ITunes U and Central Authentication Service

Question

Summary:
We are testing RSS URLs that are behind CAS. iTunes is have a problem when subscribing to a podcast with these RSS URLs.
Description:
- RSS URL is put in browser, the browser is redirected to our CAS server where the user is challenged for their username / passphrase. If authenticated, they are directed back to URL with a CAS ticket.
-RSS URL before: http://someurl.com/feed.xml
-RSS URL after: http://someurl.com/feed.xml&casticket=somecaseticketid
The W3C Feed Validation Service sees the URL as:
Redirecting to CAS server, so it believes the RSS URL is not a valid RSS URL. The feed is valid without the CAS redirect.
Assumption: The RSS URL with CAS ticket can not be passed from browser to iTunes while maintaining the validity of the CAS ticket. (effectively copying a RSS URL with CAS ticket from Safari and pasting in Firefox).
Question: How can we protect a podcast RSS URL behind CAS and allow a subscription to the podcast URL in iTunes?

Answer 1

MJ,
I'm pretty sure my picture of what you're trying to do is too fuzzy for me to offer you good advice .... I have a couple of ideas, but I'm not sure if they apply to you mostly because I don't know if I've got a good picture of what you're trying to do.
I think my big hangup is that you seem (big emphasis on "seem") to be conflating what are two different RSS feeds into the same feed.
In iTunes U, there are basically two types of RSS feeds. First, there is the RSS feed that iTunes U itself uses to get to your content (if you're locally hosting content). This is the feed you tell iTunes U about when you create a feed group (that is, when you create a new tab in a course, and say that it's a "feed" tab…as opposed to a "simple" or "smart" tab). You can access this feed anonymously, or with user credentials (you can use HTTP basic authentication or have Apple SHA256 any feed request)…but you don't access this feed for individual users…you sort of access the feed generically, for all users of your site (iTunes will show/hide the feed on a per-user basis given the creds the user brings to an iTunes U session). Then there is the second kind of feed…the feeds iTunes U shows to your users when they're in iTunes U (the feeds iTunes U makes available to users when they click on the "Subscribe" button in courses). The URLs for these two kinds of feeds are quite different.
Your CAS server sounds as though it acts as your iTunes U portal server (or is a component of it). As such, it must translate a user/password into an iTunes U URL with credentials (that is, it must point to the -second- kind of feed I described in the paragraph above). An iTunes U portal server is basically a mapping tool…it maps users/passwords into iTunes U URL requests. These requests contain a set of credentials and a specific destination within iTunes U, not any sort of local server…even for feed groups.
Not sure this is helpful because I could really be misreading your problem…but I thought I'd take a whack at it.