From fdafb2ea76ab0e759d8651b57a56acf04611f417 Mon Sep 17 00:00:00 2001
From: srosse <stephane.rosse@frentix.com>
Date: Mon, 16 Jul 2018 10:22:05 +0200
Subject: [PATCH] OO-3296: unify the SiteDef implementation for the new roles,
 and their security callback

---
 .../org/olat/admin/site/UserAdminSiteDef.java |  7 ++--
 .../site/ui/SitesConfigurationController.java | 22 +++++-------
 .../user/SystemRolesAndRightsController.java  |  2 +-
 .../admin/user/UsermanagerUserSearchForm.java | 36 ++++++-------------
 .../user/_i18n/LocalStrings_ar.properties     |  5 +--
 .../user/_i18n/LocalStrings_bg.properties     |  5 +--
 .../user/_i18n/LocalStrings_cs.properties     |  5 +--
 .../user/_i18n/LocalStrings_da.properties     |  5 +--
 .../user/_i18n/LocalStrings_de.properties     | 29 ++++++++++-----
 .../user/_i18n/LocalStrings_el.properties     |  5 +--
 .../user/_i18n/LocalStrings_en.properties     |  5 +--
 .../user/_i18n/LocalStrings_es.properties     |  5 +--
 .../user/_i18n/LocalStrings_fa.properties     |  5 +--
 .../user/_i18n/LocalStrings_fr.properties     |  5 +--
 .../user/_i18n/LocalStrings_it.properties     |  5 +--
 .../user/_i18n/LocalStrings_jp.properties     |  5 +--
 .../user/_i18n/LocalStrings_lt.properties     |  5 +--
 .../user/_i18n/LocalStrings_nl_NL.properties  |  5 +--
 .../user/_i18n/LocalStrings_pl.properties     |  5 +--
 .../user/_i18n/LocalStrings_pt_BR.properties  |  5 +--
 .../user/_i18n/LocalStrings_pt_PT.properties  |  5 +--
 .../user/_i18n/LocalStrings_ru.properties     |  5 +--
 .../user/_i18n/LocalStrings_sq.properties     |  5 +--
 .../user/_i18n/LocalStrings_zh_CN.properties  |  5 +--
 .../user/_i18n/LocalStrings_zh_TW.properties  |  5 +--
 .../gui/control/_spring/sitedefContext.xml    | 12 +++----
 .../control/generic/portal/PortalSiteDef.java |  8 +++--
 .../navigation/AbstractSiteDefinition.java    |  5 +--
 .../callback/AdminSecurityCallback.java       |  1 -
 .../callback/DefaultSecurityCallbackImpl.java |  3 --
 .../callback/DisabledSecurityCallback.java    |  3 --
 .../callback/ManagersSecurityCallback.java    |  2 +-
 ...istredUserGuestTeaserSecurityCallback.java | 18 +++-------
 .../RegistredUserOrGuestSecurityCallback.java | 13 +++----
 .../RegistredUserSecurityCallback.java        | 14 +++-----
 ...eSecurityCallbackWithRolesRestriction.java | 18 +++++-----
 .../model/SearchAssessedIdentityParams.java   |  1 +
 .../nodes/cl/manager/CheckboxManagerImpl.java |  3 +-
 .../course/nodes/cl/model/AssessmentData.java |  4 ---
 .../cl/ui/CheckListAssessmentController.java  | 25 ++++++++-----
 .../userview/UserCourseEnvironmentImpl.java   |  5 +--
 .../org/olat/course/site/CourseSiteDef.java   |  4 ++-
 .../java/org/olat/group/site/GroupsSite.java  |  6 ++--
 .../org/olat/group/site/GroupsSiteDef.java    |  8 +++--
 .../olat/gui/demo/site/GUIDemoSiteDef.java    |  5 ---
 .../olat/modules/coach/site/CoachSite.java    |  3 +-
 .../olat/modules/coach/site/CoachSiteDef.java | 19 ++++++----
 .../site/CurriculumAdminSiteDef.java          |  6 +++-
 .../CurriculumManagerSecurityCallback.java    | 12 ++-----
 .../docpool/site/DocumentPoolSiteDef.java     | 10 +++---
 .../DocumentPoolSiteSecurityCallback.java     |  4 +--
 .../portfolio/sites/PortfolioSiteDef.java     |  8 ++---
 ...AndPoolPrivateMembersSecurityCallback.java |  4 +--
 .../PoolPrivateMembersSecurityCallback.java   |  5 ++-
 .../site/PoolTaxonomySecurityCallback.java    |  4 +--
 .../qpool/site/QuestionPoolSiteDef.java       | 11 +++---
 .../org/olat/portfolio/site/EPSiteDef.java    |  8 ++---
 .../repository/site/CatalogAdminSiteDef.java  |  3 --
 .../site/CatalogManagerSecurityCallback.java  |  6 +---
 .../repository/site/MyCoursesSiteDef.java     |  6 +++-
 .../repository/site/RepositorySiteDef.java    | 12 +++----
 .../ui/admin/UserAdminMainController.java     | 21 ++++++++++-
 .../ui/admin/_i18n/LocalStrings_de.properties | 14 ++++++++
 .../ui/admin/_i18n/LocalStrings_en.properties | 14 ++++++++
 64 files changed, 281 insertions(+), 243 deletions(-)

diff --git a/src/main/java/org/olat/admin/site/UserAdminSiteDef.java b/src/main/java/org/olat/admin/site/UserAdminSiteDef.java
index f1b5fa5cf4c..f0e7c1c0200 100644
--- a/src/main/java/org/olat/admin/site/UserAdminSiteDef.java
+++ b/src/main/java/org/olat/admin/site/UserAdminSiteDef.java
@@ -47,18 +47,17 @@ public class UserAdminSiteDef extends AbstractSiteDefinition implements SiteDefi
 
 	@Override
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
-		if(ureq == null) return null;
-		
 		UserSession usess = ureq.getUserSession();
-		if(usess.getRoles() == null) {
+		if(usess == null || usess.getRoles() == null || usess.getRoles().isInvitee() || usess.getRoles().isGuestOnly()) {
 			return null;
 		}
+		
 		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
 			return new UserAdminSite(this, ureq.getLocale());
 		} 
 		
 		Roles roles = usess.getRoles();
-		if (roles.isAdministrator() || roles.isUserManager() || roles.isRolesManager()) {
+		if (roles.isAdministrator() || roles.isPrincipal() || roles.isUserManager() || roles.isRolesManager()) {
 			// only open for olat-usermanagers
 			return new UserAdminSite(this, ureq.getLocale());
 		} 
diff --git a/src/main/java/org/olat/admin/site/ui/SitesConfigurationController.java b/src/main/java/org/olat/admin/site/ui/SitesConfigurationController.java
index 4674ca9959f..f7f8c469e39 100644
--- a/src/main/java/org/olat/admin/site/ui/SitesConfigurationController.java
+++ b/src/main/java/org/olat/admin/site/ui/SitesConfigurationController.java
@@ -50,6 +50,7 @@ import org.olat.core.gui.control.navigation.SiteDefinitions;
 import org.olat.core.gui.control.navigation.SiteSecurityCallback;
 import org.olat.core.gui.control.navigation.SiteViewSecurityCallback;
 import org.olat.core.util.StringHelper;
+import org.springframework.beans.factory.annotation.Autowired;
 
 /**
  * Configuration of the list of sites: order, security callback, alternative controllers...
@@ -61,7 +62,8 @@ import org.olat.core.util.StringHelper;
  */
 public class SitesConfigurationController extends FormBasicController {
 	
-	private final SiteDefinitions sitesModule;
+	@Autowired
+	private SiteDefinitions sitesModule;
 	private final Map<String,SiteDefinition> siteDefs;
 	
 	private final String[] secKeys;
@@ -72,7 +74,6 @@ public class SitesConfigurationController extends FormBasicController {
 	
 	private SiteDefModel model;
 	private FlexiTableElement tableEl;
-	private FormItemContainer formLayout;
 	
 	private boolean needAlternative = false;
 	private final Map<String,SiteSecurityCallback> securityCallbacks;
@@ -80,9 +81,7 @@ public class SitesConfigurationController extends FormBasicController {
 	public SitesConfigurationController(UserRequest ureq, WindowControl wControl) {
 		super(ureq, wControl, "sites_order");
 		
-		sitesModule = CoreSpringFactory.getImpl(SiteDefinitions.class);
 		siteDefs = sitesModule.getAllSiteDefinitionsList();
-
 		securityCallbacks = CoreSpringFactory.getBeansOfType(SiteSecurityCallback.class);
 		//security callbacks
 		secKeys = new String[securityCallbacks.size()];
@@ -124,8 +123,6 @@ public class SitesConfigurationController extends FormBasicController {
 
 	@Override
 	protected void initForm(FormItemContainer formLayout, Controller listener, UserRequest ureq) {
-		this.formLayout = formLayout;
-		
 		FlexiTableColumnModel columnsModel = FlexiTableDataModelFactory.createFlexiTableColumnModel();
 		columnsModel.addFlexiColumnModel(new DefaultFlexiColumnModel(SiteCols.enabled.i18nKey(), SiteCols.enabled.ordinal()));
 		columnsModel.addFlexiColumnModel(new DefaultFlexiColumnModel(SiteCols.title.i18nKey(), SiteCols.title.ordinal()));
@@ -197,13 +194,13 @@ public class SitesConfigurationController extends FormBasicController {
 	}
 	
 	protected void reload() {
-		List<SiteDefRow> configs = new ArrayList<SiteDefRow>();
+		List<SiteDefRow> configs = new ArrayList<>();
 		for(Map.Entry<String, SiteDefinition> entryDef:siteDefs.entrySet()) {
 			String id = entryDef.getKey();
 			SiteDefinition siteDef = entryDef.getValue();
 			String title = translate(siteDef.getClass().getSimpleName());
 			SiteConfiguration config = sitesModule.getConfigurationSite(id);
-			SiteDefRow row = new SiteDefRow(siteDef, config, title, formLayout);
+			SiteDefRow row = new SiteDefRow(siteDef, config, title, flc);
 			configs.add(row);
 		}
 		Collections.sort(configs, new RowOrderComparator());
@@ -232,7 +229,7 @@ public class SitesConfigurationController extends FormBasicController {
 	
 	private void doUpdateOrders() {
 		int count = 0;
-		List<SiteConfiguration> configs = new ArrayList<SiteConfiguration>();
+		List<SiteConfiguration> configs = new ArrayList<>();
 		for(SiteDefRow row:model.getObjects()) {
 			SiteConfiguration config = row.getRawConfiguration(false);
 			config.setOrder(count++);
@@ -243,7 +240,7 @@ public class SitesConfigurationController extends FormBasicController {
 	
 	private void doSaveSettings() {
 		int count = 0;
-		List<SiteConfiguration> configs = new ArrayList<SiteConfiguration>();
+		List<SiteConfiguration> configs = new ArrayList<>();
 		for(SiteDefRow row:model.getObjects()) {
 			SiteConfiguration config = row.getRawConfiguration(true);
 			config.setOrder(count++);
@@ -416,10 +413,7 @@ public class SitesConfigurationController extends FormBasicController {
 					return def.getSecurityCallbackEl();
 				}
 				case altController: return def.getAlternativeControllerEl();
-				case type: {
-					String type = def.getSiteDef().getClass().getSimpleName();
-					return type;
-				}
+				case type: return def.getSiteDef().getClass().getSimpleName();
 				case defaultOrder: return def.getOrder();
 				default: return "";
 			}
diff --git a/src/main/java/org/olat/admin/user/SystemRolesAndRightsController.java b/src/main/java/org/olat/admin/user/SystemRolesAndRightsController.java
index 03728091070..398a5e76249 100644
--- a/src/main/java/org/olat/admin/user/SystemRolesAndRightsController.java
+++ b/src/main/java/org/olat/admin/user/SystemRolesAndRightsController.java
@@ -169,7 +169,7 @@ public class SystemRolesAndRightsController extends FormBasicController {
 		formLayout.add(anonymousCont);
 		
 		anonymousEl = uifactory.addRadiosVertical(
-				"anonymous", "role.guest", anonymousCont, 
+				"anonymous", "rightsForm.guest", anonymousCont, 
 				new String[]{"true", "false"},
 				new String[]{translate("role.guest.true"), translate("role.guest.false")}
 		);
diff --git a/src/main/java/org/olat/admin/user/UsermanagerUserSearchForm.java b/src/main/java/org/olat/admin/user/UsermanagerUserSearchForm.java
index eb7ff864dab..3df5760d64b 100644
--- a/src/main/java/org/olat/admin/user/UsermanagerUserSearchForm.java
+++ b/src/main/java/org/olat/admin/user/UsermanagerUserSearchForm.java
@@ -89,8 +89,8 @@ public class UsermanagerUserSearchForm extends FormBasicController {
 	
 	private String[] statusKeys;
 	private String[] statusValues;
-	private String[] roleKeys;
-	private String[] roleValues;
+	private List<String> roleKeys;
+	private List<String> roleValues;
 	private String[] organisationKeys;
 	private String[] organisationValues;
 	private String[] authKeys;
@@ -121,25 +121,11 @@ public class UsermanagerUserSearchForm extends FormBasicController {
 		userPropertyHandlers = userManager.getUserPropertyHandlersFor(formIdentifyer, true);
 		this.manageableOrganisations = new ArrayList<>(manageableOrganisations);
 		
-		roleKeys = new String[] {
-				OrganisationRoles.administrator.name(),
-				OrganisationRoles.author.name(),
-				OrganisationRoles.groupmanager.name(),
-				OrganisationRoles.usermanager.name(),
-				OrganisationRoles.learnresourcemanager.name(),
-				OrganisationRoles.poolmanager.name(),
-				OrganisationRoles.curriculummanager.name()
-		};
-		
-		roleValues = new String[]{
-				translate("search.form.constraint.admin"),
-				translate("search.form.constraint.author"),
-				translate("search.form.constraint.groupmanager"),
-				translate("search.form.constraint.usermanager"),
-				translate("search.form.constraint.oresmanager"),
-				translate("search.form.constraint.poolmanager"),
-				translate("search.form.constraint.curriculummanager")
-		};
+		roleKeys = OrganisationRoles.toList(OrganisationRoles.values());
+		roleValues = new ArrayList<>(roleKeys.size());
+		for(int i=0; i<roleKeys.size(); i++) {
+			roleValues.add(translate("search.form.constraint.".concat(roleKeys.get(i))));
+		}
 
 		statusKeys = new String[] { 
 				Integer.toString(Identity.STATUS_VISIBLE_LIMIT),
@@ -402,11 +388,11 @@ public class UsermanagerUserSearchForm extends FormBasicController {
 
 		uifactory.addSpacerElement("space1", formLayout, false);
 		
-		organisations = uifactory.addCheckboxesVertical(
-				"organisations", "search.form.title.organisations", formLayout, organisationKeys, organisationValues, 1);
+		organisations = uifactory.addCheckboxesDropdown("organisations", "search.form.title.organisations",
+				formLayout, organisationKeys, organisationValues);
 		
