Azure Media Service Bearer Token to access VOD

Question

I am building a VOD service using Azure Media Service.

I have added Authorization policy as "Token" and have entered issuer, scope and primary verification key.

I am unable to get the correct Bearer Token to access content in Assets.

I have tried the following methods:

1. Using Azure PHP SDK: I created a token template and used this function in the SDK: TokenRestrictionTemplateSerializer::generateTestToken

2. https://media.ams.ext.azure.com/api/Utils/IssueToken: Created a form to send type, issuer, scope, primaryVerificationKey, secondaryVerificationKey to this url and obtained token.

The tokens obtained with both the methods do not work. When i try to play the video, i get "Authorization failed" message.

Please help me how to obtain the correct token?

Thanks.

Answer 1

Let's do this in steps: (Assume you are using AMS v2 API. Please let me know if that is not the case.)

1. First please do not add any RequiredClaims for now when setting up content protection (ContentKeyAuthorizationPolicyRestriction) and we can add that after we get basics working. Use the following values in your code for configuring content protection For issuer, use: https://sts.windows.net/51641c40-ad65-4736-88fc-2f0e10072d85/ For audience, use: 29635cdc-ca9a-48b7-b242-05a31810e8c9 Use symmetric verification key: C4D3E9FB-2533-4061-9892-2B8F58A1AECB (Don't worry what these values are for now. We will replace them by yours later on.)
2. For now, do not use your own custom Secure Token Service (STS). Instead use the one I hosted here: https://openidconnectweb.azurewebsites.net/DRMTool/Jwt (choose Custom STS with Symmetric Key).
3. Use this JWT token in your player for playback test. Or you can also use my test player here https://openidconnectweb.azurewebsites.net/AMTestPlayer which allows you to paste in your JWT under player_settings.

After we make this work, we then move on to using your STS (Secure Token Service). Use the same value as above for issuer, audience and symmetric key.

After we make your STS work, we can then move on to the cases you want such as

• Use asymmetric key (x509 cert),
• Adding required claims,
• Using your own issuer, audience,

So for now let's go step by step and be precise at each step. Hopefully this approach would help you isolating/troubleshooting with multiple moving parts: AMS config, AMS license authorization, STS, player/JWT, claims.

Good luck, William