Windows server: External AICC Package cannot get user information

Windows server: External AICC Package cannot get user information

by John Cusimano -
Number of replies: 13

Hello,

I have Moodle 2.2 and when we try to launch an AICC URL or downloaded AICC, the external LMS cannot receive the user credentials. Moodle 2.2 supports external AICC/HCAP and the following settings are checked off in Plugins->Activitie Modules-> SCORM- yet there is no explanation as to why this is not working:

Enable external AICC HACP

Enable external AICC URL

Any help would really be appreciated,

Thank you,

John

Average of ratings: -
In reply to John Cusimano

Re: Windows server: External AICC Package cannot get user information

by Matteo Scaramuccia -

Hi John,
can you elaborate a bit more your setup?

Using "External AICC HACP" means "let Moodle play&track AICC content hosted outside the Moodle instance" by means of publishing in Moodle a special package containing just the descriptor files where the .au file makes usage of absolute URLs pointing to each external AICC HACP-tracked content (AU = Assignable Unit): no authorization process is performed by Moodle against the host on accessing such hosted content.

HTH,
Matteo

P.S.: this thread should be moved under Using Moodle ► Moodle core ► SCORM Module.

Average of ratings: -
In reply to Matteo Scaramuccia

Re: Windows server: External AICC Package cannot get user information

by John Cusimano -
Hello Mateo, Thank you for your response! Here is some more information on our setup: Moodle version: 2.2.2 OS: Windows Sever 2008 R2 PHP: 5.10 DB: SQL Server 2008 R2 IIS 7.5 Here is everything we've done so far: We load the aicc package from the vendor by selecting Activities->SCORM. We launch the package and it goes out to the vendor URL in the player frame. Immediately after it says 'activity loading...' We receive the error that the vendor site could not retrieve user information from the host LMS site with URL: https://ourmoodlesite/mod/scrorm/aicc.php. We have also tried to load a test aicc zip from the Moodle forums, this page states the same error- that it cannot retrieve the username (firstname and last name) from our Moodle. The end result of this is that the content from the vendor site never loads on our site. We use NTLM SSO on the site and the site is also published on the internet. Our users authenticate to the portal externally with ISA. We have also tried this with a direct aicc URL and we get the same results. We have tested this on windows and Linux with. 2.2 and get the same results Thank you for your help. I will try to move the thread when I return to the office. John
Average of ratings: -
In reply to John Cusimano

Re: Windows server: External AICC Package cannot get user information

by Matteo Scaramuccia -

Hi John,
let me try to recap:

  1. Your Moodle is running under a WISP (Windows, IIS, SQL Server, PHP) stack
  2. The vendor gives you something to publish into Moodle
  3. Whenever a user attempt to that Moodle AICC Activity, the vendor site - where the content is hosted - claims on the inability to get information from AICC HACP tracking mechanism, regardless your setting about "Enable external AICC HACP"
  4. Your Moodle is fully running under NTLM SSO
  5. Hosting a content, out of Moodle, by yourself gives the same results

If my recap represents the picture, I guess you have enabled the NTLM auth negotiation for all the Moodle site: you need to add an exception to allow both the NTLM handshaking (WIA) and anonymous access (file permission included!) for mod/scorm/aicc.php: Moodle will always check the user authentication on "your" behalf, if required.

Indeed in your scenario, playing with the "Enable external AICC HACP" setting will give you the possibility to let Moodle select how it will authorize the access to the AICC URL:

  • default setup: it will require a user to be logged in, in your case a valid user session built over a NTLM SSO integration
  • External AICC HACP setup: it will create an AICC-related session regardless forcing the user being logged to access that page (please, note that a valid Moodle user session is required but in this case the checks are performed in a different way). The external vendor will be able to contact the AICC tracking page (aicc.php) and their content will happily talk with Moodle via HACP mechanisms.

Suggestion: for performance reasons, you should disabled WIA anywhere within the Moodle site except for auth/ldap/ntlmsso_magic.php. This will allow IIS to perform the (slow) NTLM handshake when just required.

