Summary #

Apple iTunes servers have problems authenticating through a proxy. You need to make a few changes to the filter to get iTunes to work properly.

UPDATE: 5-5-2014

More Information #

To get iTunes to work you need to unfilter a site and make some authentication exceptions.

1. Go to “Website Filtering” -> “Authentication Exceptions”
2. Add an entry for itunes.apple.com
3. Add an entry for metrics.apple.com
4. Add an entry for phobos.apple.com
5. Add an entry for xp.apple.com
6. Add an entry for securemetrics.apple.com
7. Add an entry for mzstatic.com
8. Add an entry for gcsp.cddbp.net
9. Add an entry for symcb.com
10. On the Authentication Exceptions page, make note of which filter set is being used for filtering Authentication Exceptions (noted in the bright teal box)
11. Go to “Website Filtering” -> “Website Access”
12. Select the filter set that you noted in step 4
13. Go to “Add a Site” and add an entry for “itunes.apple.com” to be unfiltered
14. If you are using our “Enhanced iPad Support” feature and need to allow mobile devices access to iTunes then make another rule by going to “Website Filtering” -> “Port Access” -> select the correct filter set -> “Add An Allowed Port Rule” -> Port: 443 -> Type: SSL/HTTPS -> Site: mzstatic.com -> “Submit”. 
15. Commit your changes

Note that the changes above will allow all users to access the iTunes website and content since there will no longer be user authentication for itunes.com. If you only have a few users that need to access iTunes then you do not need to make the changes above. You can disable password authentication for individual users by adding their workstation’s IP address to an IP Group by following the steps below. Note that if you use an IP group then that IP address should always be assigned to the same workstation. Make sure that workstation has a DHCP reservation or has a statically assigned IP address.

1. Go to “User Auth”-> “IP Groups” -> “List IP Groups” and see if there are any IP Groups defined. If there are pick an IP group with the appropriate filter set for the user you will be adding.
2. If you need to make a new IP Group go to “Add An IP Group” -> Select a filter set -> Name of the IP Group -> Submit.
3. Add the user’s IP address by going to “Add a Workstation IP” -> add their IP addess -> Name that makes sense to you ->Select the IP Group -> Submit.
4. Go to “Website Filtering” -> “Website Access”. Select the filter set that you noted in step 2.
5. Go to “Add a Site” and add an entry for “itunes.apple.com” to be unfiltered
6. Commit your changes.