-		roles = uifactory.addCheckboxesVertical(
-				"roles", "search.form.title.roles", formLayout, roleKeys, roleValues, 1);
+		roles = uifactory.addCheckboxesDropdown("roles", "search.form.title.roles", formLayout,
+				roleKeys.toArray(new String[roleKeys.size()]), roleValues.toArray(new String[roleValues.size()]));
 
 		uifactory.addSpacerElement("space2", formLayout, false);
 		auth = uifactory.addCheckboxesVertical(
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_ar.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_ar.properties
index 84cf08db162..82e376d84b9 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_ar.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_ar.properties
@@ -64,7 +64,7 @@ notification.noNews=\u0644\u0645 \u064A\u0642\u0645 \u0623\u0649 \u0645\u0633\u0
 notification.noSubscription=\u0644\u0645 \u062A\u0642\u0645 \u0628\u0627\u0644\u0627\u0634\u062A\u0631\u0627\u0643 \u0644\u062A\u062D\u0635\u0644 \u0639\u0644\u0649 \u0623\u062E\u0628\u0627\u0631 \u0639\u0646 \u0627\u0644\u0645\u0633\u062A\u062E\u062F\u0645\u064A\u0646 \u0627\u0644\u062C\u062F\u062F.
 rightForm.error.anonymous.no.roles=\u0627\u0644\u0632\u0627\u0626\u0631\u0648\u0646 \u0627\u0644\u0645\u062C\u0647\u0648\u0644\u0648\u0646 \u0644\u0627 \u064A\u0645\u0643\u0646\u0647\u0645 \u0627\u0633\u062A\u062E\u062F\u0627\u0645 \u0642\u0648\u0627\u0639\u062F \u0627\u0644\u0646\u0638\u0627\u0645
 role.administrator=\u0645\u062F\u064A\u0631 \u0627\u0644\u0646\u0638\u0627\u0645
-role.guest=\u0646\u0648\u0639 \u0627\u0644\u0645\u0633\u062A\u062E\u062F\u0645
+role.guest=\u0632\u0627\u0626\u0631 \u0645\u062C\u0647\u0648\u0644
 role.guest.false=\u0645\u0633\u062A\u062E\u062F\u0645 \u0627\u0644\u0646\u0638\u0627\u0645
 role.guest.true=\u0632\u0627\u0626\u0631 \u0645\u062C\u0647\u0648\u0644
 role.author=\u0627\u0644\u0645\u0624\u0644\u0641
@@ -72,6 +72,7 @@ role.groupmanager=\u0625\u062F\u0627\u0631\u0629 \u0627\u0644\u0645\u062C\u0645\
 role.learnesourcemanager=\u0645\u062F\u064A\u0631 \u0627\u0644\u0645\u0635\u062F\u0631 \u0627\u0644\u062A\u0639\u0644\u064A\u0645\u0649
 rightsForm.isLoginDenied=\u0627\u0644\u062F\u062E\u0648\u0644 \u062A\u0645 \u0645\u0646\u0639\u0647
 role.usermanager=\u0625\u062F\u0627\u0631\u0629 \u0627\u0644\u0645\u0633\u062A\u062E\u062F\u0645
+rightsForm.guest=\u0646\u0648\u0639 \u0627\u0644\u0645\u0633\u062A\u062E\u062F\u0645
 rightsForm.roles=\u0627\u0644\u0642\u0648\u0627\u0639\u062F
 rightsForm.status=\u0627\u0644\u062D\u0627\u0644\u0629
 rightsForm.status.activ=\u0646\u0634\u0637
@@ -83,7 +84,7 @@ rightsForm.title=\u062A\u062D\u062F\u064A\u062F \u0642\u0648\u0627\u0639\u062F \
 search.cancel=\u062A\u0645 \u0625\u0644\u063A\u0627\u0621 \u0627\u0644\u0646\u0634\u0627\u0637.
 search.form.afterDate=\u062A\u0645 \u0625\u0646\u0634\u0627\u0621 \u0627\u0644\u0645\u0633\u062A\u062E\u062F\u0645 \u0628\u0639\u062F
 search.form.beforeDate=\u062A\u0645 \u0625\u0646\u0634\u0627\u0621 \u0627\u0644\u0645\u0633\u062A\u062E\u062F\u0645 \u0642\u0628\u0644
-search.form.constraint.admin=\u0645\u062F\u064A\u0631
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=LDAP \u0643\u0644\u0645\u0629 \u0645\u0631\u0648\u0631
 search.form.constraint.auth.OLAT=OLAT/WebDAV \u0643\u0644\u0645\u0629 \u0645\u0631\u0648\u0631
 search.form.constraint.auth.Shib=Shibboleth \u0643\u0644\u0645\u0629 \u0645\u0631\u0648\u0631
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_bg.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_bg.properties
index 62e45d3e532..611e540bdde 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_bg.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_bg.properties
@@ -58,7 +58,7 @@ new.user.cancel=\u041E\u043F\u0435\u0440\u0430\u0446\u0438\u044F\u0442\u0430 \u0
 new.user.successful=\u041D\u043E\u0432\u0438\u044F\u0442 \u043F\u043E\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043B\u0441\u043A\u0438 \u0430\u043A\u0430\u0443\u043D\u0442 \u0435 \u0441\u044A\u0437\u0434\u0430\u0434\u0435\u043D \u0443\u0441\u043F\u0435\u0448\u043D\u043E.
 rightForm.error.anonymous.no.roles=\u0410\u043D\u043E\u043D\u0438\u043C\u043D\u0438\u0442\u0435 \u0433\u043E\u0441\u0442\u0438 \u043D\u0435 \u043C\u043E\u0433\u0430\u0442 \u0434\u0430 \u0443\u043F\u0440\u0430\u0436\u043D\u044F\u0432\u0430\u0442 \u0441\u0438\u0441\u0442\u0435\u043C\u043D\u0438 \u0440\u043E\u043B\u0438
 role.administrator=\u0421\u0438\u0441\u0442\u0435\u043C\u0435\u043D \u0430\u0434\u043C\u0438\u043D\u0438\u0441\u0442\u0440\u0430\u0442\u043E\u0440
-role.guest=\u0412\u0438\u0434 \u043F\u043E\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043B
+role.guest=\u0410\u043D\u043E\u043D\u0438\u043C\u0435\u043D \u0433\u043E\u0441\u0442
 role.guest.false=\u0421\u0438\u0441\u0442\u0435\u043C\u0435\u043D \u043F\u043E\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043B
 role.guest.true=\u0410\u043D\u043E\u043D\u0438\u043C\u0435\u043D \u0433\u043E\u0441\u0442
 role.author=\u0410\u0432\u0442\u043E\u0440
@@ -66,6 +66,7 @@ role.groupmanager=\u041C\u0435\u043D\u0438\u0434\u0436\u043C\u044A\u043D\u0442 \
 role.learnesourcemanager=\u041C\u0435\u043D\u0438\u0434\u0436\u044A\u0440 \u043D\u0430 \u0443\u0447\u0435\u0431\u0435\u043D \u043C\u0430\u0442\u0435\u0440\u0438\u0430\u043B
 rightsForm.isLoginDenied=\u0412\u043B\u0438\u0437\u0430\u043D\u0435\u0442\u043E \u0432 \u0441\u0438\u0441\u0442\u0435\u043C\u0430\u0442\u0430 \u0435 \u0431\u043B\u043E\u043A\u0438\u0440\u0430\u043D\u043E
 role.usermanager=\u041C\u0435\u043D\u0438\u0434\u0436\u043C\u044A\u043D\u0442 \u043D\u0430 \u043F\u043E\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043B\u0438
+rightsForm.guest=\u0412\u0438\u0434 \u043F\u043E\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043B
 rightsForm.status=\u0421\u0442\u0430\u0442\u0443\u0442
 rightsForm.status.activ=\u0410\u043A\u0442\u0438\u0432\u0435\u043D
 rightsForm.status.any.visible=-
@@ -76,7 +77,7 @@ rightsForm.title=\u041E\u043F\u0440\u0435\u0434\u0435\u043B\u0435\u0442\u0435 \u
 search.cancel=\u041E\u043F\u0435\u0440\u0430\u0446\u0438\u044F\u0442\u0430 \u0435 \u043E\u0442\u043C\u0435\u043D\u0435\u043D\u0430.
 search.form.afterDate=\u041F\u043E\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043B \u0441\u044A\u0437\u0434\u0430\u0434\u0435\u043D \u0441\u043B\u0435\u0434
 search.form.beforeDate=\u041F\u043E\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043B \u0441\u044A\u0437\u0434\u0430\u0434\u0435\u043D \u043F\u0440\u0435\u0434\u0438
-search.form.constraint.admin=\u0410\u0434\u043C\u0438\u043D\u0438\u0441\u0442\u0440\u0430\u0442\u043E\u0440
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=LDAP \u043F\u0430\u0440\u043E\u043B\u0430
 search.form.constraint.auth.OLAT=\u041F\u0430\u0440\u043E\u043B\u0430 \u0437\u0430 \u0441\u0438\u0441\u0442\u0435\u043C\u0430\u0442\u0430/WebDAV
 search.form.constraint.auth.Shib=\u041E\u0442\u043B\u0438\u0447\u0438\u0442\u0435\u043B\u043D\u0430 \u043F\u0430\u0440\u043E\u043B\u0430
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_cs.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_cs.properties
index dbba6546187..4c79abb4f3c 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_cs.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_cs.properties
@@ -55,7 +55,7 @@ new.user.cancel=Akce byla zru\u0161ena. Nov\u00FD \u00FA\u010Det nebyl vytvo\u01
 new.user.successful=Nov\u00FD u\u017Eivatelsk\u00FD \u00FA\u010Det byl \u00FAsp\u011B\u0161n\u011B vytvo\u0159en.
 rightForm.error.anonymous.no.roles=Anonymn\u00ED u\u017Eivatel\u00E9 nemou zkou\u0161et syst\u00E9mov\u00E9 role
 role.administrator=Administr\u00E1tor
-role.guest=Typ \u00FA\u010Dtu
+role.guest=Anonymn\u00ED u\u017Eivatel
 role.guest.false=U\u017Eivatel syst\u00E9mu
 role.guest.true=Anonymn\u00ED u\u017Eivatel
 role.author=Autor
@@ -63,6 +63,7 @@ role.groupmanager=Spr\u00E1va skupin
 rightsForm.isLoginDenied=P\u0159ihl\u00E1\u0161en\u00ED blokov\u00E1no
 role.usermanager=Spr\u00E1va u\u017Eivatel\u016F
 role.sysadmin=Administr\u00E1tor syst\u00E9mu
+rightsForm.guest=Typ \u00FA\u010Dtu
 rightsForm.status=Stav
 rightsForm.status.activ=Aktivn\u00ED
 rightsForm.status.any.visible=-
@@ -73,7 +74,7 @@ rightsForm.title=P\u0159i\u0159adit syst\u00E9mov\u00E9 role a pr\u00E1va
 search.cancel=Akce zru\u0161ena
 search.form.afterDate=U\u017Eivatel vytvo\u0159en po
 search.form.beforeDate=U\u017Eivatel vytvo\u0159en p\u0159ed
-search.form.constraint.admin=Administr\u00E1tor
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.OLAT=OLAT/WebDAV heslo
 search.form.constraint.auth.Shib=Shibboleth heslo
 search.form.constraint.auth.none=Bez ov\u011B\u0159ov\u00E1n\u00ED
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_da.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_da.properties
index 3b059cb9fa1..38a43c836b0 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_da.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_da.properties
@@ -47,7 +47,7 @@ new.user.cancel=Handlingen er afbrudt. Ingen ny konto er oprettet.
 new.user.successful=Den nye brugerkonto er oprettet succesfult.
 rightForm.error.anonymous.no.roles=Anonyme g\u00E6ster kan ikke udfylde systemroller
 role.administrator=Administrator
-role.guest=Brugertype
+role.guest=Anonym g\u00E6st
 role.guest.false=Systembruger
 role.guest.true=Anonym g\u00E6st
 role.author=Forfatter
@@ -55,6 +55,7 @@ role.groupmanager=Gruppestyring
 rightsForm.isLoginDenied=Login blokeret
 role.usermanager=Brugerstyring
 role.sysadmin=Systemadministrator
+rightsForm.guest=Brugertype
 rightsForm.status=Status
 rightsForm.status.activ=Aktiv
 rightsForm.status.any.visible=-
@@ -65,7 +66,7 @@ rightsForm.title=Tildel systemroller og rettigheder
 search.cancel=Handling afbrudt
 search.form.afterDate=Bruger oprettet efter
 search.form.beforeDate=Bruger oprettet f\u00F8r
-search.form.constraint.admin=Administrator
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.OLAT=OLAT/WebDAV kodeord 
 search.form.constraint.auth.Shib=Shibboleth kodeord 
 search.form.constraint.auth.none=Ingen autentifikation
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_de.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_de.properties
index d7175e38b4a..12e1c1b5648 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_de.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_de.properties
@@ -88,7 +88,7 @@ repocoach=Kursbetreuer
 rightForm.error.anonymous.no.roles=Anonyme G\u00E4ste k\u00F6nnen keine Systemrollen wahrnehmen
 rightsForm.add.to.organisation=Zur Organisation hinzuf\u00FCgen
 role.administrator=Administrator
-role.guest=Benutzertyp
+role.guest=Anonymer Gast
 role.guest.false=Registrierter Benutzer
 role.guest.true=Anonymer Gast
 role.author=Autor
@@ -106,6 +106,7 @@ role.rolesmanager=Rollenverwalter
 role.user=Benutzer
 role.usermanager=Benutzerverwalter
 role.sysadmin=Systemadministrator
+rightsForm.guest=Benutzertyp
 rightsForm.roles=Rollen
 rightsForm.roles.for=Rollen f\u00FCr "{0}"
 rightsForm.sendLoginDeniedEmail=Benutzer \u00FCber Loginsperre informieren
@@ -119,7 +120,7 @@ rightsForm.title=Systemrollen und Rechte zuteilen
 search.cancel=Die Aktion wurde abgebrochen.
 search.form.afterDate=Benutzer erstellt nach
 search.form.beforeDate=Benutzer erstellt vor
-search.form.constraint.admin=Systemadministrator
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=LDAP-Passwort
 search.form.constraint.auth.OAuth=Soziale Netzwerk Authentifizierung / Single-Sign-On (OAuth)
 search.form.constraint.auth.OLAT=OLAT/WebDAV-Passwort
@@ -127,13 +128,25 @@ search.form.constraint.auth.Shib=Shibboleth-Passwort
 search.form.constraint.auth.ShibGeneric=$\:search.form.constraint.auth.Shib
 search.form.constraint.auth.WEBDAV=WebDAV-Passwort
 search.form.constraint.auth.none=Ohne Authentifizierung
-search.form.constraint.author=Autor
-search.form.constraint.curriculummanager=Curriculumverwalter
-search.form.constraint.groupmanager=Gruppenverwalter
+
+search.form.constraint.author=$\:role.author
+search.form.constraint.curriculummanager=$\:role.curriculummanager
+search.form.constraint.guest=$\:role.guest
+search.form.constraint.groupmanager=$\:role.groupmanager
+search.form.constraint.invitee=$\:role.invitee
 search.form.constraint.logindenied=Account gesperrt
-search.form.constraint.oresmanager=Lernressourcenverwalter
-search.form.constraint.poolmanager=Fragenpoolverwalter
-search.form.constraint.usermanager=Benutzerverwalter
+search.form.constraint.learnresourcemanager=$\:role.learnresourcemanager
+search.form.constraint.lecturemanager=$\:role.lecturemanager
+search.form.constraint.linemanager=$\:role.linemanager
+search.form.constraint.poolmanager=$\:role.poolmanager
+search.form.constraint.principal=$\:role.principal
+search.form.constraint.qualitymanager=$\:role.qualitymanager
+search.form.constraint.rolesmanager=$\:role.rolesmanager
+search.form.constraint.sysadmin=$\:role.sysadmin
+search.form.constraint.user=$\:role.user
+search.form.constraint.usermanager=$\:role.usermanager
+
+
 search.form.login=Benutzername
 search.form.title.authentications=Einschr\u00E4nkung auf Authentifizierung
 search.form.title.date=Einschr\u00E4nkung auf Erstellungsdatum
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_el.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_el.properties
index c95a7cc7e1d..08758802401 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_el.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_el.properties
@@ -63,7 +63,7 @@ new.user.successful=\u039F \u03BD\u03AD\u03BF\u03C2 \u03BB\u03BF\u03B3\u03B1\u03
 notification.noNews=\u039A\u03B1\u03BD\u03AD\u03BD\u03B1\u03C2 \u03BD\u03AD\u03BF\u03C2 \u03C7\u03C1\u03AE\u03C3\u03C4\u03B7\u03C2 \u03B4\u03B5\u03BD \u03AD\u03C7\u03B5\u03B9 \u03C3\u03C5\u03BD\u03B4\u03B5\u03B8\u03B5\u03AF \u03B1\u03C0\u03CC \u03B5\u03BA\u03B5\u03AF\u03BD\u03B7 \u03C4\u03B7\u03BD \u03B7\u03BC/\u03BD\u03AF\u03B1.
 notification.noSubscription=\u0394\u03B5\u03BD \u03AD\u03C7\u03B5\u03C4\u03B5 \u03B5\u03B3\u03B3\u03C1\u03B1\u03C6\u03B5\u03AF \u03B3\u03B9\u03B1 \u03BD\u03B1 \u03BB\u03B1\u03BC\u03B2\u03AC\u03BD\u03B5\u03C4\u03B5 \u03BD\u03AD\u03B1 \u03B3\u03B9\u03B1 \u03C4\u03BF\u03C5\u03C2 \u03BD\u03AD\u03BF\u03C5\u03C2 \u03C7\u03C1\u03AE\u03C3\u03C4\u03B5\u03C2.
 rightForm.error.anonymous.no.roles=\u039F\u03B9 \u03B1\u03BD\u03CE\u03BD\u03C5\u03BC\u03BF\u03B9 \u03B5\u03C0\u03B9\u03C3\u03BA\u03AD\u03C0\u03C4\u03B5\u03C2 \u03B4\u03B5\u03BD \u03BC\u03C0\u03BF\u03C1\u03BF\u03CD\u03BD \u03BD\u03B1 \u03B1\u03C3\u03BA\u03BF\u03CD\u03BD \u03C1\u03CC\u03BB\u03BF\u03C5\u03C2 \u03C3\u03C5\u03C3\u03C4\u03AE\u03BC\u03B1\u03C4\u03BF\u03C2
-role.guest=\u03A4\u03CD\u03C0\u03BF\u03C2 \u03BB\u03BF\u03B3\u03B1\u03C1\u03B9\u03B1\u03C3\u03BC\u03BF\u03CD
+role.guest=\u0391\u03BD\u03CE\u03BD\u03C5\u03BC\u03BF\u03C2 \u03B5\u03C0\u03B9\u03C3\u03BA\u03AD\u03C0\u03C4\u03B7\u03C2
 role.guest.false=\u03A7\u03C1\u03AE\u03C3\u03C4\u03B7\u03C2 \u03C3\u03C5\u03C3\u03C4\u03AE\u03BC\u03B1\u03C4\u03BF\u03C2
