2154000 - Cross-Domain Communication Restriction - Learning Management System

One common network architecture solution to work around the cross-domain restriction is the reverse proxy. This is essentially a proxy server that sits in front of the LMS and any content servers in your environment. All requests for the LMS or content are routed through the reverse proxy and are forwarded to the appropriate servers based on the context of the request.

For Example, if your network contained the following servers:

• LMS = http://lms.customer.com/learning/user/login.jsp
• Content Server 1 = http://content.customer.com/content1/course_x/sco_x.htm
• Content Server 2 = http://content2.customer.com/content2/course_y/index.htm

A reverse proxy server (http://revProxy.customer.com) could be added to your network with the following rules:

• route any "/learning" request to http://lms.customer.com/learning
• route any "/content1" request to http://content.customer.com/content1
• route any "/content2" request to http://content2.customer.com/content2

This would allow a user to use the following reverse proxy requests to access the LMS or content:

• LMS = http://revProxy.customer.com/learning/user/login.jsp
• Content Server 1 = http://revProxy.customer.com/content1/course_x/sco_x.htm
• Content Server 2 = http://revProxy.customer.com/content2/course_y/index.htm

The browser would see the content and the LMS as coming from the same DNS and thus the cross-domain restriction would not apply.

Proxlet Solution

SCORM (and some AICC) content expects your Learning Management System (LMS) to be in the same Domain Name Space (DNS) as your eLearning content.  If you host your content on another server other than Success Factors, a solution needs to be set up in order for this to work.

The proxlet is a set of files you install on your content server that enables your SCORM content to communicate Cross Domain back to LMS using a trusted server to server communication.  It makes the content believe it is located on the same server as the LMS and allows content to be taken and tracking to work.

In Plateau 5.5 an entirely LMS-based solution (no changes required in the content) was introduced. This solution resolves the cross-domain restriction by placing the communication APIs on the content server and relies on a communication proxy (proxlet) on the content server to relay tracking data back to Plateau (section 1.3.8 of the ADL document). It can be thought of as placing part of the LMS, needed by the content for communication, on the content server. This solution is enabled via the LMS configuration files, and requires additional settings at the content object or question object level.

This solution resolves the cross-domain restriction for the following APIs:

The diagram above shows the LMS-based solution introduced in Plateau 5.5. The content and the APIs are loaded into a
wrapper. The APIs communicate back to Plateau via a communication proxy running on the content server.

Document Domain Manipulation

One combination LMS and content solution that is discussed in the ADL document and is supported by Plateau is the manipulation of document.domain (section 1.3.5 of the document). This solution uses javascript to trick the content and the LMS into thinking they are under the same DNS. For this solution to work, the content server and the LMS server must share a common root domain. in the diagram above, the common root would be PLATEAU.COM.

Plateau 4.1 introduced a cross-domain configuration setting in the LMS configuration framework. This setting allows a user to set the domain of the SCORM and Plateau Tracking API's to a root domain. For instance, the diagram above has the API's hosted under LMS.PLATEAU.COM, so Plateau could be configured to host the API's under PLATEAU.COM (it is not possible to specify just COM as a domain).

Once Plateau's API's are configured to a root domain, it is possible to use javascript to manipulate the domain of the content. The following code can be used to hard code the domain of the content:

<script language="javascript">
document.domain="Plateau.com";
</script>

Or this code can be used to dynamically set the domain to the top root-level domain. For instance, if the domain was MY.CONTENT.SERVER.PLATEAU.COM, this code would set the domain to PLATEAU.COM.

<script language="javascript">
midDotLoc = document.domain.lastIndexOf('.');
dotLoc = document.domain.lastIndexOf('.',midDotLoc-1);
document.domain=document.domain.substring(dotLoc+1);
</script>

Once the Plateau API domain and the content domain have been set to a common root, the cross-domain restriction no longer applies. and the content will be able to access the APIs.

• Plateau Tracking
• SCORM
• PEXAM