Unable to enter a Division for which I have proper credentials, via the GUI

Question

I have a Division which I am unable to enter, either as a student or as the full site Administrator, from the GUI.
When I log into the main Site page, I see the link for the Division (as I should - I have DOWNLOAD permissions for the Division). However when I click the link (the thumbnail image) I am always, 100% of the time, rejected and sent to the login page. Ignoring that, I still have all of my proper credentials and may continue to freely access other parts of the site.
In the past, I had this exact behavior on (1) a Division "RobotCourses:PSYC" (Psychology), and (2) my main site breadcrumb, which appears at the top of the site page to the right of the "iTunes U" breadcrumb and says "Maiko Covington @ University of Illinois..." For reasons completely unknown to me, this behavior resolved itself yesterday, clicking both of those objects works as expected, although NO one at our site with any edit access did anything on the server.
However, the same behavior has now reappeared, this time on a Division "RobotCourses:CLCV" (Classical Civilizations). Again, I have not done any editing of that Division, nor had anyone logged into it (these Divisions are in a test area where I am developing automation tools).
I am, quite frankly, stumped. But I've done some investigation.
SETUP:
The Division has identity "RobotCourses:CLCV".
This Division contains a single Course with identity "RobotCourses:CLCV:CLCV115:CLCV115All-13564".
Both the Division and the Course are restricted to properly registered academic students. I have developed automation code in a login portal which grants credentials for RobotCourses:CLCV to students registered for courses in the CLCV department (Classical Civilizations) and credentials for RobotCourses:CLCV:CLCV115:CLCV115All-13564 to students registered for CLCV 115 (Classical Civilizations 115 - Mythology of Greece and Rome) specifically.
The Permissions set on RobotCourses:CLCV in particular are:
<Permission>
<Credential>Authenticated@urn:mace:itunesu.com:sites:illinois.edu</Credential>
<Access>No Access</Access>
</Permission>
<Permission>
<Credential>gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV</C redential>
<Access>Download</Access>
</Permission>
The point is to deny access to Authenticated@ (merely authenticated students) and then specifically grant it for people given a "gakusei" credential for RobotCourses:CLCV in particular.
(Note here that "gakusei" is a Japanese word meaning "student," I am using it in my credentials to ensure that my credentials and permissions are not affected by other credentials named "student" set at upper levels and used by some live users of the site, as we do not have a segregated development environment. It is our lowest level of access beyond mere Authenticated@..., designed to give students access to download and "surf to" Divisions and Courses.)
*LOGIN: ISSUING CREDENTIALS:*
The login portal code works successfully, and so when a student "Jane Doe" logs in, she is in fact given appropriate credentials (as she is actually registered for CLCV 115 here at UIUC). From the code generating her login URL, I see:
Issued credentials:
gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV
gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV:CLCV115:CLCV1 15All-13564
gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:STAT
gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:STAT:STAT100:STAT1 00X1-13570
(You can see she is also registered for STAT 100).
With the default login URL thus generated, she is taken to the top level of the Site in iTunes, and in fact sees thumbnail links for both STAT (Statistics) and CLCV (Classical Civilizations). Clicking on STAT takes her to the STAT Division where she can then enter the Course STAT 100 with no problems.
*PROBLEM: CAN'T GET TO CLCV FROM THE MAIN PAGE IN THE GUI*
HOWEVER! Clicking on CLCV brings up the login page. If she ignores the login page, she can still access the rest of the site, including STAT, just fine. Logging in again (reissuing her credentials) does not help the situation.
Note that this is not a problem only for Jane Doe, the same thing happens for anyone in CLCV and in fact happens for me as Administrator of the whole site with full access, even.
*ACCESS DIRECTLY TO THE DIVISION BY URL WORKS*
With a slight modification to the login to allow access directly to the RobotCourses:CLCV Division (by adding the handle of the Division to the end of the location), credentials are issued exactly as before:
Issued credentials:
gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV
gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV:CLCV115:CLCV1 15All-13564
gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:STAT
gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:STAT:STAT100:STAT1 00X1-13570
