PHP iTunes U authentication issue

Question

I’ve been working with integrating iTunes U with Moodle. On the Moodle site there is an iTunes U block available for integrating the 2 systems. I’ve been trying to use this and I am able to get to the iTunes U site from Moodle, but I am not being signed into the site as an authenticated user. I can’t seem to figure out why. I was however able to authenticate with a Perl script.
The Moodle block has a Setting section where I fill in all my site specific information such as the Shared Secret. This is definitely working fine as I am able to get to my site without issue. But, the passing of the credentials and identity do not seem to be working because I am not being signed in as an authenticated user.
Right now my Credentials are very basic – formatted just like the sample ones – such as:
Adminstrator@urn:mace:itunesu.com:sites:example.edu (where example.edu is my school’s name).
Can anyone review the files below and shed some light on why I am not getting authenticated?
Thanks.
Itunes_redirect.php
<?php // $Id: itunesu_redirect.php,v 1.1 2008/06/06 19:08:49 mchurch Exp $
require_once('../../config.php');
global $USER, $CFG;
require_once($CFG->dirroot.'/lib/weblib.php');
require_once($CFG->dirroot.'/lib/moodlelib.php');
require_once($CFG->dirroot.'/blocks/itunesu/itunes.php');
if (!isloggedin()) {
print_error('sessionerroruser', '' , $CFG->wwwroot);
$destination = required_param('destination', SITEID, PARAM_INT); // iTunes U destination
$name = fullname($USER);
/* Create instance of the itunes class and initalized instance variables */
$itunes = new itunes();
$itunes->setUser($name, $USER->email, $USER->username, $USER->id);
/* more work needs to be done with determining credentials */
$itunes->setAdminCredential($CFG->blockitunesuadmincred);
$itunes->setInstructorCredential($CFG->blockitunesuinsturctcred);
$itunes->addAdminCredentials();
$itunes->setSiteURL($CFG->blockitunesuurl);
$itunes->setSharedSecret($CFG->blockitunesusharedsecret);
$itunes->setDestination($destination);
$itunes->invokeAction();
?>
Itunes.php file:
<?php
# iTunes Authentication Class
# Written by Aaron Axelsen - [email protected]
# University of Wisconsin - Whitewater
# Edited by Ryan Pharis, [email protected] - Texas Tech University
# Class based on the Apple provided ITunesU.pl
# example script.
# REQUIREMENTS:
# PHP:
# - tested with PHP 5.2
# - make sure hash_hmac() works - <a class="jive-link-external-small" href="http://us2.php.net/manual/en/function.hash-hmac.php">http://us2.php.net/m anual/en/function.hash-hmac.php</a>
# - php curl support
#Example Usage:
<?php
include('itunes.php');
$itunes = new itunes();
// show loading screen while processing request
//include(ROOTURL.'/includes/pages/itunesload.php');
// Set User
$itunes->setUser("Jane Doe", "[email protected]", "jdoe", "42");
// Set Admin Permissions
$itunes->addAdminCredentials();
// Set Instructor Permission
//$itunes->addInstructorCredential('uniquename_fromitunes');
// Set Student Credential
//$itunes->addStudentCredential('uniquename_fromitunes');
// Set Handle
// This will direct login to the specific page
#$itunes->setHandle('');
// iTunes U Auth Debugging
$itunes->setDebug(true);
$itunes->invokeAction();
?>
class itunes {
// Oktech - add
var $authtoken;
var $siteURL;
var $debugSuffix;
var $sharedSecret;
var $administratorCredential;
var $instructorCredential;
var $studentCredential;
var $urlonly;
var $urlcredentials;
var $destination;
// Oktech
* Create iTunes Object
public function __construct() {
$this->setDebug(false);
$this->siteURL = 'https://deimos.apple.com/WebObjects/Core.woa/Browse/example.edu';
$this->directSiteURL = 'https://www.example.edu/cgi-bin/itunesu';
$this->debugSuffix = '/abc1234';
$this->sharedSecret = 'STRINGOFTHIRTYTWOLETTERSORDIGITS';
$this->administratorCredential = 'Administrator@urn:mace:itunesu.com:sites:example.edu';
$this->studentCredential = 'Student@urn:mace:itunesu.com:sites:example.edu';
$this->instructorCredential = 'Instructor@urn:mace:itunesu.com:sites:example.edu';
$this->credentials = array();
// Set domain
$this->setDomain();
// Oktech add
public function getInstructorCredential() {
return $this->instructorCredential;
public function setInstructorCredential($credential) {
$this->instructorCredential = $credential;
public function getStudentCredential() {
return $this->studentCredential;
public function setStudentCredential($credential) {
$this->studentCredential = $credential;
public function getAdminCredential() {
return $this->administratorCredential;
public function setAdminCredential($credential) {
$this->administratorCredential = $credential;
