search

mozilla / openbadges-backpack

Mozilla Open Badges Backpack
https://backpack.openbadges.org/
Other
862 stars 263 forks source link

Discussion: how do we verify badges that are behind a firewall? #402

Open brianloveswords opened 12 years ago

brianloveswords commented 12 years ago

This comes from a community member working on moodle/mahara integration:

One more question that has come up today - many moodle sites will be internal only system that sit behind quite restrictive firewalls - often with no "external" access at all. How is that managed when it comes to pushing badges to the backpack and in particular verifying badges that have been issued? I guess that users can always manually upload badges to their backpack, but the verification seems like it could be a real problem - is there any way a site could use an external verification service so they don't need to host it themselves?

brianloveswords commented 12 years ago

@cmcavoy, @stenington something we need to consider.

threeqube commented 12 years ago

Relevant discussion: https://moodle.org/mod/forum/discuss.php?d=197834#p915186

adamprocter commented 12 years ago

I was asked on #badges IRC to add my example as a use case.

I run a Module at Winchester School of Art called Research and Communication Skills, in this module the students all contribute to a single Wordpress blog. Each week the students are given specific tasks to complete that they must then document and reflect on via the blog.

At the end of the module we mark the reflective writing and task completions skills. It allow us to introduce key features of what being Art Student at WSA is all about and also the act of sharing the tasks with there fellow student allows for peer learning, decreases fears and allows us to introduce not only theoretical ideas but also very practical resource needs, such as demonstrate you found a journal using the universities library and more. Students and staff seem to really like it.

However we thus hide the blog behind a firewall so only our staff and students can read these entries, contribute etc. It means sharing is not so public and they are free to make mistakes and so on. This year I want/wanted to try and issue badges as part of the process i.e Badge for X posts, X comments etc. However due to the firewall we have encountered the following problem: badge assertion appears to be invalid. We added Mozilla.net to the firewall exceptions but this has not helped.

If I can help further I would be more than happy to.

adamprocter commented 12 years ago

To note I was missing some info from the json assertion stuff stuff that means I am now getting the following error -

"We have encountered the following problem: trying to grab image at url http://myblog.soton.ac.uk/blog/files/2012/10/walk.png got error UnreachableError: Unable to retrieve image from the following url: http://myblog.soton.ac.uk/blog/files/2012/10/walk.png"

adamprocter commented 12 years ago

Ok removing the featured image gives me the error - i guess it messed up the jSON file..

"badge assertion appears to be invalid"

I cant use a URL to an image as there is no option to set as featured (server to dish up badge image)

threeqube commented 12 years ago

Hey @adamprocter not sure I follow the above. If you could point out where you are now, maybe @brianloveswords can help?

adamprocter commented 12 years ago

I had to add some details to my badge , such as issuer and the like in Wordpress, once I did this on trying to claim the badge I was presented with the image error. If I removed the featured image from the wordpress badge then I get assertion is invalid.

And cannot put the badge image on another server (not behind firewall). hope that makes sense.

2 options So if I can set featured image to be on another server not behind firewall will it work ? Do I need to set some other firewall setting to allow Openbadges to contact the image location ? at the moment requests from mozilla.net are allowed but maybe i need to allow something else ?

simoncoggins commented 11 years ago

This continues to be an issue for many organisations using Moodle and Totara to issue badges.

Signed assertions are a step in the right direction but they don't actually solve this problem since you still need to host your public key. I was wondering if it would be possible to implement something like a PGP key server (e.g. http://pgp.mit.edu/) - a publicly accessible site where organisations could upload their public keys to publicise their existence?

Is that technically feasible?

Simon