and she is taken to the Division page, SUCCESSFULLY. So, it seems she actually HAS access, as expected.
*ACCESS CONFIRMED WITH DEBUGGING:*
Writing some code to generate not the actual login URL but rather a link that takes me to an "iTunes U Access Debugging" page for the Division (figured this out by reading some other posts! :)) I am taken to a page with the following:
(at generated URL https://deimos.apple.com/WebObjects/Core.woa/Browse/illinois.edu.1945806043/xxx5 64?credentials=....)
Received
Destination illinois.edu.1945806043
Identity "Jane X Doe" <[email protected]> (jxdoe) [xxxxxxxxx]
Credentials gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV; ​ gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV:CLCV115:CLCV1 15All-13564; ​gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:STAT;​ gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:STAT:STAT100:STAT1 00X1-13570
Time 1236877947
Signature 42ccef92a3298684a7a09eed45adb6b788a700c01645b8b423d33ace120650b0
Analysis
The destination string is valid and the corresponding destination item was found.
The identity string is valid and provides the following information:
Display Name Jane X Doe
Email Address [email protected]
Username jxdoe
User Identifier xxxxxxxxx
The credential string is valid and contains the following 4 recognized credentials:
1. gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV
2. gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:CLCV:CLCV115:CLCV1 15All-13564
3. gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:STAT
4. gakusei@urn:mace:itunesu.com:sites:illinois.edu:RobotCourses:STAT:STAT100:STAT1 00X1-13570
The time string is valid and corresponds to 2009-03-12 17:12:27Z.
The signature string is valid.
Access
Because the received signature and time were valid, the received identity and credentials were accepted by iTunes U.
In addition, the following 2 credentials were automatically added by iTunes U:
1. All@urn:mace:itunesu.com:sites:illinois.edu
2. Authenticated@urn:mace:itunesu.com:sites:illinois.edu
With these credentials, you have browsing and downloading access to the requested destination.
(In case you think to check the sums, be aware I've actually changed the student's name for this example.)
So, as expected, I have access, in fact the student DOES have access, visiting the Division page directly (specifiying its handle as part of the desired location).
*IT'S ONLY CLICKING THE THUMBNAIL ON THE MAIN PAGE THAT BREAKS*
Because the problem is only apparent when clicking the icon for the Division on the main Site page, I have no way (that I know of) to get any information about precisely WHAT is going on, what possibly differs in the GUI-click situation from the "generate me a URL that takes me right there" situation.
At that point I'm fully in the GUI, I'm not sending anything via web services, so I have no idea how I can proceed to debug this from here.
I'm also quite confused at the sudden appearance of this behavior, and the disappearance of this behavior from RobotCourses:PYSC, another Division that was broken in this same way all last week but which magically resumed allowing me access yesterday.
Any suggestions, hints, or advice would be very welcome. Has anyone else even seen behavior similar to this?
Thanks for any information you might have.

Answer 1

Maiko,
I'm confess I'm still trying to get a handle on your problem. You do a fantastic job of describing it ... but I'm just trying to picture it accurately in my head.
I think, were I in your shoes, I'd begin by looking at what the debug page has to say for the specific destination in which you're interested in fixing. In other words, I'm not clear on where, exactly, this destination points ...
Destination illinois.edu.1945806043
Is that your site, or the division within your site that you want to fix? "Normally", you do not need to specify a site handle to get to your site within your transfer CGI ... if you say "uillinois.edu", it's enough to transfer your users to iTunes U ... but every site still has a handle, and you could, if you wanted to, actually specify it in your transfer CGI. For example, this:
Destination uic.edu.1139051993
is for my entire site ... it's my site handle. Whereas this:
Destination uic.edu.1991288441
is for a division within my site ... but it's impossible to tell the difference between "site" and "division" from just the handle (I mean, if I didn't say "this is a site" and "this is a division", there'd be no way for you to know). So when I look at your creds and permissions on your debug page, I can't quite tell if they give you download access for your site, or for the specific division you want to fix. If you could open the debug page with your division as destination (or confirm that that's what we're looking at), it'd rule out some things.