy{$item} = $possible;
+                    }
+                } elsif ($item eq 'sslopt') {
+                    if ($possible =~ /^0|1$/) {
+                        $wafproxy{$item} = $possible;
+                    }
+                } else {
+                    my (@ok,$count);
+                    if (($item eq 'vpnint') || ($item eq 'vpnext')) {
+                        unless ($env{'form.wafproxy_vpnaccess'}) {
+                            $possible = '';
+                        }
+                    } elsif ($item eq 'trusted') {
+                        unless ($wafproxy{'remoteip'} eq 'h') {
+                            $possible = '';
+                        }
+                    }
+                    unless ($possible eq '') {
+                        $possible =~ s/[\r\n]+/\s/g;
+                        $possible =~ s/\s*-\s*/-/g;
+                        $possible =~ s/\s+/,/g;
+                        $possible =~ s/,+/,/g;
+                    }
+                    $count = 0;
+                    if ($possible ne '') {
+                        foreach my $poss (split(/\,/,$possible)) {
+                            $count ++;
+                            $poss = &validate_ip_pattern($poss);
+                            if ($poss ne '') {
+                                push(@ok,$poss);
+                            }
+                        }
+                        my $diff = $count - scalar(@ok);
+                        if ($diff) {
+                            push(@warnings,'<li>'.
+                                 &mt('[quant,_1,IP] invalid and excluded from saved value for [_2]',
+                                     $diff,$warn{$item}).
+                                 '</li>');
+                        }
+                        if (@ok) {
+                            my @cidr_list;
+                            foreach my $item (@ok) {
+                                @cidr_list = &Net::CIDR::cidradd($item, at cidr_list);
+                            }
+                            $wafproxy{$item} = join(',', at cidr_list);
+                        }
+                    }
+                }
+                if ($wafproxy{$item} ne $currvalue{$item}) {
+                    $changes{$item} = 1;
+                }
+            } elsif ($currvalue{$item}) {
+                $changes{$item} = 1;
+            }
+        }
+    } else {
+        if (keys(%curralias)) {
+            $changes{'alias'} = 1;
+        }
+        if (keys(%currsaml)) {
+            $changes{'saml'} = 1;
+        }
+        if (keys(%currvalue)) {
+            foreach my $key (keys(%currvalue)) {
+                $changes{$key} = 1;
+            }
+        }
+    }
+    if (keys(%changes)) {
+        my %defaultshash = (
+                              wafproxy => \%wafproxy,
+                           );
+        my $putresult = &Apache::lonnet::put_dom('configuration',\%defaultshash,
+                                                 $dom);
+        if ($putresult eq 'ok') {
+            my $cachetime = 24*60*60;
+            my (%domdefaults,$updatedomdefs);
+            foreach my $item ('ipheader','trusted','vpnint','vpnext','sslopt') {
+                if ($changes{$item}) {
+                    unless ($updatedomdefs) {
+                        %domdefaults = &Apache::lonnet::get_domain_defaults($dom);
+                        $updatedomdefs = 1;
+                    }
+                    if ($wafproxy{$item}) {
+                        $domdefaults{'waf_'.$item} = $wafproxy{$item};
+                    } elsif (exists($domdefaults{'waf_'.$item})) {
+                        delete($domdefaults{'waf_'.$item});
+                    }
+                }
+            }
+            if ($updatedomdefs) {
+                &Apache::lonnet::do_cache_new('domdefaults',$dom,\%domdefaults,$cachetime);
+                if (ref($lastactref) eq 'HASH') {
+                    $lastactref->{'domdefaults'} = 1;
+                }
+            }
+            if ((exists($wafproxy{'alias'})) || (keys(%expirecache))) {
+                my %updates = %expirecache;
+                foreach my $key (keys(%expirecache)) {
+                    &Apache::lonnet::devalidate_cache_new('proxyalias',$key);
+                }
+                if (ref($wafproxy{'alias'}) eq 'HASH') {
+                    my $cachetime = 24*60*60;
+                    foreach my $key (keys(%{$wafproxy{'alias'}})) {
+                        $updates{$key} = 1;
+                        &Apache::lonnet::do_cache_new('proxyalias',$key,$wafproxy{'alias'}{$key},
+                                                      $cachetime);
+                    }
+                }
+                if (ref($lastactref) eq 'HASH') {
+                    $lastactref->{'proxyalias'} = \%updates;
+                }
+            }
+            if ((exists($wafproxy{'saml'})) || (keys(%expiresaml))) {
+                my %samlupdates = %expiresaml;
+                foreach my $key (keys(%expiresaml)) {
+                    &Apache::lonnet::devalidate_cache_new('proxysaml',$key);
+                }
+                if (ref($wafproxy{'saml'}) eq 'HASH') {
+                    my $cachetime = 24*60*60;
+                    foreach my $key (keys(%{$wafproxy{'saml'}})) {
+                        $samlupdates{$key} = 1;
+                        &Apache::lonnet::do_cache_new('proxysaml',$key,$wafproxy{'saml'}{$key},
+                                                      $cachetime);