 role.guest.true=\u0391\u03BD\u03CE\u03BD\u03C5\u03BC\u03BF\u03C2 \u03B5\u03C0\u03B9\u03C3\u03BA\u03AD\u03C0\u03C4\u03B7\u03C2
 role.author=\u03A3\u03C5\u03B3\u03B3\u03C1\u03B1\u03C6\u03AD\u03B1\u03C2
@@ -71,6 +71,7 @@ role.groupmanager=\u0394\u03B9\u03B1\u03C7\u03B5\u03AF\u03C1\u03B9\u03C3\u03B7 \
 role.learnresourcemanager=\u0394\u03B9\u03B1\u03C7\u03B5\u03B9\u03C1\u03B9\u03C3\u03C4\u03AE\u03C2 \u03C0\u03CC\u03C1\u03BF\u03C5 \u03BC\u03AC\u03B8\u03B7\u03C3\u03B7\u03C2
 rightsForm.isLoginDenied=\u03A6\u03C1\u03B1\u03B3\u03AE \u03B5\u03B9\u03C3\u03CC\u03B4\u03BF\u03C5
 role.usermanager=\u0394\u03B9\u03B1\u03C7\u03B5\u03AF\u03C1\u03B9\u03C3\u03B7 \u03C7\u03C1\u03B7\u03C3\u03C4\u03CE\u03BD
+rightsForm.guest=\u03A4\u03CD\u03C0\u03BF\u03C2 \u03BB\u03BF\u03B3\u03B1\u03C1\u03B9\u03B1\u03C3\u03BC\u03BF\u03CD
 rightsForm.roles=\u03A1\u03CC\u03BB\u03BF\u03B9
 rightsForm.status=\u039A\u03B1\u03C4\u03AC\u03C3\u03C4\u03B1\u03C3\u03B7
 rightsForm.status.activ=\u0395\u03BD\u03B5\u03C1\u03B3\u03CC 
@@ -82,7 +83,7 @@ rightsForm.title=\u0391\u03BD\u03AC\u03B8\u03B5\u03C3\u03B7 \u03C1\u03CC\u03BB\u
 search.cancel=\u0397 \u03B5\u03BD\u03AD\u03C1\u03B3\u03B5\u03B9\u03B1 \u03B1\u03BA\u03C5\u03C1\u03CE\u03B8\u03B7\u03BA\u03B5.
 search.form.afterDate=\u0394\u03B7\u03BC\u03B9\u03BF\u03C5\u03C1\u03B3\u03AF\u03B1 \u03C7\u03C1\u03AE\u03C3\u03C4\u03B7 \u03BC\u03B5\u03C4\u03AC \u03C4\u03B7\u03BD
 search.form.beforeDate=\u0394\u03B7\u03BC\u03B9\u03BF\u03C5\u03C1\u03B3\u03AF\u03B1 \u03C7\u03C1\u03AE\u03C3\u03C4\u03B7 \u03C0\u03C1\u03B9\u03BD \u03C4\u03B7\u03BD
-search.form.constraint.admin=\u0394\u03B9\u03B1\u03C7\u03B5\u03B9\u03C1\u03B9\u03C3\u03C4\u03AE\u03C2
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=\u039A\u03C9\u03B4\u03B9\u03BA\u03CC\u03C2 LDAP
 search.form.constraint.auth.OLAT=\u039A\u03C9\u03B4\u03B9\u03BA\u03CC\u03C2 \u03C0\u03C1\u03CC\u03C3\u03B2\u03B1\u03C3\u03B7\u03C2 OLAT/WebDAV
 search.form.constraint.auth.Shib=\u03A3\u03C5\u03BD\u03B8\u03B7\u03BC\u03B1\u03C4\u03B9\u03BA\u03CC
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_en.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_en.properties
index 7c05c4832b3..2b311866ed9 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_en.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_en.properties
@@ -88,7 +88,7 @@ repocoach=Course coach
 rightForm.error.anonymous.no.roles=Anonymous guests cannot exercise system roles
 rightsForm.add.to.organisation=Add to organisation
 role.administrator=Administrator
-role.guest=User type
+role.guest=Anonymous guest
 role.guest.false=System user
 role.guest.true=Anonymous guest
 role.author=Author
@@ -106,6 +106,7 @@ role.rolesmanager=Roles manager
 role.user=User
 role.usermanager=User management
 role.sysadmin=System administrator
+rightsForm.guest=User type
 rightsForm.roles=Roles
 rightsForm.roles.for=Roles for "{0}"
 rightsForm.sendLoginDeniedEmail=Notify user about login denied change
@@ -119,7 +120,7 @@ rightsForm.title=Assign system roles and rights
 search.cancel=Action cancelled.
 search.form.afterDate=User created after
 search.form.beforeDate=User created before
-search.form.constraint.admin=Administrator
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=LDAP password
 search.form.constraint.auth.OAuth=Social network authentication / Single-Sign-On (OAuth)
 search.form.constraint.auth.OLAT=OLAT/WebDAV password
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_es.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_es.properties
index 662cc5de2d3..492ad7fa2a8 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_es.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_es.properties
@@ -55,8 +55,8 @@ new.form.username=Nombre de usuario
 new.user.cancel=Acci\u00F3n cancelada. No se cre\u00F3 la nueva cuenta de usuario.
 new.user.successful=La nueva cuenta de usuario se cre\u00F3 correctamente.
 rightForm.error.anonymous.no.roles=Los invitados an\u00F3nimos no pueden tener roles de sistema
+role.guest=Invitado an\u00F3nimo
 role.administrator=Administrador
-role.guest=Tipo de usuario
 role.guest.false=Usuario de sistema
 role.guest.true=Invitado an\u00F3nimo
 role.author=Autor
@@ -64,6 +64,7 @@ role.groupmanager=Administraci\u00F3n de grupos
 rightsForm.isLoginDenied=Acceso denegado
 role.usermanager=Administraci\u00F3n de usuarios
 role.sysadmin=Administrador del sistema
+rightsForm.guest=Tipo de usuario
 rightsForm.status=Estado
 rightsForm.status.activ=Activo
 rightsForm.status.any.visible=-
@@ -74,7 +75,7 @@ rightsForm.title=Administrar roles y permisos del sistema
 search.cancel=Acci\u00F3n cancelada.
 search.form.afterDate=Usuario creado despu\u00E9s de
 search.form.beforeDate=Usuario creado antes de
-search.form.constraint.admin=Administrador
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.OLAT=Contrase\u00F1a OLAT/WebDAV 
 search.form.constraint.auth.Shib=Contrase\u00F1a Shibboleth
 search.form.constraint.auth.none=Sin autenticaci\u00F3n
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_fa.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_fa.properties
index 8986016150b..970405f3153 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_fa.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_fa.properties
@@ -43,18 +43,19 @@ new.form.username=\u0646\u0627\u0645 \u06A9\u0627\u0631\u0628\u0631
 new.user.cancel=\u0639\u0645\u0644\u06CC\u0627\u062A \u0644\u063A\u0648 \u06AF\u0631\u062F\u06CC\u062F / \u0647\u06CC\u0686 \u06A9\u0627\u0631\u0628\u0631\u06CC \u0627\u06CC\u062C\u0627\u062F \u0646\u06AF\u0631\u062F\u06CC\u062F
 new.user.successful=\u062D\u0633\u0627\u0628 \u06A9\u0627\u0631\u0628\u0631 \u062C\u062F\u06CC\u062F \u0628\u0627 \u0645\u0648\u0641\u0642\u06CC\u062A \u0627\u06CC\u062C\u0627\u062F \u06AF\u0631\u062F\u06CC\u062F 
 rightForm.error.anonymous.no.roles=\u0645\u06CC\u0647\u0645\u0627\u0646 \u0646\u0627\u0634\u0646\u0627\u0633 \u0647\u06CC\u062C \u0628\u0647 \u0647\u06CC\u0686 \u06CC\u06A9 \u0627\u0632 \u0639\u0645\u0644\u06A9\u0631\u062F\u0647\u0627\u06CC \u0633\u06CC\u0633\u062A\u0645  \u062F\u0633\u062A\u0631\u0633\u06CC \u0646\u062F\u0627\u0634\u062A\u0647 \u0628\u0627\u0634\u062F 
-role.guest=\u0646\u0648\u0639 \u062D\u0633\u0627\u0628 
+role.guest=\u0645\u06CC\u0647\u0645\u0627\u0646 \u0646\u0627\u0634\u0646\u0627\u0633 
 role.guest.false=\u06A9\u0627\u0631\u0628\u0631 \u0633\u06CC\u0633\u062A\u0645 
 role.guest.true=\u0645\u06CC\u0647\u0645\u0627\u0646 \u0646\u0627\u0634\u0646\u0627\u0633 
 role.author=\u0646\u0648\u06CC\u0633\u0646\u062F\u0647 
 role.groupmanager=\u0645\u062F\u06CC\u0631\u06CC\u062A \u06AF\u0631\u0648\u0647 
+rightsForm.guest=\u0646\u0648\u0639 \u062D\u0633\u0627\u0628
 rightsForm.isLoginDenied=\u0627\u062A\u0635\u0627\u0644 \u0628\u0647 \u0633\u06CC\u0633\u062A\u0645 \u0645\u0633\u062F\u0648\u062F\u0634\u062F 
 role.usermanager=\u0645\u062F\u06CC\u0631\u06CC\u062A \u06A9\u0627\u0631\u0628\u0631 
 rightsForm.title=\u062A\u062E\u0635\u06CC\u0635 \u062D\u0642\u0648\u0642 \u0648 \u0639\u0645\u0644\u06A9\u0631\u062F \u0633\u06CC\u0633\u062A\u0645 
 search.cancel=\u0644\u063A\u0648 \u0639\u0645\u0644\u06CC\u0627\u062A 
 search.form.afterDate=\u06A9\u0627\u0631\u0628\u0631 \u0627\u06CC\u062C\u0627\u062F \u0634\u062F \u0628\u0639\u062F \u0627\u0632 
 search.form.beforeDate=\u06A9\u0627\u0631\u0628\u0631 \u0642\u0628\u0644\u0627\u064B \u0627\u06CC\u062C\u0627\u062F \u0634\u062F\u0647 \u0627\u0633\u062A 
-search.form.constraint.admin=\u0645\u062F\u06CC\u0631 \u0633\u06CC\u0633\u062A\u0645 
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.OLAT=\u06A9\u0644\u0645\u0647 \u0639\u0628\u0648\u0631 \u0627\u0648\u0644\u0627\u062A 
 search.form.constraint.auth.Shib=\u06A9\u0644\u0645\u0647 \u0622\u0632\u0645\u0627\u06CC\u0634\u06CC \u0639\u0628\u0648\u0631 
 search.form.constraint.auth.none=\u0628\u062F\u0648\u0646 \u0627\u062A\u0635\u0627\u0644 
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_fr.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_fr.properties
index 5c776e55996..2020382ef53 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_fr.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_fr.properties
@@ -86,7 +86,7 @@ poolsmanager=Gestionnaire banque de questions
 repocoach=Coach de cours
 rightForm.error.anonymous.no.roles=Les invit\u00E9(e)s anonymes ne peuvent pas exercer des r\u00F4les de syst\u00E8me.
 role.administrator=Administrateur
-role.guest=Type d'utilisateur
+role.guest=Invit\u00E9(e) anonyme
 role.guest.false=Utilisateur du syst\u00E8me
 role.guest.true=Invit\u00E9(e) anonyme
 role.author=Auteur
@@ -96,6 +96,7 @@ rightsForm.isLoginDenied=Acc\u00E8s bloqu\u00E9
 role.poolmanager=Gestion banque de questions
 role.usermanager=Gestion des utilisateurs
 role.sysadmin=Administrateur syst\u00E8me
+rightsForm.guest=Type d'utilisateur
 rightsForm.roles=R\u00F4les
 rightsForm.sendLoginDeniedEmail=Informer les utilisateurs de la suspension de leur compte
 rightsForm.status=Statut
@@ -108,7 +109,7 @@ rightsForm.title=Attribuer des r\u00F4les syst\u00E8me et droits.
 search.cancel=L'action a \u00E9t\u00E9 annul\u00E9e. 
 search.form.afterDate=Utilisateur cr\u00E9\u00E9 apr\u00E8s
 search.form.beforeDate=Utilisateur cr\u00E9\u00E9 il y a
-search.form.constraint.admin=Administrateur syst\u00E8me
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=Mot de passe LDAP
 search.form.constraint.auth.OAuth=Identification par r\u00E9seaux sociaux / Single-Sign-On (OAuth)
 search.form.constraint.auth.OLAT=Mot de passe OLAT/WebDAV 
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_it.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_it.properties
index 344815ff81f..77fb4ba8908 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_it.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_it.properties
@@ -73,7 +73,7 @@ notification.noNews=A partire da questa data non si \u00E8 connesso alcun nuovo
 notification.noSubscription=Non ha abbonato gli avvisi sui nuovi utenti.
 rightForm.error.anonymous.no.roles=Gli ospiti anonimi non possono assumere ruoli nel sistema
 role.administrator=Amministratore
-role.guest=Tipo d'utente
+role.guest=Ospite anonimo
 role.guest.false=Utente nel sistema
 role.guest.true=Ospite anonimo
 role.author=Autore
@@ -83,6 +83,7 @@ rightsForm.isLoginDenied=Login bloccato
 role.poolmanager=Gestore del pool di domande
 role.usermanager=Amministratore utenti
 role.sysadmin=Amministratore sistema
+rightsForm.guest=Tipo d'utente
 rightsForm.roles=Ruoli
 rightsForm.sendLoginDeniedEmail=Notificare il cambiamento del blocco login agli utenti
 rightsForm.status=Stato
@@ -95,7 +96,7 @@ rightsForm.title=Attribuire ruoli nel sistema e diritti
 search.cancel=L'azione \u00E8 stata interrotta.
 search.form.afterDate=Utente creato dopo il
 search.form.beforeDate=Utente creato prima del
-search.form.constraint.admin=Amministratore
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=Password LDAP
 search.form.constraint.auth.OAuth=Autenticazione con social network / Single-Sign-On (OAuth)
 search.form.constraint.auth.OLAT=Password OLAT/WebDAV
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_jp.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_jp.properties
index 1175446f330..0d71531d53f 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_jp.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_jp.properties
@@ -65,7 +65,7 @@ new.user.successful=\u65B0\u3057\u3044\u30E6\u30FC\u30B6\u30A2\u30AB\u30A6\u30F3
 notification.noNews=\u305D\u306E\u65E5\u4EE5\u6765\u3001\u65B0\u3057\u3044\u30E6\u30FC\u30B6\u306F\u3001\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u3044\u307E\u305B\u3093\u3002
 notification.noSubscription=\u3042\u306A\u305F\u306F\u3001\u65B0\u3057\u3044\u30E6\u30FC\u30B6\u306E\u305F\u3081\u306E\u30CB\u30E5\u30FC\u30B9\u3092\u8CFC\u8AAD\u767B\u9332\u3057\u3066\u3044\u307E\u305B\u3093\u3002
 rightForm.error.anonymous.no.roles=\u533F\u540D\u30B2\u30B9\u30C8\u306F\u3001\u30B7\u30B9\u30C6\u30E0\u30ED\u30FC\u30EB\u3092\u4F7F\u7528\u3059\u308B\u3053\u3068\u306F\u3067\u304D\u307E\u305B\u3093\u3002
-role.guest=\u30E6\u30FC\u30B6\u30BF\u30A4\u30D7
+role.guest=\u533F\u540D\u30B2\u30B9\u30C8
 role.guest.false=\u30B7\u30B9\u30C6\u30E0\u30E6\u30FC\u30B6
 role.guest.true=\u533F\u540D\u30B2\u30B9\u30C8
 role.author=\u4F5C\u8005
@@ -74,6 +74,7 @@ role.learnresourcemanager=\u5B66\u7FD2\u30EA\u30BD\u30FC\u30B9\u30DE\u30CD\u30FC
 rightsForm.isLoginDenied=\u30ED\u30B0\u30A4\u30F3\u505C\u6B62
 role.usermanager=\u30E6\u30FC\u30B6\u7BA1\u7406
 role.sysadmin=\u30B7\u30B9\u30C6\u30E0\u7BA1\u7406\u8005
+rightsForm.guest=\u30E6\u30FC\u30B6\u30BF\u30A4\u30D7
 rightsForm.roles=\u30ED\u30FC\u30EB
 rightsForm.status=\u30B9\u30C6\u30FC\u30BF\u30B9
 rightsForm.status.activ=\u30A2\u30AF\u30C6\u30A3\u30D6
@@ -85,7 +86,7 @@ rightsForm.title=\u30B7\u30B9\u30C6\u30E0\u30ED\u30FC\u30EB\u304A\u3088\u3073\u6
 search.cancel=\u64CD\u4F5C\u304C\u30AD\u30E3\u30F3\u30BB\u30EB\u3055\u308C\u307E\u3057\u305F\u3002
 search.form.afterDate=\u6B21\u306E\u65E5\u4ED8\u4EE5\u964D\u3001\u4F5C\u6210\u3055\u308C\u305F\u30E6\u30FC\u30B6
 search.form.beforeDate=\u6B21\u306E\u65E5\u4ED8\u4EE5\u524D\u3001\u4F5C\u6210\u3055\u308C\u305F\u30E6\u30FC\u30B6
-search.form.constraint.admin=\u7BA1\u7406\u8005
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=LDAP\u30D1\u30B9\u30EF\u30FC\u30C9
 search.form.constraint.auth.OLAT=OLAT/WebDAV\u30D1\u30B9\u30EF\u30FC\u30C9
 search.form.constraint.auth.Shib=Shibboleth\u30D1\u30B9\u30EF\u30FC\u30C9
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_lt.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_lt.properties
index 0d5d6b37137..d546e5659de 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_lt.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_lt.properties
@@ -44,7 +44,7 @@ new.user.cancel=Veiksmas buvo at\u0161auktas. Naujas naudotojas nesukurtas.
 new.user.successful=Naujas naudotojas s\u0117kmingai sukurtas
 rightForm.error.anonymous.no.roles=Anoniminiai sve\u010Diai negali tureti sistemini\u0173 roli\u0173
 role.administrator=Administratorius
-role.guest=Sandaros tipas
+role.guest=Anoniminis sve\u010Dias
 role.guest.false=Sisteminis naudotojas
 role.guest.true=Anoniminis sve\u010Dias
 role.author=Autorius
@@ -52,11 +52,12 @@ role.groupmanager=Grupi\u0173 valdymas
 rightsForm.isLoginDenied=Prisijungimas u\u017Eblokuotas
 role.usermanager=Naudotoj\u0173 valdymas
 role.sysadmin=Sistemos administratorius
+rightsForm.guest=Sandaros tipas
 rightsForm.title=Priskirti sistemines roles ir teises
 search.cancel=Veiksmas at\u0161auktas.
 search.form.afterDate=Naudotojas sukurtas po
 search.form.beforeDate=Naudotojas sukurtas iki
-search.form.constraint.admin=Administratorius
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.OLAT=OLAT/WebDAV slapta\u017Eodis
 search.form.constraint.auth.Shib=Shibboleth slapta\u017Eodis
 search.form.constraint.auth.none=Neautentifikuoti
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_nl_NL.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_nl_NL.properties
