azure encryption JWT playback

Question

Hello,
I couldn't be more confused on how to add a JWT token to test if my stream works, I have literally tried everything and it still wouldn't accept my data.

So I tried to create a test JWT from an online token generator ( this one : https://irrte.ch/jwt-js-decode/ )

here is the JWT decoded 🥇

{
    "alg": "HS256",
    "typ": "JWT"
}
{

    "iss": "https://sts.windows.net/********-***-****-****-******d/",
    "aud": "*******-*****-****-****-********",
    "iat": 1600954213,
    "exp": 1632490213,
    "nbf": 1632490213
}

"iss" is my .net/tenantID
"aud" is my ad app id

i generate this with my verification key and gives me A VERIFIED token

I then add the same exact data in my content key policy in azure portal token configuration with the same verification key

i generate a new streaming policy with the created token , i take it to the Azure Media Player online , i set in the AES textfield "bearer=myverifiedtoken"

i paste my generated widevine DRM URL over dash with the player open on Chrome i press play and i get an error

0x20500006

Please ANYONE CAN HELP ME ??

Answer 1

Are you playing the stream with Azure Media Player specifying the token using the advanced option?

You should check that the content key policy does not require the key id to be in the token. It is the case if you see
"claimType": "urn:microsoft:azure:mediaservices:contentkeyidentifier"
in the claims of the policy.

If you are running Windows, you can generate a token with AMSE (https://aka.ms/amse). Select the published asset, double click on it, go to content protection, keys and test token tab.

Answer 2

Hello,
It looks like you created the content key policy using the Azure Portal, right ? Did you add any specific claim ?
I ask the question as per default, it looks like the portal add the "iss", "aud" mandatory claims. And "nbf" and "exp" are required. Your token contains "iat" and I wonder if this is not the a claim which creates the issue. Can you remove "iat" ?
Are your sure the token is signed with the same key that defined in the content key policy ?