Authentication

[MrBillMcDonald]

No description provided.

[MrBillMcDonald]

 John,

If I understand correctly the Entitlement Data elements are intended to address #1. EntitlementIdentifier is intended as a "license key" to identify the LMS to the content server to determine if the LMS is authorized to use the content.

#2 is an issue that could addressed by running over SSL. The Session ID could be a "shared secret" to authenticate each request. The actual allocation of session id values is outside of the specification. The LMS must provide it on the launch URL for HTTP based content. SSL will protect the value during transport. However, it would appear in browser address bar and history and could be sent as the http "referer".

As I recall, the reason we left authentication out of the specification is that there are many different approaches. If we were to specify one then all clients and servers would have to support that approach.

Some possible scenarios:

1. Default (same as HACP):

•Student logs on.
•Selects a learning activity to launch.
•LMS generates a session id and launches the content.
•Service calls are "authenticated" by checking the validity of the session id.
•Session id is inactivated when Exit request is received.

1. Same as Authentication #1 but run under SSL.
2. Web Session based.

•Student logs on.
•Selects a learning activity to launch.
•LMS generates a session id and launches the content.
•Service calls are "authenticated" by checking the student's login session information against student information associated with the session id (service will need to support the same session identification mechanism as the LMS uses to maintain student login). Requests with invalid session ids will still be rejected.
•Session id is inactivated when Exit request is received.

Some of the ws-security extensions could be used but they require SOAP 1.2 and need close conformance between client and server.

I'm not enough with oauth. If it involves adding a field to each request for authentication then I don't see a problem with that. I'll try to take a quick look.

---

Mark Schupp - Integrity eLearning