# Moodle LMS Integration with Amazon Alexa: A Practical Experience
## 3 Method
### Alexa Skill Implementation
#### 3.2.1 Account Linking Web Service  
We required an additional web service that would handle the Account Linking process with Alexa service when users enable the skill for the first time. In a nutshell, Account Linking is an Alexa service's feature that enables authentication with a third-party service, and it is based on the OAuth2 authentication protocol (see [PERSON] [39] for more details on OAuth2 protocol). The process for linking an account is initiated from the Alexa mobile app, which redirects the user to an authorization url, previously configured on the Alexa Developer Console (see Figure 5). Users would have to sign in to the form presented on that url to authenticate themselves against the third party service. In case the authentication is successful, a call to the access token url is triggered to fetch an access token to accompany any further Alexa request, and the Account Linking process is concluded. Similar to the authorization url, the access token url must be previously configured [40]. Account Linking is not mandatory for an Alexa skill to function properly, but in our case we perceived it would be best to add the extra step of linking the Moodle account of the user before any interaction with the skill happened, and so we implemented this service using Java SE 8 and AWS Lambda as we did previously. Our skill aimed to retrieve information from Moodle LMS, which made it mandatory for the skill to communicate with Moodle Web Services. The Alexa requests would have to carry the account token to successfully interact with the Moodle Web Services. To reach the token, our approach was to developed a traditional login web form (see Figure 6) where the user could input the username and password of their Moodle account and exchange those credentials for the token. To keep the highest security when handling the user's password for Moodle, we decided not to store the password at all. The user would input the username and password from the Moodle account on the login form and those credentials would be sent directly to Moodle via HTTPS request to the script located at /login/token.php, which will then exchange those credentials for the account token, to be used in the following requests to Moodle Web Services. Figure 4: Alexa Developer Console: View for creating a new skill. All communication was achieved using HTTPS to ensure the protection of the privacy and integrity of the exchanged data while in transit. As happened with the passwords, we decided not to store the Moodle token anywhere either. However, we would require the token when requesting information to Moodle Web Services. To be able to keep the token without storing it ourselves, we decided to use the Alexa access token for this task (see Figure 7). Figure 5: Account Linking flow for authorization code grant type (Source: own authors’ elaboration). Figure 6: Login web form screenshot (Source: own authors’ elaboration). The Alexa access token is delivered on every Alexa request sent by the Alexa service, and allows for identifying the user which triggered the request. We took advantage of this feature and used the Alexa access token to store a JSON Web Token (JWT) created by us. The JWT would contain information that would allow us to identify the user (see Listing 2), including the Moodle account token previously exchanged through the login form. JWTs are an open industry standard RFC 7519 method for representing claims securely between two parties. As explained on the RFC formal document by [PERSON] et al. [41], \"the claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code (MAC) and/or encrypted\". Our JWT token would include three claims for us to use later on:  
* **userId**, our own unique identifier for the user, not related to any identifier from Alexa service or Moodle. * **username**, user's Moodle username.