index 639cbe4a5a0..11696c8fdb2 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_nl_NL.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_nl_NL.properties
@@ -67,7 +67,7 @@ notification.noNews=Er zijn geen nieuwe gebruikers ingelogd sinds die datum.
 notification.noSubscription=U heeft u nog niet ingeschreven om nieuws te ontvangen over nieuwe gebruikers.
 rightForm.error.anonymous.no.roles=Anonieme gasten kunnen geen systeemrollen beoefenen
 role.administrator=Administrator
-role.guest=Gebruikerstype
+role.guest=Anonieme gast
 role.guest.false=Systeemgebruiker
 role.guest.true=Anonieme gast
 role.author=Auteur
@@ -76,6 +76,7 @@ role.learnresourcemanager=Leermiddelenbeheerder
 rightsForm.isLoginDenied=Login gesloten
 role.usermanager=Gebruikersbeheer
 role.sysadmin=Systeemadministrator
+rightsForm.guest=Gebruikerstype
 rightsForm.roles=Rollen
 rightsForm.status=Status
 rightsForm.status.activ=Actief
@@ -87,7 +88,7 @@ rightsForm.title=Wijs systeem rollen en rechten toe
 search.cancel=Actie geannuleerd
 search.form.afterDate=Gebruiker nadien aangemaakt
 search.form.beforeDate=Gebruiker voordien aangemaakt
-search.form.constraint.admin=Administrateur
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=LDAP wachtwoord
 search.form.constraint.auth.OLAT=OLAT/WebDAV wachtwoord
 search.form.constraint.auth.Shib=Shibboleth wachtwoord
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pl.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pl.properties
index 5723cc43e86..fdc39715904 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pl.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pl.properties
@@ -68,7 +68,7 @@ notification.noNews=\u017Baden nowy u\u017Cytkownik nie zalogowa\u0142 si\u0119
 notification.noSubscription=Nie subskrybowa\u0142e\u015B powiadamiania o nowych u\u017Cytkownikach.
 rightForm.error.anonymous.no.roles=Anonimowy go\u015B\u0107 nie mo\u017Ce wykonywa\u0107 r\u00F3l systemowych
 role.administrator=Administrator
-role.guest=Typ konta
+role.guest=Anonimowy go\u015B\u0107
 role.guest.false=U\u017Cytkownik systemowy
 role.guest.true=Anonimowy go\u015B\u0107
 role.author=Autor
@@ -76,6 +76,7 @@ role.groupmanager=Zarz\u0105dzanie grup\u0105
 role.learnresourcemanager=Mened\u017Cer zasob\u00F3w edukacyjnych
 rightsForm.isLoginDenied=Login zablokowany
 role.usermanager=Zarz\u0105dzanie u\u017Cytkownikiem
+rightsForm.guest=Typ konta
 rightsForm.roles=Role
 rightsForm.status=Status
 rightsForm.status.activ=Aktywny
@@ -87,7 +88,7 @@ rightsForm.title=Przypisz role systemowe i uprawnienia
 search.cancel=Akcja anulowana.
 search.form.afterDate=U\u017Cytkownicy utworzeni po
 search.form.beforeDate=U\u017Cytkownicy utworzeni przed
-search.form.constraint.admin=Administrator
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=Has\u0142o LDAP
 search.form.constraint.auth.OLAT=Has\u0142o OLAT/WebDAV
 search.form.constraint.auth.Shib=Has\u0142o Shibboleth
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pt_BR.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pt_BR.properties
index 90e969812ba..1558338e435 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pt_BR.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pt_BR.properties
@@ -86,7 +86,7 @@ poolsmanager=Gestor do banco de perguntas
 repocoach=Coach de Curso
 rightForm.error.anonymous.no.roles=Anonymous guests can not exercise system roles
 role.administrator=administrator
-role.guest=User type
+role.guest=Anonymous guest
 role.guest.false=System user
 role.guest.true=Anonymous guest
 role.author=Author
@@ -96,6 +96,7 @@ rightsForm.isLoginDenied=Login blocked
 role.poolmanager=Gestor de reservat\u00F3rio de perguntas
 role.usermanager=User management
 role.Admin=System administrator
+rightsForm.guest=User type
 rightsForm.roles=Fun\u00E7\u00F5es
 rightsForm.sendLoginDeniedEmail=Notificar o usu\u00E1rio sobre acesso negado
 rightsForm.status=Status
@@ -108,7 +109,7 @@ rightsForm.title=Assign system roles and rights
 search.cancel=Action cancelled.
 search.form.afterDate=User created after
 search.form.beforeDate=User created before
-search.form.constraint.admin=Administrator
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=Senha LDAP
 search.form.constraint.auth.OAuth=Autentica\u00E7\u00E3o de rede social / Single Sign-On (OAuth)
 search.form.constraint.auth.OLAT=OLAT/WebDAV password 
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pt_PT.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pt_PT.properties
index d46b9b14f0d..3c8e6c41768 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pt_PT.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_pt_PT.properties
@@ -47,7 +47,7 @@ new.user.cancel=Action cancelled. No new user account created.
 new.user.successful=The new user account has been created successfully.
 rightForm.error.anonymous.no.roles=Anonymous guests can not exercise system roles
 role.administrator=Administrator
-role.guest=User type
+role.guest=Anonymous guest
 role.guest.false=System user
 role.guest.true=Anonymous guest
 role.author=Author
@@ -55,6 +55,7 @@ role.groupmanager=Group management
 rightsForm.isLoginDenied=Login blocked
 role.usermanager=User management
 role.sysadmin=System administrator
+rightsForm.guest=User type
 rightsForm.status=Status
 rightsForm.status.activ=Ativo
 rightsForm.status.any.visible=-
@@ -65,7 +66,7 @@ rightsForm.title=Assign system roles and rights
 search.cancel=Action cancelled.
 search.form.afterDate=User created after
 search.form.beforeDate=User created before
-search.form.constraint.admin=Administrator
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.OLAT=OLAT/WebDAV password 
 search.form.constraint.auth.Shib=Shibboleth password 
 search.form.constraint.auth.none=No authentication
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_ru.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_ru.properties
index fd13b9b66c1..c9b82dae73b 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_ru.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_ru.properties
@@ -46,13 +46,14 @@ new.form.username=\u0418\u043C\u044F \u043F\u043E\u043B\u044C\u0437\u043E\u0432\
 new.user.cancel=\u041E\u043F\u0435\u0440\u0430\u0446\u0438\u044F \u0431\u044B\u043B\u0430 \u043E\u0442\u043C\u0435\u043D\u0435\u043D\u0430. \u041D\u043E\u0432\u0430\u044F \u0443\u0447\u0451\u0442\u043D\u0430\u044F \u0437\u0430\u043F\u0438\u0441\u044C \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044F \u043D\u0435 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043E\u0432\u0430\u043D\u0430.
 new.user.successful=\u0421\u043E\u0437\u0434\u0430\u043D\u0430 \u043D\u043E\u0432\u0430\u044F \u0443\u0447\u0451\u0442\u043D\u0430\u044F \u0437\u0430\u043F\u0438\u0441\u044C \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044F.
 rightForm.error.anonymous.no.roles=\u0410\u043D\u043E\u043D\u0438\u043C\u043D\u044B\u0435 \u0433\u043E\u0441\u0442\u0438 \u043D\u0435 \u043C\u043E\u0433\u0443\u0442 \u043F\u0435\u0440\u0435\u043D\u0438\u043C\u0430\u0442\u044C \u0440\u043E\u043B\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043C\u0435
-role.guest=\u0422\u0438\u043F \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044F
+role.guest=\u0410\u043D\u043E\u043D\u0438\u043C\u043D\u044B\u0439 \u0433\u043E\u0441\u0442\u044C
 role.guest.false=\u041F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044C \u0441\u0438\u0441\u0442\u0435\u043C\u044B
 role.guest.true=\u0410\u043D\u043E\u043D\u0438\u043C\u043D\u044B\u0439 \u0433\u043E\u0441\u0442\u044C
 role.author=\u0410\u0432\u0442\u043E\u0440 
 role.groupmanager=\u0423\u043F\u0440\u0430\u0432\u043B\u0435\u043D\u0438\u0435 \u0433\u0440\u0443\u043F\u043F\u043E\u0439
 rightsForm.isLoginDenied=\u0412\u0445\u043E\u0434 \u0437\u0430\u0431\u043B\u043E\u043A\u0438\u0440\u043E\u0432\u0430\u043D
 role.usermanager=\u0410\u0434\u043C\u0438\u043D\u0438\u0441\u0442\u0440\u0438\u0440\u043E\u0432\u0430\u043D\u0438\u0435 \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u0435\u0439
+rightsForm.guest=\u0422\u0438\u043F \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044F
 rightsForm.status=\u0421\u0442\u0430\u0442\u0443\u0441
 rightsForm.status.activ=\u0410\u043A\u0442\u0438\u0432\u043D\u043E
 rightsForm.status.any.visible=-
@@ -63,7 +64,7 @@ rightsForm.title=\u0420\u0430\u0441\u043F\u0440\u0435\u0434\u0435\u043B\u0438\u0
 search.cancel=\u041E\u043F\u0435\u0440\u0430\u0446\u0438\u044F \u0431\u044B\u043B\u0430 \u043E\u0442\u043C\u0435\u043D\u0435\u043D\u0430 
 search.form.afterDate=\u041F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044C \u0441\u043E\u0437\u0434\u0430\u043D \u043F\u043E\u0441\u043B\u0435
 search.form.beforeDate=\u041F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044C \u0441\u043E\u0437\u0434\u0430\u043D \u0434\u043E
-search.form.constraint.admin=\u0410\u0434\u043C\u0438\u043D\u0438\u0441\u0442\u0440\u0430\u0442\u043E\u0440
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.OLAT=OLAT/WebDAV \u043F\u0430\u0440\u043E\u043B\u044C
 search.form.constraint.auth.Shib=Shibboleth (\u0442\u0430\u0439\u043D\u044B\u0439) \u043F\u0430\u0440\u043E\u043B\u044C 
 search.form.constraint.auth.none=\u0411\u0435\u0437 \u0430\u0432\u0442\u043E\u0440\u0438\u0437\u0430\u0446\u0438\u0438
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_sq.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_sq.properties
index 6e9c4801c37..d318b796efd 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_sq.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_sq.properties
@@ -49,7 +49,7 @@ new.user.cancel=Aksioni u anulua. Nuk u krijua ndonj\u00EB llogari.
 new.user.successful=Llogaria e shfryt\u00EBzuesit t\u00EB ri u krijuar me sukses.
 rightForm.error.anonymous.no.roles=Mysafir\u00EBt anonim nuk mund t\u00EB ushtrojn\u00EB role t\u00EB sistemit
 role.administrator=Administrator
-role.guest=Lloji i shfryt\u00EBzuesit
+role.guest=Mysafir anonim
 role.guest.false=Shfryt\u00EBzues i sistemit
 role.guest.true=Mysafir anonim
 role.author=Autor
@@ -57,6 +57,7 @@ role.groupmanager=Drejtimi grupeve
 rightsForm.isLoginDenied=Kyqje e bllokuar 
 role.usermanager=Drejtimi i shfryt\u00EBzuesve
 role.Admin=Administrator sistemi
+rightsForm.guest=Lloji i shfryt\u00EBzuesit
 rightsForm.status=Statusi
 rightsForm.status.activ=Aktiv
 rightsForm.status.any.visible=-
@@ -67,7 +68,7 @@ rightsForm.title=Cakto t\u00EB drejtat edhe rolet e sistemit
 search.cancel=Aksioni u anulua.
 search.form.afterDate=Shfryt\u00EBzuesi u krijua m\u00EB von\u00EB se
 search.form.beforeDate=Shfryt\u00EBzuesi u krijua m\u00EB p\u00EBrpara se
-search.form.constraint.admin=Administrator
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.OLAT=OLAT/WebDAV fjal\u00EBkalimi
 search.form.constraint.auth.Shib=Shibboleth fjal\u00EBkalimi 
 search.form.constraint.auth.none=Pa autentikim
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_zh_CN.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_zh_CN.properties
index 22b6d2dafd1..0c7cb63cdef 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_zh_CN.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_zh_CN.properties
@@ -66,7 +66,7 @@ new.user.successful=\u6210\u529F\u521B\u5EFA\u65B0\u7528\u6237
 notification.noNews=\u4ECE\u90A3\u5929\u8D77\u8FD8\u6CA1\u6709\u65B0\u7528\u6237\u767B\u5F55\u3002
 notification.noSubscription=\u60A8\u8FD8\u6CA1\u6709\u8BA2\u9605\u5173\u4E8E\u65B0\u7528\u6237\u7684\u6D88\u606F\u3002
 rightForm.error.anonymous.no.roles=\u533F\u540D\u6E38\u5BA2\u4E0D\u80FD\u62C5\u4EFB\u7CFB\u7EDF\u89D2\u8272
-role.guest=\u8D26\u6237\u7C7B\u578B
+role.guest=\u533F\u540D\u6E38\u5BA2
 role.guest.false=\u7CFB\u7EDF\u7528\u6237
 role.guest.true=\u533F\u540D\u6E38\u5BA2
 role.author=\u521B\u5EFA\u4EBA
@@ -74,6 +74,7 @@ role.groupmanager=\u7FA4\u7EC4\u7BA1\u7406\u5458
 role.learnresourcemanager=\u5B66\u4E60\u8D44\u6E90\u7BA1\u7406\u8005
 rightsForm.isLoginDenied=\u767B\u5F55\u5DF2\u88AB\u963B\u6B62
 role.usermanager=\u7528\u6237\u7BA1\u7406\u5458
+rightsForm.guest=\u8D26\u6237\u7C7B\u578B
 rightsForm.roles=\u7CFB\u7EDF\u89D2\u8272
 rightsForm.status=\u72B6\u6001
 rightsForm.status.activ=\u5DF2\u6FC0\u6D3B\u8D26\u6237
@@ -85,7 +86,7 @@ rightsForm.title=\u5206\u914D\u7CFB\u7EDF\u89D2\u8272\u548C\u6743\u9650
 search.cancel=\u64CD\u4F5C\u53D6\u6D88
 search.form.afterDate=\u7528\u6237\u521B\u5EFA\u665A\u4E8E
 search.form.beforeDate=\u7528\u6237\u521B\u5EFA\u65E9\u4E8E
-search.form.constraint.admin=\u7BA1\u7406\u5458
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=LDAP\u5BC6\u7801
 search.form.constraint.auth.OLAT=OLAT/WebDAV\u5BC6\u7801
 search.form.constraint.auth.Shib=\u5BC6\u7801
diff --git a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_zh_TW.properties b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_zh_TW.properties
index f76d1fe17c5..c3234075592 100644
--- a/src/main/java/org/olat/admin/user/_i18n/LocalStrings_zh_TW.properties
+++ b/src/main/java/org/olat/admin/user/_i18n/LocalStrings_zh_TW.properties
@@ -63,7 +63,7 @@ new.user.successful=\u65B0\u7684\u4F7F\u7528\u8005\u5E33\u865F\u5DF2\u88AB\u6210
 notification.noNews=\u81EA\u8A72\u65E5\u671F\u8D77\u6C92\u6709\u65B0\u7684\u4F7F\u7528\u8005\u767B\u5165\u3002
 notification.noSubscription=\u60A8\u5C1A\u672A\u8A02\u95B1\u65B0\u4F7F\u7528\u8005\u7684\u6D88\u606F\u3002
 rightForm.error.anonymous.no.roles=\u533F\u540D\u8A2A\u5BA2\u4E0D\u80FD\u64D4\u4EFB\u7CFB\u7D71\u89D2\u8272
-role.guest=\u4F7F\u7528\u8005\u985E\u578B
+role.guest=\u533F\u540D\u8A2A\u5BA2
 role.guest.false=\u7CFB\u7D71\u4F7F\u7528\u8005
 role.guest.true=\u533F\u540D\u8A2A\u5BA2
 role.author=\u4F5C\u8005
@@ -71,6 +71,7 @@ role.groupmanager=\u7FA4\u7D44\u7BA1\u7406\u54E1
 role.learnresourcemanager=\u5B78\u7FD2\u8CC7\u6E90\u7BA1\u7406\u8005
 rightsForm.isLoginDenied=\u767B\u5165\u5C01\u9396
 role.usermanager=\u4F7F\u7528\u8005\u7BA1\u7406\u54E1
+rightsForm.guest=\u4F7F\u7528\u8005\u985E\u578B
 rightsForm.roles=\u89D2\u8272
 rightsForm.status=\u72C0\u614B
 rightsForm.status.activ=\u6709\u6548\u7684
@@ -82,7 +83,7 @@ rightsForm.title=\u6307\u6D3E\u7CFB\u7D71\u89D2\u8272\u548C\u6B0A\u9650
 search.cancel=\u52D5\u4F5C\u53D6\u6D88
 search.form.afterDate=\u4F7F\u7528\u8005\u5EFA\u7ACB\u665A\u65BC
 search.form.beforeDate=\u4F7F\u7528\u8005\u5EFA\u7ACB\u65E9\u65BC
-search.form.constraint.admin=\u7CFB\u7D71\u7BA1\u7406\u8005
+search.form.constraint.administrator=$\:role.administrator
 search.form.constraint.auth.LDAP=LDAP \u5BC6\u78BC
 search.form.constraint.auth.OLAT=OLAT/WebDAV \u5BC6\u78BC
 search.form.constraint.auth.Shib=Shibboleth \u5BC6\u78BC
diff --git a/src/main/java/org/olat/core/gui/control/_spring/sitedefContext.xml b/src/main/java/org/olat/core/gui/control/_spring/sitedefContext.xml
index 4fa490a9b18..1a4f711bcb3 100644
--- a/src/main/java/org/olat/core/gui/control/_spring/sitedefContext.xml
+++ b/src/main/java/org/olat/core/gui/control/_spring/sitedefContext.xml
@@ -134,27 +134,27 @@
 	</bean>
 