public function getSharedSecret() {
return $this->sharedSecret;
public function setSharedSecret($sharedsecret) {
$this->sharedSecret = $sharedsecret;
public function getAuthToken() {
return $this->authtoken;
public function setAuthToken($authtoken) {
$this->authtoken = $authtoken;
public function getDebugSuffix() {
return $this->directSiteURL;
public function setDebugSuffix($debugsuffix) {
$this->directSiteURL = $debugsuffix;
public function getSiteURL() {
return $this->siteURL;
public function setSiteURL($siteurl) {
$this->siteURL = $siteurl;
* Extract the URL from the return html
* block from the iTunes U server. Replace
* Apple's itmss tag with https
private function extractURL($htmlblock) {
$remainder = '';
$pos = 0;
$result = '';
$remainder = strstr($htmlblock, "_open('i");
$remainder = substr_replace($remainder, '', 0, 7);
$remainder = substr_replace($remainder, 'https', 0, 5);
$pos = strpos($remainder, "');");
$result = substr_replace($remainder, '', $pos);
$this->urlonly = $result;
public function getExtractedURL() {
return $this->urlonly;
* Extract the credentials part from the returned URL from
* the iTunes U server
public function extractURLCredentials($url) {
$result = '';
$pos = 0;
$remainder = strstr($url, "gtcc.edu?");
$remainder = substr_replace($remainder, '', 0, 9);
$this->urlcredentials = $remainder;
public function getExtractedURLCredentials() {
return $this->urlcredentials;
public function setDestination($destination) {
$this->destination = $destination;
public function getDestination() {
return $this->destination;
// Oktech add
* Add's admin credentials for a given user
public function addAdminCredentials() {
$this->addCredentials($this->administratorCredential);
* Add Student Credential for a given course
public function addStudentCredential($unique) {
$this->addCredentials($this->studentCredential.":$unique");
* Add Instructor Credential for a given course
public function addInstructorCredential($unique) {
$this->addCredentials($this->instructorCredential.":$unique");
* Set User Information
public function setUser($name, $email, $netid, $userid) {
$this->name = $name;
$this->email = $email;
$this->netid = $netid;
$this->userid = $userid;
return true;
* Set the Domain
* Takes the siteURL and splits off the destination, hostname and action path.
private function setDomain() {
$tmpArray = split("/",$this->siteURL);
$this->siteDomain = $tmpArray[sizeof($tmpArray)-1];
$this->actionPath = preg_replace("/https:\/\/(.+?)\/.*/",'$1',$this->siteURL);
$pattern = "/https:\/\/".$this->actionPath."(.*)/";
$this->hostName = preg_replace($pattern,'$1',$this->siteURL);
$this->destination = $this->siteDomain;
return true;
* Set the Handle
* Takes the handle as input and forms the get upload url string
* This is needed for using the API to upload files directly to iTunes U
public function setHandle($handleIn) {
$this->handle = $handleIn;
$this->getUploadUrl = "http://deimos.apple.com/WebObjects/Core.woa/API/GetUploadURL/".$this->siteDoma in.'.'.$this->handle;
return true;
* Get Identity String
* Combine user identity information into an appropriately formatted string.
* take the arguments passed into the function copy them to variables
private function getIdentityString() {
# wrap the elements into the required delimiters.
return sprintf('"%s" <%s> (%s) [%s]', $this->name, $this->email, $this->netid, $this->userid);
* Add Credentials to Array
* Allows to push multiple credientials for a user onto the array
public function addCredentials($credentials) {
array_push($this->credentials,$credentials);
return true;
* Get Credentials String
* this is equivalent to join(';', @_); this function is present
* for consistency with the Java example.
* concatenates all the passed in credentials into a string
* with a semicolon delimiting the credentials in the string.
private function getCredentialsString() {
#make sure that at least one credential is passed in
if (sizeof($this->credentials) < 1)
return false;
return implode(";",$this->credentials);
private function getAuthorizationToken() {
# Create a buffer with which to generate the authorization token.
$buffer = "";
# create the POST Content and sign it
$buffer .= "credentials=" . urlencode($this->getCredentialsString());
$buffer .= "&identity=" . urlencode($this->identity);
$buffer .= "&time=" . urlencode(mktime());
# returns a signed message that is sent to the server
$signature = hash_hmac('SHA256', $buffer, $this->sharedSecret);
# append the signature to the POST content
return sprintf("%s&signature=%s", $buffer, $signature);
* Invoke Action
* Send a request to iTunes U and record the response.