+                    }
+                }
+                if (ref($lastactref) eq 'HASH') {
+                    $lastactref->{'proxysaml'} = \%samlupdates;
+                }
+            }
+            $output = &mt('Changes were made to Web Application Firewall/Reverse Proxy').'<ul>';
+            foreach my $item ('alias','remoteip','ipheader','trusted','vpnint','vpnext','sslopt') {
+                if ($changes{$item}) {
+                    if ($item eq 'alias') {
+                        my $numaliased = 0;
+                        if (ref($wafproxy{'alias'}) eq 'HASH') {
+                            my $shown;
+                            if (keys(%{$wafproxy{'alias'}})) {
+                                foreach my $server (sort(keys(%{$wafproxy{'alias'}}))) {
+                                    $shown .= '<li>'.&mt('[_1] aliased by [_2]',
+                                                         &Apache::lonnet::hostname($server),
+                                                         $wafproxy{'alias'}{$server}).'</li>';
+                                    $numaliased ++;
+                                }
+                                if ($numaliased) {
+                                    $output .= '<li>'.&mt('Aliases for hostnames set to: [_1]',
+                                                          '<ul>'.$shown.'</ul>').'</li>';
+                                }
+                            }
+                        }
+                        unless ($numaliased) {
+                            $output .= '<li>'.&mt('Aliases deleted for hostnames').'</li>';
+                        }
+                    } elsif ($item eq 'saml') {
+                        my $shown;
+                        if (ref($wafproxy{'saml'}) eq 'HASH') {
+                            if (keys(%{$wafproxy{'saml'}})) {
+                                $shown = join(', ',sort(keys(%{$wafproxy{'saml'}})));
+                            }
+                        }
+                        if ($shown) {
+                            $output .= '<li>'.&mt('Alias used by SSO Auth for: [_1]',
+                                                  $shown).'</li>';
+                        } else {
+                            $output .= '<li>'.&mt('No alias used for SSO Auth').'</li>';
+                        }
+                    } else {
+                        if ($item eq 'remoteip') {
+                            my %ip_methods = &remoteip_methods();
+                            if ($wafproxy{$item} =~ /^[mh]$/) {
+                                $output .= '<li>'.&mt("Method for determining user's IP set to: [_1]",
+                                                      $ip_methods{$wafproxy{$item}}).'</li>';
+                            } else {
+                                if (($env{'form.wafproxy_'.$dom}) && (ref($wafproxy{'alias'}) eq 'HASH')) {
+                                    $output .= '<li>'.&mt("No method in use to get user's real IP (will report IP used by WAF).").
+                                               '</li>';
+                                } else {
+                                    $output .= '<li>'.&mt('WAF/Reverse Proxy not in use').'</li>';
+                                }
+                            }
+                        } elsif ($item eq 'ipheader') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('Request header with remote IP set to: [_1]',
+                                                      $wafproxy{$item}).'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('Request header with remote IP deleted').'</li>';
+                            }
+                        } elsif ($item eq 'trusted') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('Trusted IP range(s) set to: [_1]',
+                                                      $wafproxy{$item}).'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('Trusted IP range(s) deleted').'</li>';
+                            }
+                        } elsif ($item eq 'vpnint') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('Internal IP Range(s) for VPN sessions set to: [_1]',
+                                                       $wafproxy{$item}).'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('Internal IP Range(s) for VPN sessions deleted').'</li>';
+                            }
+                        } elsif ($item eq 'vpnext') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('IP Range(s) for backend WAF connections set to: [_1]',
+                                                       $wafproxy{$item}).'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('IP Range(s) for backend WAF connections deleted').'</li>';
+                            }
+                        } elsif ($item eq 'sslopt') {
+                            if ($wafproxy{$item}) {
+                                $output .= '<li>'.&mt('WAF/Reverse Proxy expected to forward requests to https on LON-CAPA node, regardless of original protocol in web browser (http or https).').'</li>';
+                            } else {
+                                $output .= '<li>'.&mt('WAF/Reverse Proxy expected to preserve original protocol in web browser (either http or https) when forwarding to LON-CAPA node.').'</li>';
+                            }
+                        }
+                    }
+                }
+            }
+        } else {
+            $output = '<span class="LC_error">'.