HTH,
Matteo

Average of ratings: -
In reply to Matteo Scaramuccia

Re: Windows server: External AICC Package cannot get user information

by John Cusimano -

Hello Matteo,

Your recap is exactly right; I have a few questions though,

1. Where does the anonymous access need to be configured, can it be configured just for a single object /mod/scorm/aicc.php in IIS?

2. Is there a setting in Moodle that also needs to be enabled to allow anonymous in addition to NTLM?, e.g the 'No authentication' option.

3. Is there any special option I need to set to make sure it generates a user session?

4. Being that ISA is involved externally, does there need to be a rule created in ISA to bypass auth externally for the aicc.php page as well? 

 

Thank you for all your help,

John

 

Average of ratings: -
In reply to John Cusimano

Re: Windows server: External AICC Package cannot get user information

by John Cusimano -

Hi Matteo,

I just wanted to add that I added anonymous login to the security on the aicc.php file and tried again- it still didn't work. I received the same error related to user information.

 

John

 

Average of ratings: -
In reply to John Cusimano

Re: Windows server: External AICC Package cannot get user information

by Matteo Scaramuccia -

Hi John,
I've just realized that I missed that ISA is performing the NTLM authentication too.

Here are my replies:

  1. Yes, you need at least to allow anonymous access to mod/scorm/aicc.php. Removing it everywhere but auth/ldap/ntlmsso_magic.php as per my suggestion will improve local IIS performances, regardless ISA setting about NTLM
  2. Yes, you can disable (click on the "eye") all the auth plugin but ldap and manual
  3. No, a Moodle user session is generated by Moodle itself when it requires to verify the authentication and the authorization. Flagging "Enable external AICC HACP" is required to allow external calls to the AICC URL
  4. Yes, you need to allow anonymous access to the whole chain in front of the AICC URL

HTH,
Matteo

Average of ratings: -
In reply to Matteo Scaramuccia

Re: Windows server: External AICC Package cannot get user information

by John Cusimano -

Hello Matteo,

Thanks again. I have enabled anonymous at the mod folder all the way down and it doesn't seem to help. Please look at the attached and let me know if it looks correct? Any other suggestions?

John

Average of ratings: -
In reply to John Cusimano

Re: Windows server: External AICC Package cannot get user information

by Matteo Scaramuccia -

Hi John,
that is not the expected behaviour, at least by me wink: are your sure that both ISA and file system allow anonymous user too?

To see if kind of NTLM handshake is still working on AICC URL you can install, locally to your PC, Fiddler, press F12 just before entering the course, attend the course, press F12 and look at the captured traffic to see how the communication flows, NTLM authentication included.

Matteo

Average of ratings: -
In reply to Matteo Scaramuccia

Re: Windows server: External AICC Package cannot get user information

by John Cusimano -

Hi Matteo,

We have not allowed anonymous yet on ISA. The really interesting thing is that we installed Moodle on a machine today off our Network. This machine has direct access to the internet- without a proxy, firewall or ISA- yet we still could not get this to work! The Moodle site was not even configured with NTLM- only manual accounts, and was still not able to send user info to either one of the AICC sites. I am beginning to think that either something is not enabled that needs to be somewhere else in Moodle, or Moodle 2.2.2 does not fully support AICC communication. What is your setup, do you use Moodle 2.2, do you have Windows etc- Do you have this working correctly in your environment? Can you successfully launch the following URL and have the external site get the first name and last name?

https://secure.testcraft.com/dev7/Assess.aspx?aid=MOODLE-AICC-01&apass=PASSWORD123

John 

Average of ratings: -
In reply to John Cusimano

Re: Windows server: External AICC Package cannot get user information

by John Cusimano -

Hello Matteo,

I was just wondering, is it possible I am not allowing anonymous properly on the page? Does the screen above you look correct? I went directly to IIS for the mod folder enabled Anonymous and also put in Anonymous Logon Windows folder propery permission?

Thank you very much again, for all your help,

John

Average of ratings: -
In reply to John Cusimano

Re: Windows server: External AICC Package cannot get user information

by Matteo Scaramuccia -

Hi John,
unfortunately I do not have a Moodle instance running on a Windows machine right now and do not have, right now, a test machine exposed to the Internet (running VMs in my LAN) to allow your content vendor to ping me back using the AICC URL via HTTP POST - that's the HTTP AICC CMI Protocol (HACP).