 	<bean id="restrictToAuthorSiteSecurityCallback" class="org.olat.core.gui.control.navigation.callback.SiteSecurityCallbackWithRolesRestriction">
-		<property name="limitToRole" value="author"/>
+		<property name="limitToRole" value="author,administrator,principal"/>
 	</bean>
 	
 	<bean id="restrictToUserManagerSiteSecurityCallback" class="org.olat.core.gui.control.navigation.callback.SiteSecurityCallbackWithRolesRestriction">
-		<property name="limitToRole" value="usermanager,rolesmanager,administrator"/>
+		<property name="limitToRole" value="usermanager,rolesmanager,principal,administrator"/>
 	</bean>
 	
 	<bean id="restrictToGroupManagerSiteSecurityCallback" class="org.olat.core.gui.control.navigation.callback.SiteSecurityCallbackWithRolesRestriction">
-		<property name="limitToRole" value="groupmanager,administrator"/>
+		<property name="limitToRole" value="groupmanager,principal,administrator"/>
 	</bean>
 	
 	<bean id="restrictToPoolAdminSiteSecurityCallback" class="org.olat.core.gui.control.navigation.callback.SiteSecurityCallbackWithRolesRestriction">
-		<property name="limitToRole" value="poolmanager,administrator"/>
+		<property name="limitToRole" value="poolmanager,principal,administrator"/>
 	</bean>
 
 	<bean id="restrictToInstResourceManagersAndAuthorsSiteSecurityCallback" class="org.olat.core.gui.control.navigation.callback.SiteSecurityCallbackWithRolesRestriction">
-		<property name="limitToRole" value="author,learnresourcemanager,administrator"/>
+		<property name="limitToRole" value="author,learnresourcemanager,principal,administrator"/>
 	</bean>
 
 	<bean id="restrictToInstResourceManagerSiteSecurityCallback" class="org.olat.core.gui.control.navigation.callback.SiteSecurityCallbackWithRolesRestriction">
-		<property name="limitToRole" value="learnresourcemanager,administrator"/>
+		<property name="limitToRole" value="learnresourcemanager,principal,administrator"/>
 	</bean>
 	
 	<bean id="catalogManagerSiteSecurityCallback" class="org.olat.repository.site.CatalogManagerSecurityCallback">
diff --git a/src/main/java/org/olat/core/gui/control/generic/portal/PortalSiteDef.java b/src/main/java/org/olat/core/gui/control/generic/portal/PortalSiteDef.java
index f60656ee025..43025068fa7 100644
--- a/src/main/java/org/olat/core/gui/control/generic/portal/PortalSiteDef.java
+++ b/src/main/java/org/olat/core/gui/control/generic/portal/PortalSiteDef.java
@@ -26,6 +26,7 @@ import org.olat.core.gui.control.navigation.SiteConfiguration;
 import org.olat.core.gui.control.navigation.SiteDefinition;
 import org.olat.core.gui.control.navigation.SiteInstance;
 import org.olat.core.util.StringHelper;
+import org.olat.core.util.UserSession;
 
 /**
  * 
@@ -43,8 +44,11 @@ public class PortalSiteDef extends AbstractSiteDefinition implements SiteDefinit
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
 		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
 			return new PortalSite(this, ureq.getLocale());
-		} else if (!ureq.getUserSession().getRoles().isGuestOnly()
-				&& !ureq.getUserSession().getRoles().isInvitee()) {
+		}
+		
+		UserSession usess = ureq.getUserSession();
+		if (usess != null && usess.getRoles() != null &&
+				!usess.getRoles().isGuestOnly() && !usess.getRoles().isInvitee()) {
 			// all except guests and invitees see this site
 			return new PortalSite(this, ureq.getLocale());
 		}
diff --git a/src/main/java/org/olat/core/gui/control/navigation/AbstractSiteDefinition.java b/src/main/java/org/olat/core/gui/control/navigation/AbstractSiteDefinition.java
index 1708d98543f..bee9adb9657 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/AbstractSiteDefinition.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/AbstractSiteDefinition.java
@@ -61,6 +61,8 @@ public abstract class AbstractSiteDefinition extends AbstractConfigOnOff impleme
 	
 	@Override
 	public final SiteInstance createSite(UserRequest ureq, WindowControl wControl) {
+		if(ureq == null) return null;
+		
 		SiteConfiguration config = getSiteConfiguration();
 		
 		String secCallbackBeanId = config.getSecurityCallbackBeanId();
@@ -81,8 +83,7 @@ public abstract class AbstractSiteDefinition extends AbstractConfigOnOff impleme
 	
 	protected SiteConfiguration getSiteConfiguration() {
 		SiteDefinitions siteModule = CoreSpringFactory.getImpl(SiteDefinitions.class);
-		SiteConfiguration config = siteModule.getConfigurationSite(this);
-		return config;
+		return siteModule.getConfigurationSite(this);
 	}
 
 	@Override
diff --git a/src/main/java/org/olat/core/gui/control/navigation/callback/AdminSecurityCallback.java b/src/main/java/org/olat/core/gui/control/navigation/callback/AdminSecurityCallback.java
index 02b074299f0..8212a286cdd 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/callback/AdminSecurityCallback.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/callback/AdminSecurityCallback.java
@@ -36,7 +36,6 @@ public class AdminSecurityCallback implements SiteSecurityCallback {
 
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		if(ureq == null) return false;
 		UserSession usess = ureq.getUserSession();
 		return usess != null
 				&& usess.getRoles() != null
diff --git a/src/main/java/org/olat/core/gui/control/navigation/callback/DefaultSecurityCallbackImpl.java b/src/main/java/org/olat/core/gui/control/navigation/callback/DefaultSecurityCallbackImpl.java
index 00fcd005420..bf35fac71e7 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/callback/DefaultSecurityCallbackImpl.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/callback/DefaultSecurityCallbackImpl.java
@@ -31,9 +31,6 @@ import org.olat.core.gui.control.navigation.SiteSecurityCallback;
  */
 public class DefaultSecurityCallbackImpl implements SiteSecurityCallback {
 
-	/**
-	 * @see com.frentix.olat.coursesite.SiteSecurityCallback#isAllowedToLaunchSite(org.olat.core.gui.UserRequest)
-	 */
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
 		return true;
diff --git a/src/main/java/org/olat/core/gui/control/navigation/callback/DisabledSecurityCallback.java b/src/main/java/org/olat/core/gui/control/navigation/callback/DisabledSecurityCallback.java
index 6262bb78a1b..9c591306462 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/callback/DisabledSecurityCallback.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/callback/DisabledSecurityCallback.java
@@ -32,9 +32,6 @@ import org.olat.core.gui.control.navigation.SiteSecurityCallback;
  */
 public class DisabledSecurityCallback implements SiteSecurityCallback {
 