+                      &mt('An error occurred: [_1]',$putresult).'</span>';
+        }
+    } elsif (keys(%canset)) {
+        $output = &mt('No changes made to Web Application Firewall/Reverse Proxy settings');
+    }
+    if (@warnings) {
+        $output .= '<br />'.&mt('Warnings:').'<ul>'.
+                       join("\n", at warnings).'</ul>';
+    }
+    return $output;
+}
+
+sub validate_ip_pattern {
+    my ($pattern) = @_;
+    if ($pattern =~ /^([^-]+)\-([^-]+)$/) {
+        my ($start,$end) = ($1,$2);
+        if ((&Net::CIDR::cidrvalidate($start)) && (&Net::CIDR::cidrvalidate($end))) {
+            if (($start !~ m{/}) && ($end !~ m{/})) {
+                return $start.'-'.$end;
+            }
+        }
+    } elsif ($pattern ne '') {
+        $pattern = &Net::CIDR::cidrvalidate($pattern);
+        if ($pattern ne '') {
+            return $pattern;
+        }
+    }
+    return;
+}
+
 sub modify_usersessions {
     my ($dom,$lastactref,%domconfig) = @_;
     my @hostingtypes = ('version','excludedomain','includedomain');
@@ -16144,16 +17848,48 @@
     my %thismachine;
     map { $thismachine{$_} = 1; } &Apache::lonnet::current_machine_ids();
     my @posscached = ('domainconfig','domdefaults','usersessions',
-                      'directorysrch','passwdconf','cats');
+                      'directorysrch','passwdconf','cats','proxyalias','proxysaml',
+                      'ipaccess');
+    my %cache_by_lonhost;
+    if (exists($cachekeys->{'samllanding'})) {
+        if (ref($cachekeys->{'samllanding'}) eq 'HASH') {
+            my %landing = %{$cachekeys->{'samllanding'}};
+            my %domservers = &Apache::lonnet::get_servers($dom);
+            if (keys(%domservers)) {
+                foreach my $server (keys(%domservers)) {
+                    my @cached;
+                    next if ($thismachine{$server});
+                    if ($landing{$server}) {
+                        push(@cached,&escape('samllanding').':'.&escape($server));
+                    }
+                    if (@cached) {
+                        $cache_by_lonhost{$server} = \@cached;
+                    }
+                }
+            }
+        }
+    }
     if (keys(%servers)) {
         foreach my $server (keys(%servers)) {
             next if ($thismachine{$server});
             my @cached;
             foreach my $name (@posscached) {
                 if ($cachekeys->{$name}) {
-                    push(@cached,&escape($name).':'.&escape($dom));
+                    if (($name eq 'proxyalias') || ($name eq 'proxysaml')) {
+                        if (ref($cachekeys->{$name}) eq 'HASH') {
+                            foreach my $key (keys(%{$cachekeys->{$name}})) {
+                                push(@cached,&escape($name).':'.&escape($key));
+                            }
+                        }
+                    } else {
+                        push(@cached,&escape($name).':'.&escape($dom));
+                    }
                 }
             }
+            if ((exists($cache_by_lonhost{$server})) &&
+                (ref($cache_by_lonhost{$server}) eq 'ARRAY')) {
+                push(@cached,@{$cache_by_lonhost{$server}});
+            }
             if (@cached) {
                 &Apache::lonnet::remote_devalidate_cache($server,\@cached);
             }


More information about the LON-CAPA-cvs mailing list