Integrating iTunes U with Authentication at Lafayette College

Question

A couple of folks have asked how we got iTunes U authentication working at Lafayette. Here's a quick run down of how we did it; if you have any questions about the specifics feel free to e-mail me at [email protected].
The quest for authentication started with reading Chapters 1 and 2 of the iTunes U documentation and downloading the sample connection scripts. This yielded a few observations: 1) we could use our department's preferred programming language, Perl, to build the authentication process 2) Apple designed iTunes U's user/roles framework on the assumptions that folks would use the eduCourse specification and that the college's campus authentication system would include role and course information.
Our campus LDAP does not store course information and has limited information about roles. Because of this, we decided to implement a two-part authentication -- first we'd authenticate against our campus LDAP directory, then we would check the user against eduCourse-based role and course information stored in a small MySQL database. With this information in hand, the Perl script then builds the connection script with all of the role/user/unique identifier information.
We are looking at extending campus LDAP to include the needed information, but in the short term this allows us to manage access to iTunes U.
The biggest headache we encountered in setting up the authenication process involved time. After many trials and too many errors, we determined that our web server's clock was out of sync with Apple's by 110 seconds. Since we only had 90 seconds to authenticate, that meant that the handshake couldn't be concluded. We solved the problem by making sure our server's clock is updated hourly against an NTP time server.
The Process
1. A private/public login page was created on our secondary web server, ww2.lafayette.edu. This login page accepts the user's Network ID and password and passes those values on to a Perl script. It also includes a "public link" that goes to the same Perl script
2. The Perl script checks to see if the Network ID and password.
3. If the Network ID and password are given, the credentials are checked against the campus LDAP server using Perl's LDAP functions. If the user authenticates, then a query is run against a MySQL database to determine what access that user should be granted based on roles (Instructor, Learner, Administrator) and courses (a list of unique identifiers for courses) based on the eduCourse specification.
4. If the public link is clicked, then the user is connected directly to iTunes U with no credentials, which lands them on the public welcome page.
Useful Resources
* Flowchart of Lafayette College's iTunes U Authentication Scheme:
http://ww2.lafayette.edu/~its/downloads/pdfs/public/LafayetteItunesAuth.pdf
* LDAP representations of eduCourse attributes and an auxiliary object class
http://middleware.internet2.edu/courseid/docs/internet2-mace-dir-courseid-educou rse-ldap-200507.html
* eduCourse Data Model
http://middleware.internet2.edu/courseid/docs/internet2-mace-dir-courseID-eduCou rse-200507.html
I hope this helps -- good luck with your configuration!

Answer 1

to quote Gaff from Blade Runner " You've done a man's job , sir"
Great work Ken your team has paved the way for us.