-	/**
-	 * @see com.frentix.olat.coursesite.SiteSecurityCallback#isAllowedToLaunchSite(org.olat.core.gui.UserRequest)
-	 */
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
 		return false;
diff --git a/src/main/java/org/olat/core/gui/control/navigation/callback/ManagersSecurityCallback.java b/src/main/java/org/olat/core/gui/control/navigation/callback/ManagersSecurityCallback.java
index 289346e1faa..7095e59cc06 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/callback/ManagersSecurityCallback.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/callback/ManagersSecurityCallback.java
@@ -38,7 +38,7 @@ public class ManagersSecurityCallback implements SiteSecurityCallback {
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
 		UserSession usess = ureq.getUserSession();
-		if (usess.getRoles() == null) {
+		if (usess == null || usess.getRoles() == null) {
 			return false;
 		}
 		
diff --git a/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserGuestTeaserSecurityCallback.java b/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserGuestTeaserSecurityCallback.java
index 5be10209c20..0df46f3fab8 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserGuestTeaserSecurityCallback.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserGuestTeaserSecurityCallback.java
@@ -22,6 +22,7 @@ package org.olat.core.gui.control.navigation.callback;
 
 import org.olat.core.gui.UserRequest;
 import org.olat.core.gui.control.navigation.SiteViewSecurityCallback;
+import org.olat.core.util.UserSession;
 
 /**
  * Guest can see the site, but only registred can launch it
@@ -35,22 +36,13 @@ public class RegistredUserGuestTeaserSecurityCallback implements SiteViewSecurit
 
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		if (ureq.getUserSession().getRoles() == null
-				|| ureq.getUserSession().getRoles().isInvitee()
-				|| ureq.getUserSession().getRoles().isGuestOnly()) {
-			return false;
-		} else {
-			return true; 
-		}
+		UserSession usess = ureq.getUserSession();
+		return usess != null && usess.getRoles() != null && !usess.getRoles().isInvitee() && !usess.getRoles().isGuestOnly();
 	}
 
 	@Override
 	public boolean isAllowedToViewSite(UserRequest ureq) {
-		if (ureq.getUserSession().getRoles() == null
-				|| ureq.getUserSession().getRoles().isInvitee()) {
-			return false;
-		} else {
-			return true; 
-		}
+		UserSession usess = ureq.getUserSession();
+		return usess != null && usess.getRoles() != null && !usess.getRoles().isInvitee();
 	}
 }
diff --git a/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserOrGuestSecurityCallback.java b/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserOrGuestSecurityCallback.java
index 262b93ada73..6c1bfb2d807 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserOrGuestSecurityCallback.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserOrGuestSecurityCallback.java
@@ -22,6 +22,7 @@ package org.olat.core.gui.control.navigation.callback;
 
 import org.olat.core.gui.UserRequest;
 import org.olat.core.gui.control.navigation.SiteSecurityCallback;
+import org.olat.core.util.UserSession;
 
 /**
  * <h3>Description:</h3>
@@ -32,16 +33,10 @@ import org.olat.core.gui.control.navigation.SiteSecurityCallback;
  */
 public class RegistredUserOrGuestSecurityCallback implements SiteSecurityCallback {
 
-	/**
-	 * @see com.frentix.olat.coursesite.SiteSecurityCallback#isAllowedToLaunchSite(org.olat.core.gui.UserRequest)
-	 */
+
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		if (ureq.getUserSession().getRoles() == null
-				|| ureq.getUserSession().getRoles().isInvitee()) {
-			return false;
-		} else {
-			return true; 
-		}
+		UserSession usess = ureq.getUserSession();
+		return usess != null && usess.getRoles() != null && !usess.getRoles().isInvitee();
 	}
 }
diff --git a/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserSecurityCallback.java b/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserSecurityCallback.java
index 18b60bbb72e..049642e6f92 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserSecurityCallback.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/callback/RegistredUserSecurityCallback.java
@@ -22,6 +22,7 @@ package org.olat.core.gui.control.navigation.callback;
 
 import org.olat.core.gui.UserRequest;
 import org.olat.core.gui.control.navigation.SiteSecurityCallback;
+import org.olat.core.util.UserSession;
 
 /**
  * <h3>Description:</h3>
@@ -33,17 +34,10 @@ import org.olat.core.gui.control.navigation.SiteSecurityCallback;
  */
 public class RegistredUserSecurityCallback implements SiteSecurityCallback {
 
-	/**
-	 * @see com.frentix.olat.coursesite.SiteSecurityCallback#isAllowedToLaunchSite(org.olat.core.gui.UserRequest)
-	 */
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		if (ureq.getUserSession().getRoles() == null
-				|| ureq.getUserSession().getRoles().isInvitee()
-				|| ureq.getUserSession().getRoles().isGuestOnly()) {
-			return false;
-		} else {
-			return true; 
-		}
+		UserSession usess = ureq.getUserSession();
+		return usess != null && usess.getRoles() != null
+				&& !usess.getRoles().isInvitee() && !usess.getRoles().isGuestOnly();
 	}
 }
diff --git a/src/main/java/org/olat/core/gui/control/navigation/callback/SiteSecurityCallbackWithRolesRestriction.java b/src/main/java/org/olat/core/gui/control/navigation/callback/SiteSecurityCallbackWithRolesRestriction.java
index eb635f0ba8c..b7023cdf634 100644
--- a/src/main/java/org/olat/core/gui/control/navigation/callback/SiteSecurityCallbackWithRolesRestriction.java
+++ b/src/main/java/org/olat/core/gui/control/navigation/callback/SiteSecurityCallbackWithRolesRestriction.java
@@ -38,18 +38,18 @@ public class SiteSecurityCallbackWithRolesRestriction implements SiteSecurityCal
 		if (limitToRole == null || limitToRole.length == 0) {
 			// no restriction
 			return true;
-		} else {
-			Roles roles = ureq.getUserSession().getRoles();
-			if(roles != null) {
-				for (String limit : limitToRole) {
-					OrganisationRoles theRole = OrganisationRoles.valueOf(limit);
-					if(roles.hasRole(theRole)) {
-						return true;
-					}
+		}
+		
+		Roles roles = ureq.getUserSession().getRoles();
+		if(roles != null) {
+			for (String limit : limitToRole) {
+				OrganisationRoles theRole = OrganisationRoles.valueOf(limit);
+				if(roles.hasRole(theRole)) {
+					return true;
 				}
 			}
-			return false;
 		}
+		return false;
 	}
 	
 	/**
diff --git a/src/main/java/org/olat/course/assessment/model/SearchAssessedIdentityParams.java b/src/main/java/org/olat/course/assessment/model/SearchAssessedIdentityParams.java
index 7b0de9af1e5..bbe87859a61 100644
--- a/src/main/java/org/olat/course/assessment/model/SearchAssessedIdentityParams.java
+++ b/src/main/java/org/olat/course/assessment/model/SearchAssessedIdentityParams.java
@@ -124,6 +124,7 @@ public class SearchAssessedIdentityParams {
 		return businessGroupKeys;
 	}
 
+	//TODO roles groups
 	public void setBusinessGroupKeys(List<Long> businessGroupKeys) {
 		this.businessGroupKeys = businessGroupKeys;
 	}
diff --git a/src/main/java/org/olat/course/nodes/cl/manager/CheckboxManagerImpl.java b/src/main/java/org/olat/course/nodes/cl/manager/CheckboxManagerImpl.java
index 96f7ee1de3e..8beba6aabd3 100644
--- a/src/main/java/org/olat/course/nodes/cl/manager/CheckboxManagerImpl.java
+++ b/src/main/java/org/olat/course/nodes/cl/manager/CheckboxManagerImpl.java
@@ -440,7 +440,8 @@ public class CheckboxManagerImpl implements CheckboxManager {
 	}
 
 	@Override
-	public List<AssessmentData> getAssessmentDatas(OLATResourceable ores, String resSubPath, RepositoryEntry re, List<BusinessGroup> businessGroups) {
+	public List<AssessmentData> getAssessmentDatas(OLATResourceable ores, String resSubPath, RepositoryEntry re,
+			List<BusinessGroup> businessGroups) {
 		StringBuilder sb = new StringBuilder();
 		sb.append("select check from clcheck check")
 		  .append(" inner join fetch check.checkbox box")
diff --git a/src/main/java/org/olat/course/nodes/cl/model/AssessmentData.java b/src/main/java/org/olat/course/nodes/cl/model/AssessmentData.java
index 9b6d8bf951e..6a1b9d0ea02 100644
--- a/src/main/java/org/olat/course/nodes/cl/model/AssessmentData.java
+++ b/src/main/java/org/olat/course/nodes/cl/model/AssessmentData.java
@@ -43,10 +43,6 @@ public class AssessmentData {
 		return identity;
 	}
 	
-	public Float getTotalPoints() {
-		return 2.5f;
-	}
-	
 	public List<DBCheck> getChecks() {
 		return checks;
 	}
diff --git a/src/main/java/org/olat/course/nodes/cl/ui/CheckListAssessmentController.java b/src/main/java/org/olat/course/nodes/cl/ui/CheckListAssessmentController.java
index b51cf3aeae4..22a154a488c 100644
--- a/src/main/java/org/olat/course/nodes/cl/ui/CheckListAssessmentController.java
+++ b/src/main/java/org/olat/course/nodes/cl/ui/CheckListAssessmentController.java
@@ -96,6 +96,7 @@ import org.olat.repository.RepositoryService;
 import org.olat.repository.model.RepositoryEntryMembership;
 import org.olat.user.UserManager;
 import org.olat.user.propertyhandlers.UserPropertyHandler;
+import org.springframework.beans.factory.annotation.Autowired;
 
 /**
  * 
@@ -134,12 +135,18 @@ public class CheckListAssessmentController extends FormBasicController implement
 	private AssessedIdentityOverviewController editCtrl;
 	private CheckboxAssessmentController boxAssessmentCtrl;
 	
-	private final UserManager userManager;
-	private final BaseSecurity securityManager;
-	private final CheckboxManager checkboxManager;
-	private final RepositoryManager repositoryManager;
-	private final RepositoryService repositoryService;
-	private final BusinessGroupService businessGroupService;
+	@Autowired
+	private UserManager userManager;
+	@Autowired
+	private BaseSecurity securityManager;
+	@Autowired
+	private CheckboxManager checkboxManager;
+	@Autowired
+	private RepositoryManager repositoryManager;
+	@Autowired
+	private RepositoryService repositoryService;
+	@Autowired
+	private BusinessGroupService businessGroupService;
 	
 	/**
 	 * Use this constructor to launch the checklist.
@@ -262,12 +269,13 @@ public class CheckListAssessmentController extends FormBasicController implement
 			UserCourseEnvironmentImpl env = (UserCourseEnvironmentImpl)coachCourseEnv;
 			List<BusinessGroup> coachedGroups = env.getCoachedGroups();
 			List<FlexiTableFilter> filters = new ArrayList<>(coachedGroups.size() + 1);
-			filters.add(new FlexiTableFilter(translate("filter.all"), "all"));
 			for(int k=0; k<coachedGroups.size(); k++) {
 				BusinessGroup group = coachedGroups.get(k);
 				String groupName = StringHelper.escapeHtml(group.getName());
 				filters.add(new FlexiTableFilter(groupName, group.getKey().toString()));
 			}
+			filters.add(FlexiTableFilter.SPACER);
+			filters.add(new FlexiTableFilter(translate("filter.all"), "all"));
 			table.setFilters("participants", filters, false);
 		}
 		table.setExportEnabled(true);
@@ -321,7 +329,8 @@ public class CheckListAssessmentController extends FormBasicController implement
 		List<BusinessGroup> coachedGroups = courseAdmin ?
 				coachCourseEnv.getCourseEnvironment().getCourseGroupManager().getAllBusinessGroups()
 				: env.getCoachedGroups();
-		List<AssessmentData> dataList = checkboxManager.getAssessmentDatas(courseOres, courseNode.getIdent(), courseTutor || courseAdmin ? re : null, coachedGroups);
+		List<AssessmentData> dataList = checkboxManager
+				.getAssessmentDatas(courseOres, courseNode.getIdent(), courseTutor || courseAdmin ? re : null, coachedGroups);
 		List<CheckListAssessmentRow> boxList = getAssessmentDataViews(dataList, checkboxColl);
 		Map<Long,CheckListAssessmentRow> identityToView = new HashMap<>();
 		for(CheckListAssessmentRow box:boxList) {
diff --git a/src/main/java/org/olat/course/run/userview/UserCourseEnvironmentImpl.java b/src/main/java/org/olat/course/run/userview/UserCourseEnvironmentImpl.java
index 6cfceadf6f2..e12a186628a 100644
--- a/src/main/java/org/olat/course/run/userview/UserCourseEnvironmentImpl.java
+++ b/src/main/java/org/olat/course/run/userview/UserCourseEnvironmentImpl.java
@@ -237,11 +237,8 @@ public class UserCourseEnvironmentImpl implements UserCourseEnvironment {
 		}
 		return courseRepoEntry;
 	}
-	
-	public int sizeCoachedGroups() {
-		return coachedGroups == null ? 0 : coachedGroups.size();
-	}
 
+	//TODO roles groups
 	public List<BusinessGroup> getCoachedGroups() {
 		if(coachedGroups == null) {
 			return Collections.emptyList();
diff --git a/src/main/java/org/olat/course/site/CourseSiteDef.java b/src/main/java/org/olat/course/site/CourseSiteDef.java
index 62217a7cc1f..4e731ec06b4 100644
--- a/src/main/java/org/olat/course/site/CourseSiteDef.java
+++ b/src/main/java/org/olat/course/site/CourseSiteDef.java
@@ -72,7 +72,9 @@ public class CourseSiteDef extends AbstractSiteDefinition implements SiteDefinit
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
 		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
 			return createSite(ureq, getCourseSiteconfiguration(), config);
-		} else if(!ureq.getUserSession().getRoles().isInvitee()) {
+		}
+		UserSession usess = ureq.getUserSession();
+		if(!usess.getRoles().isInvitee()) {
 			// only for registered users and guests
 			return createSite(ureq, getCourseSiteconfiguration(), config);
 		}
diff --git a/src/main/java/org/olat/group/site/GroupsSite.java b/src/main/java/org/olat/group/site/GroupsSite.java
index 0071f201d2d..3c1b5636c80 100644
--- a/src/main/java/org/olat/group/site/GroupsSite.java
+++ b/src/main/java/org/olat/group/site/GroupsSite.java
@@ -78,17 +78,15 @@ public class GroupsSite extends AbstractSiteInstance {
 		OLATResourceable ores = OresHelper.createOLATResourceableInstance(GroupsSite.class, 0l);
 		ThreadLocalUserActivityLogger.addLoggingResourceInfo(LoggingResourceable.wrapBusinessPath(ores));
 		WindowControl bwControl = BusinessControlFactory.getInstance().createBusinessWindowControl(ureq, ores, new StateSite(this), wControl, true);
-		//MainLayoutController c = new BusinessGroupMainController(ureq, bwControl);
 		return new OverviewBusinessGroupListController(ureq, bwControl);
 	}
 
-	/**
-	 * @see org.olat.navigation.SiteInstance#isKeepState()
-	 */
+	@Override
 	public boolean isKeepState() {
 		return true;
 	}
 
+	@Override
 	public void reset() {
 		curNavElem = new DefaultNavElement(origNavElem);
 	}
diff --git a/src/main/java/org/olat/group/site/GroupsSiteDef.java b/src/main/java/org/olat/group/site/GroupsSiteDef.java
index 0618341a473..4cc5e3fb374 100644
--- a/src/main/java/org/olat/group/site/GroupsSiteDef.java
+++ b/src/main/java/org/olat/group/site/GroupsSiteDef.java
@@ -32,6 +32,7 @@ import org.olat.core.gui.control.navigation.SiteConfiguration;
 import org.olat.core.gui.control.navigation.SiteDefinition;
 import org.olat.core.gui.control.navigation.SiteInstance;
 import org.olat.core.util.StringHelper;
+import org.olat.core.util.UserSession;
 
