![](bg9.png)
in the iTEC Cloud. The widgets also allow an au-
thorised user to register a backend service provider
and assign authorisation rules to that service provider,
thus providing a central place to manage all authori-
sation at the iTEC components level. This allows for
a more consistent and secure approach.
5.5 Implementing Widgets and Services
Integrating a new service into UMAC is a very simple
process that consists of instantiating the UMAC filter
in front of the new service. As stated above, the fil-
ter takes the form of a Java servlet, that intercepts all
service requests, authenticates them and checks au-
thorisation together with the central policy. A map-
ping between the centrally-managed iTEC roles and
the service-specific roles is defined and translated into
the Shire rules.
Widgets access services through the XMLHttpRe-
quest API that allows to connect to remote sites and
services. To make the integration with UMAC as easy
as possible for widget developer, calls to services are
wrapped through calls of the UMAC library that hide
the logic of the underlying protocols. From the wid-
get perspective, invoking a service is simply a matter
of issuing a request to the service. Authentication and
token issuance is handled under the control of the li-
brary.
6 CONCLUSION & FUTURE
WORK
In this paper, we described a model and its imple-
mentation that supports centralised authentication and
authorisation in a loosely-coupled multi-layered web
application in the eLearning area. The model is open
to third-party authenticators, following the conclusion
of a survey run among potential users of the platform.
Although the individual components of the approach
themselves are not particularly innovative, yet state-
of-the-art, we advocate that the integration approach
we propose, that takes into account requirements and
behaviours of end-users, and the complexity of the en-
vironment to which it applies constitute the core of the
research. It could easily be transposed to other similar
environments.
The whole iTEC ecosystem has been used through
various cycles of piloting, involving over 2,000 class-
rooms across 19 European countries, and the UMAC
component, although almost invisible to the vast ma-
jority of users, did work properly, securing the ser-
vices from 4 main providers access through a wide
variety of widgets.
In the future, we intend to work on a stronger and
easier integration between shells and UMAC compo-
nents, which would allow further customisation of the
shell based on information received from the UMAC
system. We will explore the IMS Learning Tools In-
teroperability specifications(Wilson et al., 2011)
12
as
it seems to be a potential candidate for supporting
tools integration.
A scope should be added to tokens, to reduce the
granularity of authorisation rules and limit the poten-
tial impact of token interception, and client authenti-
cation should be added to the protocol to ensure that
only authenticated clients can obtain access tokens
from UMAC server.
REFERENCES
Aghaee, S. and Pautasso, C. (2012). An evaluation of
mashup tools based on support for heterogeneous
mashup components. In Harth, A. and Koch, N.,
editors, Current Trends in Web Engineering, volume
7059 of Lecture Notes in Computer Science, pages 1–
12. Springer Berlin Heidelberg.
Colin, J.-N. and Simon, B. (2012). D7.2: Second generation
of iTEC shells and composer. Project deliverable 7.2,
University of Namur.
Crocker, D. (2008). Augmented BNF for Syntax Specifica-
tions: ABNF. RFC 5234, RFC Editor.
De Keukelaere, F., Bhola, S., Steiner, M., Chari, S.,
and Yoshihama, S. (2008). Smash: secure compo-
nent model for cross-domain mashups on unmodified
browsers. In Proceedings of the 17th international
conference on World Wide Web, WWW ’08, pages
535–544, New York, NY, USA. ACM.
Ferraiolo, D. F., Sandhu, R., Gavrila, S., Kuhn, D. R., and
Chandramouli, R. (2001). Proposed nist standard for
role-based access control. ACM Trans. Inf. Syst. Se-
cur., 4(3):224–274.
Foundation, O. (2007). Openid authentication 2.0. http:
//openid.net/developers/specs/.
Govaerts, S., Verbert, K., Dahrendorf, D., Ullrich, C.,
Schmidt, M., Werkle, M., Chatterjee, A., Nussbaumer,
A., Renzel, D., Scheffel, M., Friedrich, M., Santos,
J. L., Duval, E., and Law, E. L.-C. (2011). Towards
responsive open learning environments: the ROLE in-
teroperability framework. In Proceedings of the 6th
European conference on Technology enhanced learn-
ing: towards ubiquitous learning, EC-TEL’11, pages
125–138, Berlin, Heidelberg. Springer-Verlag.
Hardt, D. (2012). The OAuth 2.0 Authorization Framework.
RFC 6749, RFC Editor.
Saltzer, J. and Schroeder, M. (1975). The protection of in-
formation in computer systems. Proceedings of the
IEEE, 63(9):1278–1308.
12
http://www.imsglobal.org/toolsinteroperability2.cfm
AuthenticationandAuthorisationforWidget-basedApplicationsinaLoosely-coupledWebeLearningEnvironment
25