* Net:HTTPS is used to get better control of the encoding of the POST data
* as HTTP::Request::Common does not encode parentheses and Java's URLEncoder
* does.
public function invokeAction() {
$this->identity = $this->getIdentityString();
$this->token = $this->getAuthorizationToken();
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $this->generateURL() . '?' . $this->token);
//curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
// Oktech - change
$this->authtoken = curl_exec($ch);
curl_close($ch);
/* Start a new sesstion and send a request for specific content with the appropriate credentials */
$ch = curl_init();
$this->extractURL($this->authtoken);
$this->extractURLCredentials($this->urlonly);
curl_setopt($ch, CURLOPT_URL, $this->siteURL . '.' . $this->destination . '?' . $this->urlcredentials);
//curl_setopt($ch, CURLOPT_POST, 1);
curl_exec($ch);
curl_close($ch);
// Oktech
* Auth and Upload File to iTunes U
* This method is said to not be as heavily tested by apple, so you may have
* unexpected results.
* $fileIn - full system path to the file you desire to upload
public function uploadFile($fileIn) {
$this->identity = $this->getIdentityString();
$this->token = $this->getAuthorizationToken();
// Escape the filename
$f = escapeshellcmd($fileIn);
// Contact Apple and Get the Upload URL
$upUrl = curl_init($this->getUploadUrl.'?'.$this->token);
curl_setopt($upUrl, CURLOPT_RETURNTRANSFER, true);
$uploadURL = curl_exec($upUrl);
$error = curl_error($upUrl);
$http_code = curl_getinfo($upUrl ,CURLINFOHTTPCODE);
curl_close($upUrl);
print $http_code;
print "
$uploadURL";
if ($error) {
print "
$error";
# Currently not working using php/curl functions. For now, we are just going to echo a system command .. see below
#// Push out the designated file to iTunes U
#// Build Post Fields
#$postfields = array("file" => "@$fileIn");
#$pushUrl = curl_init($uploadURL);
#curl_setopt($pushUrl, CURLOPT_FAILONERROR, 1);
#curl_setopt($pushUrl, CURLOPT_FOLLOWLOCATION, 1);// allow redirects
#curl_setopt($pushUrl, CURLOPT_VERBOSE, 1);
#curl_setopt($pushUrl, CURLOPT_RETURNTRANSFER, true);
#curl_setopt($pushUrl, CURLOPT_POST, true);
#curl_setopt($pushUrl, CURLOPT_POSTFILEDS, $postfields);
#$output = curl_exec($pushUrl);
#$error = curl_error($pushUrl);
#$http_code = curl_getinfo($pushUrl, CURLINFOHTTPCODE);
#curl_close($pushUrl);
#print "
#print $http_code;
#print "
$output";
#if ($error) {
# print "
$error";
// Set the php time limit higher so it doesnt time out.
settimelimit(1200);
// System command to initiate curl and upload the file. (Temp until I figure out the php curl commands to do it)
$command = "curl -S -F file=@$f $uploadURL";
echo "
echo $command;
exec($command, $result, $error);
if ($error) {
echo "I'm busted";
} else {
print_r($result);
echo $command;
* Set Debugging
* Enable/Disable debugging of iTunes U Authentication
public function setDebug($bool) {
if ($bool) {
$this->debug = true;
} else {
$this->debug = false;
return true;
* Generate Site URL
* Append debug suffix to end of url if debugging is enabled
private function generateURL() {
if ($this->debug) {
return $this->siteURL.$this->debugSuffix;
} elseif ($this->isHandleSet()) {
return $this->directSiteURL.'.'.$this->handle;
} else {
return $this->siteURL;
* Check to see if the handle is set
private function isHandleSet() {
if (isset($this->handle))
return true;
else
return false;
?>

Answer 1

Janet ... hmmm ... I suppose it could also be "Jane T. Smith" ... ah well, anywho,
One thing to understand when it comes to credentialling is that, even if your transfer CGI (Moodle block) doesn't work ... if you redirect someone to your iTunes U site, that person will -always- carry two credentials ... "Unauthenticated" and "All". You do not have to assign the credentials ... they are automatic.
Put it this way, if I direct you to my site:
https://deimos.apple.com/WebObjects/Core.woa/Browse/uic.edu
if you click on that link, authentication or no, Apple will give you the "Unauthenticated" and "All" credentials. Anywhere on my site where those creds are good, you'll have access.
Hmmm ... maybe I can rephrase it this way ... there are four credentials that are a part of every site ...
All ... everyone who accesses your site gets this cred ... everyone.
Authenticated ... if you pass a valid iTunes U URL request for a user, he/she will get this cred.
Unauthenticated ... this cred is given whenever someone gets to your site -without- a tokenized (credentials, identity, time, signature) URL request. For example, if someone uses your site base URL without any modification.
Administrator ... this cred has total access to a site.
So if you access your site using your admin cred, you'll actually carry three creds ... "Administrator" (of course), but also "All" and "Authenticated".
So why this long discussion of creds? Well, if you're getting in with the "Unauthenticated" credential, it's a sure sign your transfer CGI (Moodle thingy) isn't working ... at all. It's not that you can't pass the admin cred ... or identity info ... you're not passing any info. And because you're not passing any info, iTunes U does the default thing ... give you "All" and "Unauthenticated" access.