 /**
  * Description:<br>
@@ -49,8 +50,11 @@ public class GroupsSiteDef extends AbstractSiteDefinition implements SiteDefinit
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
 		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
 			return new GroupsSite(this, ureq.getLocale());
-		} else if (!ureq.getUserSession().getRoles().isGuestOnly()
-				&& !ureq.getUserSession().getRoles().isInvitee()) {
+		}
+		
+		UserSession usess = ureq.getUserSession();
+		if (usess != null && usess.getRoles() != null
+				&& !usess.getRoles().isGuestOnly() && !usess.getRoles().isInvitee()) {
 			// all except guests and invitees see this site
 			return new GroupsSite(this, ureq.getLocale());
 		}
diff --git a/src/main/java/org/olat/gui/demo/site/GUIDemoSiteDef.java b/src/main/java/org/olat/gui/demo/site/GUIDemoSiteDef.java
index 1dc77c755d2..6ca13bd4f9a 100644
--- a/src/main/java/org/olat/gui/demo/site/GUIDemoSiteDef.java
+++ b/src/main/java/org/olat/gui/demo/site/GUIDemoSiteDef.java
@@ -43,11 +43,6 @@ import org.olat.core.gui.control.navigation.SiteInstance;
  */
 public class GUIDemoSiteDef extends AbstractSiteDefinition implements SiteDefinition {
 
-	@Override
-	public boolean isEnabled() {
-		return true | super.isEnabled();
-	}
-
 	@Override
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
 		return new GUIDemoSite(this);
diff --git a/src/main/java/org/olat/modules/coach/site/CoachSite.java b/src/main/java/org/olat/modules/coach/site/CoachSite.java
index 1a76524461a..4ea4c72d08d 100644
--- a/src/main/java/org/olat/modules/coach/site/CoachSite.java
+++ b/src/main/java/org/olat/modules/coach/site/CoachSite.java
@@ -73,8 +73,7 @@ public class CoachSite extends AbstractSiteInstance {
 		OLATResourceable ores = OresHelper.createOLATResourceableInstance(CoachSite.class, 0l);
 		ThreadLocalUserActivityLogger.addLoggingResourceInfo(LoggingResourceable.wrapBusinessPath(ores));
 		WindowControl bwControl = BusinessControlFactory.getInstance().createBusinessWindowControl(ureq, ores, new StateSite(this), wControl, true);
-		CoachMainController mainController = new CoachMainController(ureq, bwControl);
-		return mainController;
+		return new CoachMainController(ureq, bwControl);
 	}
 
 	@Override
diff --git a/src/main/java/org/olat/modules/coach/site/CoachSiteDef.java b/src/main/java/org/olat/modules/coach/site/CoachSiteDef.java
index eaa9c4401ab..d0bdaed22c5 100644
--- a/src/main/java/org/olat/modules/coach/site/CoachSiteDef.java
+++ b/src/main/java/org/olat/modules/coach/site/CoachSiteDef.java
@@ -45,13 +45,18 @@ public class CoachSiteDef extends AbstractSiteDefinition implements SiteDefiniti
 	@Override
 	protected SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
 		UserSession usess = ureq.getUserSession();
-		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())
-				|| (!usess.getRoles().isGuestOnly() && !usess.getRoles().isInvitee())) {
-			if(usess.getRoles().isAdministrator() 
-					|| usess.getRoles().isUserManager() || usess.getRoles().isRolesManager()
-					|| CoreSpringFactory.getImpl(CoachingService.class).isCoach(ureq.getIdentity())) {
-				return new CoachSite(this, ureq.getLocale());
-			}
+		if(usess == null || usess.getRoles() == null || usess.getRoles().isGuestOnly() || usess.getRoles().isInvitee()) {
+			return null;
+		}
+
+		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
+			return new CoachSite(this, ureq.getLocale());
+		}		
+
+		if(usess.getRoles().isAdministrator()  || usess.getRoles().isPrincipal()
+				|| usess.getRoles().isUserManager() || usess.getRoles().isRolesManager()
+				|| CoreSpringFactory.getImpl(CoachingService.class).isCoach(ureq.getIdentity())) {
+			return new CoachSite(this, ureq.getLocale());
 		}
 		return null;
 	}
diff --git a/src/main/java/org/olat/modules/curriculum/site/CurriculumAdminSiteDef.java b/src/main/java/org/olat/modules/curriculum/site/CurriculumAdminSiteDef.java
index 76857bbca1e..a92fd116568 100644
--- a/src/main/java/org/olat/modules/curriculum/site/CurriculumAdminSiteDef.java
+++ b/src/main/java/org/olat/modules/curriculum/site/CurriculumAdminSiteDef.java
@@ -27,6 +27,7 @@ import org.olat.core.gui.control.navigation.SiteConfiguration;
 import org.olat.core.gui.control.navigation.SiteDefinition;
 import org.olat.core.gui.control.navigation.SiteInstance;
 import org.olat.core.util.StringHelper;
+import org.olat.core.util.UserSession;
 import org.olat.modules.curriculum.CurriculumModule;
 
 /**
@@ -42,7 +43,10 @@ public class CurriculumAdminSiteDef extends AbstractSiteDefinition implements Si
 		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
 			return new CurriculumAdminSite(this, ureq.getLocale());
 		}
-		if(ureq.getUserSession().getRoles().isLearnResourceManager()) {
+		
+		UserSession usess = ureq.getUserSession();
+		if(usess != null && usess.getRoles() != null &&
+				(usess.getRoles().isLearnResourceManager() || usess.getRoles().isCurriculumManager() || usess.getRoles().isPrincipal())) {
 			// only for admins
 			return new CurriculumAdminSite(this, ureq.getLocale());
 		}
diff --git a/src/main/java/org/olat/modules/curriculum/site/CurriculumManagerSecurityCallback.java b/src/main/java/org/olat/modules/curriculum/site/CurriculumManagerSecurityCallback.java
index 805b3388c09..903bfc95ff2 100644
--- a/src/main/java/org/olat/modules/curriculum/site/CurriculumManagerSecurityCallback.java
+++ b/src/main/java/org/olat/modules/curriculum/site/CurriculumManagerSecurityCallback.java
@@ -36,18 +36,10 @@ public class CurriculumManagerSecurityCallback implements SiteSecurityCallback {
 
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		if (ureq == null) {
-			return false;
-		}
 		UserSession usess = ureq.getUserSession();
-		if(usess == null || usess.getRoles() == null) {
-			return false;
-		}
+		if(usess == null ) return false;
 		
 		Roles roles = usess.getRoles();
-		if (usess.getRoles() == null || roles.isInvitee() || roles.isGuestOnly()) {
-			return false;
-		}
-		return roles.isAdministrator() || roles.isCurriculumManager();
+		return roles != null && (roles.isAdministrator() || roles.isPrincipal() || roles.isCurriculumManager());
 	}
 }
diff --git a/src/main/java/org/olat/modules/docpool/site/DocumentPoolSiteDef.java b/src/main/java/org/olat/modules/docpool/site/DocumentPoolSiteDef.java
index 3e8ff1b8efd..defab89fbcb 100644
--- a/src/main/java/org/olat/modules/docpool/site/DocumentPoolSiteDef.java
+++ b/src/main/java/org/olat/modules/docpool/site/DocumentPoolSiteDef.java
@@ -43,12 +43,12 @@ public class DocumentPoolSiteDef extends AbstractSiteDefinition implements SiteD
 	@Override
 	protected SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
 		UserSession usess = ureq.getUserSession();
-		Roles roles = usess.getRoles();
-		if(roles.isAdministrator()) {
-			return new DocumentPoolSite(this, ureq.getLocale());
-		} else if(roles.isGuestOnly() || roles.isInvitee()) {
+		if(usess == null || usess.getRoles() == null || usess.getRoles().isGuestOnly() || usess.getRoles().isInvitee()) {
 			return null;
-		} else if(hasCompetence(usess.getIdentity())) {
+		}
+		
+		Roles roles = usess.getRoles();
+		if(roles.isAdministrator() || roles.isPrincipal() || hasCompetence(usess.getIdentity())) {
 			return new DocumentPoolSite(this, ureq.getLocale());
 		}
 		return null;
diff --git a/src/main/java/org/olat/modules/docpool/site/DocumentPoolSiteSecurityCallback.java b/src/main/java/org/olat/modules/docpool/site/DocumentPoolSiteSecurityCallback.java
index 5783007f577..2f736f2ee1c 100644
--- a/src/main/java/org/olat/modules/docpool/site/DocumentPoolSiteSecurityCallback.java
+++ b/src/main/java/org/olat/modules/docpool/site/DocumentPoolSiteSecurityCallback.java
@@ -47,14 +47,14 @@ public class DocumentPoolSiteSecurityCallback implements SiteSecurityCallback {
 
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		UserSession usess = ureq == null ? null : ureq.getUserSession();
+		UserSession usess = ureq.getUserSession();
 		if(usess == null) return false;
 		
 		Roles roles = usess.getRoles();
 		if(roles == null || roles.isInvitee() || roles.isGuestOnly()) {
 			return false;
 		}
-		if (roles.isAdministrator()) {
+		if (roles.isAdministrator() || roles.isPrincipal()) {
 			return true;
 		}
 		
diff --git a/src/main/java/org/olat/modules/portfolio/sites/PortfolioSiteDef.java b/src/main/java/org/olat/modules/portfolio/sites/PortfolioSiteDef.java
index 2a2604722f9..7d7f7eac368 100644
--- a/src/main/java/org/olat/modules/portfolio/sites/PortfolioSiteDef.java
+++ b/src/main/java/org/olat/modules/portfolio/sites/PortfolioSiteDef.java
@@ -26,7 +26,7 @@ import org.olat.core.gui.control.navigation.AbstractSiteDefinition;
 import org.olat.core.gui.control.navigation.SiteConfiguration;
 import org.olat.core.gui.control.navigation.SiteDefinition;
 import org.olat.core.gui.control.navigation.SiteInstance;
-import org.olat.core.util.StringHelper;
+import org.olat.core.util.UserSession;
 import org.olat.modules.portfolio.PortfolioV2Module;
 
 /**
@@ -39,11 +39,11 @@ public class PortfolioSiteDef  extends AbstractSiteDefinition implements SiteDef
 
 	@Override
 	protected SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
-		if(ureq.getUserSession().getRoles().isGuestOnly()) {
+		UserSession usess = ureq.getUserSession();
+		if(usess == null || usess.getRoles() == null || usess.getRoles().isGuestOnly()) {
 			return null;
-		} else if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
-			return new PortfolioSite(this, ureq.getLocale());
 		}
+		
 		// only for registered users and invitee but not guests
 		return new PortfolioSite(this, ureq.getLocale());
 	}
diff --git a/src/main/java/org/olat/modules/qpool/site/AuthorAndPoolPrivateMembersSecurityCallback.java b/src/main/java/org/olat/modules/qpool/site/AuthorAndPoolPrivateMembersSecurityCallback.java
index 2aacf121968..6615070b47a 100644
--- a/src/main/java/org/olat/modules/qpool/site/AuthorAndPoolPrivateMembersSecurityCallback.java
+++ b/src/main/java/org/olat/modules/qpool/site/AuthorAndPoolPrivateMembersSecurityCallback.java
@@ -45,7 +45,7 @@ public class AuthorAndPoolPrivateMembersSecurityCallback implements SiteSecurity
 
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		if (!questionPoolModule.isEnabled() || ureq == null || ureq.getIdentity() == null) {
+		if (!questionPoolModule.isEnabled()) {
 			return false;
 		}
 		UserSession usess = ureq.getUserSession();
@@ -56,7 +56,7 @@ public class AuthorAndPoolPrivateMembersSecurityCallback implements SiteSecurity
 		if (roles == null || roles.isInvitee() || roles.isGuestOnly()) {
 			return false;
 		}
-		return roles.isAdministrator() || roles.isPoolManager() || roles.isAuthor()
+		return roles.isAdministrator() || roles.isPrincipal() || roles.isPoolManager() || roles.isAuthor()
 				|| qPoolService.isMemberOfPrivatePools(ureq.getIdentity());
 	}
 }
diff --git a/src/main/java/org/olat/modules/qpool/site/PoolPrivateMembersSecurityCallback.java b/src/main/java/org/olat/modules/qpool/site/PoolPrivateMembersSecurityCallback.java
index b858672e6ce..1ddb1bef377 100644
--- a/src/main/java/org/olat/modules/qpool/site/PoolPrivateMembersSecurityCallback.java
+++ b/src/main/java/org/olat/modules/qpool/site/PoolPrivateMembersSecurityCallback.java
@@ -45,7 +45,7 @@ public class PoolPrivateMembersSecurityCallback implements SiteSecurityCallback
 
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		if (!questionPoolModule.isEnabled() || ureq == null || ureq.getIdentity() == null) {
+		if (!questionPoolModule.isEnabled() || ureq.getIdentity() == null) {
 			return false;
 		}
 		
@@ -57,8 +57,7 @@ public class PoolPrivateMembersSecurityCallback implements SiteSecurityCallback
 		if(roles == null || roles.isInvitee() || roles.isGuestOnly()) {
 			return false;
 		}
-		return roles.isAdministrator()
-				|| roles.isPoolManager()
+		return roles.isAdministrator() || roles.isPrincipal() || roles.isPoolManager()
 				|| qPoolService.isMemberOfPrivatePools(ureq.getIdentity());
 	}
 }
diff --git a/src/main/java/org/olat/modules/qpool/site/PoolTaxonomySecurityCallback.java b/src/main/java/org/olat/modules/qpool/site/PoolTaxonomySecurityCallback.java
index 9eb543de0c2..37bdc1a5787 100644
--- a/src/main/java/org/olat/modules/qpool/site/PoolTaxonomySecurityCallback.java
+++ b/src/main/java/org/olat/modules/qpool/site/PoolTaxonomySecurityCallback.java
@@ -55,7 +55,7 @@ public class PoolTaxonomySecurityCallback implements SiteSecurityCallback {
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
 		if (!questionPoolModule.isEnabled() || !StringHelper.isLong(questionPoolModule.getTaxonomyQPoolKey())
-				|| ureq == null || ureq.getIdentity() == null ) {
+				|| ureq.getIdentity() == null ) {
 			return false;
 		}
 		
@@ -68,7 +68,7 @@ public class PoolTaxonomySecurityCallback implements SiteSecurityCallback {
 		if (roles == null || roles.isInvitee() || roles.isGuestOnly()) {
 			return false;
 		}
-		if (roles.isAdministrator() || roles.isPoolManager()) {
+		if (roles.isAdministrator() || roles.isPrincipal() || roles.isPoolManager()) {
 			return true;
 		}
 		
diff --git a/src/main/java/org/olat/modules/qpool/site/QuestionPoolSiteDef.java b/src/main/java/org/olat/modules/qpool/site/QuestionPoolSiteDef.java
index 47986825bf8..45c5791aff1 100644
--- a/src/main/java/org/olat/modules/qpool/site/QuestionPoolSiteDef.java
+++ b/src/main/java/org/olat/modules/qpool/site/QuestionPoolSiteDef.java
@@ -39,15 +39,16 @@ public class QuestionPoolSiteDef extends AbstractSiteDefinition implements SiteD
 