BTW:

  1. double check if the IUSR account can read Moodle files starting from Moodle wwwroot folder and modify starting from the Moodle dataroot folder i.e. a normal Moodle setup on Windows;
  2. test the AICC package I've attached here: it wraps your URL in a full AICC package. Locally tested on a Moodle 2.2.5+ (Build: 20121018) instance running on a LAMP stack based on CentOS 5/PHP 5.3.8 with your content vendor warning about "This assessment requires AICC integration. Communication to your LMS (or AICC) server has failed. You must sign into this assessment through your LMS." due, here, to the inability - I'm using a private address - to POST back to me;
  3. while testing (2), give Fiddler a try: it will show you all the traffic going back and forth from your PC and you'll be able to see if the content vendor is POSTing back to your AICC URL asking - CMI is binded to a plain text protocol quite human readable - for the tracking data and your Moodle is replying according with that request. The communication with the content vendor will start just after Fiddler will show an HTTP GET to /path/to/your/moodle-22/mod/scorm/loadSCO.php?a=<activity_id>&scoid=<sco_id>&currentorg=MDL_P214527&attempt=1 which will load the content from the external vendor passing back some required AICC informations via HTTP GET => https://secure.testcraft.com/dev7/Assess.aspx?aid=MOODLE-AICC-01&apass=PASSWORD123&aicc_sid=<external token, e.g.: 7Gk1nmbSh8RNuwrxD0jY>&aicc_url=http://hostname/path/to/your/moodle-22/mod/scorm/aicc.php

If your test machine is public (and it should be otherwise the external content vendor will never ping you back wink) you can PM me the credentials of a student account and I'll test it in the week-end.

HTH,
Matteo

Average of ratings: -
In reply to Matteo Scaramuccia

Re: Windows server: External AICC Package cannot get user information

by John Cusimano -

Hello Matteo,

We were able to resolve this issue by your suggestion in the last line of your last reply. The thing that we were missing is that the URL really needs to be directly exposed to the vendor. In our case what eventually needed to be done was to create a firewall rule that allowed NAT from the vendor to the return URL. Thank you for all of your help in this matter.

I really wonder though how other companies are using AICC with multiple vendors? These days I am sure that no one is opening the Moodle return URL to the whole internet. In which case, it means a lot of firewall rules or port forwarding exceptions etc. If someone were to test this with even a DSL machine it wouldn't work- as many DSL and other providers nowadays have firewalls built in to all the devices.

It is great to know that the version we are using fully supports this technology. It was a real learning curve for me setting it up the first time, since we have only used SCORM up to this point. I learned a lot about the whole AICC technology this week, and a lot from you, thank you!

Take care,
John

Average of ratings: -
In reply to John Cusimano

Re: Windows server: External AICC Package cannot get user information

by Matteo Scaramuccia -

Hi Martin,
glad to read that we've finally found the root of your issue wink.

You need to know that SCORM (1.2) - which is an application profile i.e. a collection of standards plus best practices - tooks many parts of the work done by the AICC Group especially for the tracking both data & mechanism - which gives vendors the ability to apply their tracking logics thanks to the talking with the LMS "just" using Standards and not a Vendor locked-in solution - dropping just the HACP part.

What makes the difference between the two tracking mechanisms is HACP, an HTTP (POST) based tracking protocol, while SCORM relies on a Run Time Environment (RTE) based on an ECMA Script based API implementation. Vendors who don't want to distribute their content in a self-contained learning package (almost a requirement for SCORM) need to use AICC and HACP to allow external tracking to let their package work out of the box. SCORM RTE technology simply fails when the content is hosted in a different domain - compared to the one of the LMS - due to the so called SCORM cross domain (security, from a browser POV) issue unless IT or LMS takes care of that content configuration with some extra effort in finding a "working configuration" for the tracking (proxy is the key, at system or LMS level).

That being said, it depends also on the security a Company is used to apply in deploying their applications: here, in case of more vendors in the future, you can trust Moodle to expose mod/scorm/aicc.php to the internet, even if you have "opened" it by enabling External AICC HACP.

Matteo

P.S.: if this post and/or the previous ones has/have been useful please rate it/them smile. TIA!

Average of ratings: -