 	@Override
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
+		UserSession usess = ureq.getUserSession();
+		if(usess == null || usess.getRoles() == null || usess.getRoles().isInvitee() || usess.getRoles().isGuestOnly()) {
+			return null;
+		}
+		
 		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
 			//already checked
 			return new QuestionPoolSite(this, ureq.getLocale());
 		}
-		
-		UserSession usess = ureq.getUserSession();
-		if(usess == null || usess.getRoles() == null) {
-			return null;
-		}
+
 		Roles roles = usess.getRoles();
 		if(roles.isAdministrator() || roles.isAuthor() || roles.isPoolManager()) {
 			return new QuestionPoolSite(this, ureq.getLocale());
diff --git a/src/main/java/org/olat/portfolio/site/EPSiteDef.java b/src/main/java/org/olat/portfolio/site/EPSiteDef.java
index 67b27d75b0d..86297a65712 100644
--- a/src/main/java/org/olat/portfolio/site/EPSiteDef.java
+++ b/src/main/java/org/olat/portfolio/site/EPSiteDef.java
@@ -26,7 +26,7 @@ import org.olat.core.gui.control.navigation.AbstractSiteDefinition;
 import org.olat.core.gui.control.navigation.SiteConfiguration;
 import org.olat.core.gui.control.navigation.SiteDefinition;
 import org.olat.core.gui.control.navigation.SiteInstance;
-import org.olat.core.util.StringHelper;
+import org.olat.core.util.UserSession;
 import org.olat.portfolio.PortfolioModule;
 
 /**
@@ -39,11 +39,11 @@ public class EPSiteDef  extends AbstractSiteDefinition implements SiteDefinition
 
 	@Override
 	protected SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
-		if(ureq.getUserSession().getRoles().isGuestOnly()) {
+		UserSession usess = ureq.getUserSession();
+		if(usess == null || usess.getRoles() == null || usess.getRoles().isGuestOnly()) {
 			return null;
-		} else if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
-			return new EPSite(this, ureq.getLocale());
 		}
+		
 		// only for registered users and invitee but not guests
 		return new EPSite(this, ureq.getLocale());
 	}
diff --git a/src/main/java/org/olat/repository/site/CatalogAdminSiteDef.java b/src/main/java/org/olat/repository/site/CatalogAdminSiteDef.java
index 497595f1929..e5913e39785 100644
--- a/src/main/java/org/olat/repository/site/CatalogAdminSiteDef.java
+++ b/src/main/java/org/olat/repository/site/CatalogAdminSiteDef.java
@@ -41,9 +41,6 @@ public class CatalogAdminSiteDef extends AbstractSiteDefinition implements SiteD
 
 	@Override
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
-		if(ureq == null) {
-			return null;
-		}
 		UserSession usess = ureq.getUserSession();
 		if(usess == null) {
 			return null;
diff --git a/src/main/java/org/olat/repository/site/CatalogManagerSecurityCallback.java b/src/main/java/org/olat/repository/site/CatalogManagerSecurityCallback.java
index ee85ef9038f..c0ba23e8e0c 100644
--- a/src/main/java/org/olat/repository/site/CatalogManagerSecurityCallback.java
+++ b/src/main/java/org/olat/repository/site/CatalogManagerSecurityCallback.java
@@ -47,10 +47,6 @@ public class CatalogManagerSecurityCallback implements SiteSecurityCallback {
 
 	@Override
 	public boolean isAllowedToLaunchSite(UserRequest ureq) {
-		if(ureq == null) {
-			return false;
-		}
-		
 		UserSession usess = ureq.getUserSession();
 		if(usess == null || usess.getRoles() == null || ureq.getIdentity() == null
 				|| usess.getRoles().isInvitee() || usess.getRoles().isGuestOnly()) {
@@ -58,6 +54,6 @@ public class CatalogManagerSecurityCallback implements SiteSecurityCallback {
 		}
 		return usess.getRoles().isAdministrator()
 				|| usess.getRoles().isLearnResourceManager()
-				||  catalogManager.isOwner(ureq.getIdentity());
+				|| catalogManager.isOwner(ureq.getIdentity());
 	}
 }
diff --git a/src/main/java/org/olat/repository/site/MyCoursesSiteDef.java b/src/main/java/org/olat/repository/site/MyCoursesSiteDef.java
index b916ce2744d..85d04017484 100644
--- a/src/main/java/org/olat/repository/site/MyCoursesSiteDef.java
+++ b/src/main/java/org/olat/repository/site/MyCoursesSiteDef.java
@@ -26,6 +26,7 @@ import org.olat.core.gui.control.navigation.SiteConfiguration;
 import org.olat.core.gui.control.navigation.SiteDefinition;
 import org.olat.core.gui.control.navigation.SiteInstance;
 import org.olat.core.util.StringHelper;
+import org.olat.core.util.UserSession;
 
 /**
  * 
@@ -46,7 +47,10 @@ public class MyCoursesSiteDef extends AbstractSiteDefinition implements SiteDefi
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
 		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
 			return new MyCoursesSite(this, ureq.getLocale());
-		} else if(!ureq.getUserSession().getRoles().isInvitee() && !ureq.getUserSession().getRoles().isGuestOnly()) {
+		}
+		
+		UserSession usess = ureq.getUserSession();
+		if(usess != null && usess.getRoles() != null && !usess.getRoles().isInvitee() && !usess.getRoles().isGuestOnly()) {
 			// only for registered users
 			return new MyCoursesSite(this, ureq.getLocale());
 		}
diff --git a/src/main/java/org/olat/repository/site/RepositorySiteDef.java b/src/main/java/org/olat/repository/site/RepositorySiteDef.java
index b451a248d3e..b243c61627d 100644
--- a/src/main/java/org/olat/repository/site/RepositorySiteDef.java
+++ b/src/main/java/org/olat/repository/site/RepositorySiteDef.java
@@ -51,17 +51,17 @@ public class RepositorySiteDef extends AbstractSiteDefinition implements SiteDef
 	 */
 	@Override
 	public SiteInstance createSite(UserRequest ureq, WindowControl wControl, SiteConfiguration config) {
-		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
-			return new RepositorySite(this, ureq.getLocale());
-		} 
-		
 		UserSession usess = ureq.getUserSession();
-		if(usess == null || usess.getRoles() == null) {
+		if(usess == null || usess.getRoles() == null || usess.getRoles().isInvitee() || usess.getRoles().isGuestOnly()) {
 			return null;
 		}
 		
+		if(StringHelper.containsNonWhitespace(config.getSecurityCallbackBeanId())) {
+			return new RepositorySite(this, ureq.getLocale());
+		} 
+		
 		Roles roles = usess.getRoles();
-		if(roles.isAdministrator() || roles.isAuthor() || roles.isLearnResourceManager()) {
+		if(roles.isAdministrator() || roles.isAuthor() || roles.isLearnResourceManager() || roles.isPrincipal()) {
 			// only for authors and institutional resource managers
 			return new RepositorySite(this, ureq.getLocale());
 		}
diff --git a/src/main/java/org/olat/user/ui/admin/UserAdminMainController.java b/src/main/java/org/olat/user/ui/admin/UserAdminMainController.java
index 626cfcef063..f6f74391f0d 100644
--- a/src/main/java/org/olat/user/ui/admin/UserAdminMainController.java
+++ b/src/main/java/org/olat/user/ui/admin/UserAdminMainController.java
@@ -276,7 +276,7 @@ public class UserAdminMainController extends MainLayoutBasicController implement
 		}
 		return ctrl;
 	}
-	
+
 	private Controller getController(UserRequest ureq, String uobject) {
 		OLATResourceable ores = OresHelper.createOLATResourceableInstance(uobject, 0l);
 		WindowControl bwControl = BusinessControlFactory.getInstance().createBusinessWindowControl(ores, null, getWindowControl());
@@ -291,8 +291,16 @@ public class UserAdminMainController extends MainLayoutBasicController implement
 			case "useradmin": return createUserSearchController(ureq, bwControl);
 			case "admingroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.administrator);
 			case "sysadmingroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.sysadmin);
+			case "principalgroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.principal);
 			case "usermanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.usermanager);
+			case "rolesmanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.rolesmanager);
 			case "groupmanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.groupmanager);
+			case "learnresourcemanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.learnresourcemanager);
+			case "linemanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.linemanager);
+			case "lecturemanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.lecturemanager);
+			case "qualitymanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.qualitymanager);
+			case "curriculummanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.curriculummanager);
+			case "poolmanagergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.poolmanager);
 			case "authorgroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.author);
 			case "usergroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.user);
 			case "anonymousgroup": return createUserSearchController(ureq, bwControl, OrganisationRoles.guest);
@@ -527,7 +535,18 @@ public class UserAdminMainController extends MainLayoutBasicController implement
 		
 		// admin group and user manager group always restricted to admins
 		if (isAdministrator) {
+			appendNode("menu.lecturemanagergroup", "menu.lecturemanagergroup.alt", "lecturemanagergroup", "o_sel_useradmin_lecturemanagergroup", accessNode);
+			appendNode("menu.qualitymanagergroup", "menu.qualitymanagergroup.alt", "qualitymanagergroup", "o_sel_useradmin_qualitymanagergroup", accessNode);
+			appendNode("menu.poolmanagergroup", "menu.poolmanagergroup.alt", "poolmanagergroup", "o_sel_useradmin_poolmanagergroup", accessNode);
+			
 			appendNode("menu.usermanagergroup", "menu.usermanagergroup.alt", "usermanagergroup", "o_sel_useradmin_usermanagergroup", accessNode);
+			appendNode("menu.rolesmanagergroup", "menu.rolesmanagergroup.alt", "rolesmanagergroup", "o_sel_useradmin_rolesmanagergroup", accessNode);
+			appendNode("menu.learnresourcemanagergroup", "menu.learnresourcemanagergroup.alt", "learnresourcemanagergroup", "o_sel_useradmin_learnresourcemanagergroup", accessNode);
+			
+			appendNode("menu.linemanagergroup", "menu.linemanagergroup.alt", "linemanagergroup", "o_sel_useradmin_linemanagergroup", accessNode);
+			
+
+			appendNode("menu.principalgroup", "menu.principalgroup.alt", "principalgroup", "o_sel_useradmin_principalgroup", accessNode);
 			appendNode("menu.admingroup", "menu.admingroup.alt", "admingroup", "o_sel_useradmin_admingroup", accessNode);
 			appendNode("menu.sysadmingroup", "menu.sysadmingroup.alt", "sysadmingroup", "o_sel_useradmin_sysadmingroup", accessNode);
 		}
diff --git a/src/main/java/org/olat/user/ui/admin/_i18n/LocalStrings_de.properties b/src/main/java/org/olat/user/ui/admin/_i18n/LocalStrings_de.properties
index 5b4926b899e..0dbc97a48ad 100644
--- a/src/main/java/org/olat/user/ui/admin/_i18n/LocalStrings_de.properties
+++ b/src/main/java/org/olat/user/ui/admin/_i18n/LocalStrings_de.properties
@@ -27,6 +27,12 @@ menu.groupcoach=Gruppenbetreuer
 menu.groupcoach.alt=Gruppenbetreuer
 menu.groupmanagergroup=Gruppenverwalter
 menu.groupmanagergroup.alt=Verwalter von kurs\u00FCbergreifenden Gruppen verwalten
+menu.learnresourcemanagergroup=$org.olat.admin.user\:role.learnresourcemanager
+menu.learnresourcemanagergroup.alt=$org.olat.admin.user\:role.learnresourcemanager
+menu.lecturemanagergroup=$org.olat.admin.user\:role.lecturemanager
+menu.lecturemanagergroup.alt=$org.olat.admin.user\:role.lecturemanager
+menu.linemanagergroup=$org.olat.admin.user\:role.linemanager
+menu.linemanagergroup.alt=$org.olat.admin.user\:role.linemanager
 menu.logondeniedgroup=Gesperrte Benutzer
 menu.logondeniedgroup.alt=Benutzer, die sich nicht in OpenOLAT einloggen d\u00FCrfen
 menu.menuaccess=Zugang und Rechte
@@ -37,8 +43,16 @@ menu.noauthentication=Fehlende Authentifizierung
 menu.noauthentication.alt=Benutzer, die noch nicht vollst\u00E4ndig angelegt sind (Kein Passwort)
 menu.organisations=Organisationen
 menu.organisations.alt=Organisationen
+menu.poolmanagergroup=$org.olat.admin.user\:role.poolmanager
+menu.poolmanagergroup.alt=$org.olat.admin.user\:role.poolmanager
+menu.principalgroup=$org.olat.admin.user\:role.principal
+menu.principalgroup.alt=$org.olat.admin.user\:role.principal
+menu.qualitymanagergroup=$org.olat.admin.user\:role.qualitymanager
+menu.qualitymanagergroup.alt=$org.olat.admin.user\:role.qualitymanager
 menu.resourceowners=Autoren und Co-Autoren
 menu.resourceowners.alt=Besitzer von Lernressourcen verwalten
+menu.rolesmanagergroup=$org.olat.admin.user\:role.rolesmanager
+menu.rolesmanagergroup.alt=$org.olat.admin.user\:role.rolesmanager
 menu.sysadmingroup=Systemadministratoren
 menu.sysadmingroup.alt=Systemadministratoren verwalten
 menu.ucreate=Benutzer erstellen
diff --git a/src/main/java/org/olat/user/ui/admin/_i18n/LocalStrings_en.properties b/src/main/java/org/olat/user/ui/admin/_i18n/LocalStrings_en.properties
index d73c9d2c1e7..4a933500aea 100644
--- a/src/main/java/org/olat/user/ui/admin/_i18n/LocalStrings_en.properties
+++ b/src/main/java/org/olat/user/ui/admin/_i18n/LocalStrings_en.properties
@@ -27,6 +27,12 @@ menu.groupcoach=Group coach
 menu.groupcoach.alt=Group coach
 menu.groupmanagergroup=Group administrator
 menu.groupmanagergroup.alt=Manage group administrators course-comprehensively
+menu.learnresourcemanagergroup=$org.olat.admin.user\:role.learnresourcemanager
+menu.learnresourcemanagergroup.alt=$org.olat.admin.user\:role.learnresourcemanager
+menu.lecturemanagergroup=$org.olat.admin.user\:role.lecturemanager
+menu.lecturemanagergroup.alt=$org.olat.admin.user\:role.lecturemanager
+menu.linemanagergroup=$org.olat.admin.user\:role.linemanager
+menu.linemanagergroup.alt=$org.olat.admin.user\:role.linemanager
 menu.logondeniedgroup=Blocked users
 menu.logondeniedgroup.alt=Users not allowed to log in into OpenOLAT
 menu.menuaccess=Access and rights
@@ -37,8 +43,16 @@ menu.noauthentication=Authentication missing
 menu.noauthentication.alt=Users that are not correctly set up (no password)
 menu.organisations=Organisations
 menu.organisations.alt=Organisations
+menu.poolmanagergroup=$org.olat.admin.user\:role.poolmanager
+menu.poolmanagergroup.alt=$org.olat.admin.user\:role.poolmanager
+menu.principalgroup=$org.olat.admin.user\:role.principal
+menu.principalgroup.alt=$org.olat.admin.user\:role.principal
+menu.qualitymanagergroup=$org.olat.admin.user\:role.qualitymanager
+menu.qualitymanagergroup.alt=$org.olat.admin.user\:role.qualitymanager
 menu.resourceowners=Authors and co-authors
 menu.resourceowners.alt=Manage all owners of a learning resource
+menu.rolesmanagergroup=$org.olat.admin.user\:role.rolesmanager
+menu.rolesmanagergroup.alt=$org.olat.admin.user\:role.rolesmanager
 menu.sysadmingroup=System administrators
 menu.sysadmingroup.alt=Manage system administrator group
 menu.ucreate=Create user
-- 
GitLab