JJ’s Blog

A self-contained Azure Media Service (AMS) end-to-end szenario with dynamic AES128 encryption

juliajauss — Thu, 22 Dec 2016 10:25:05 GMT

Microsoft Azure Media Services enables you to deliver Http-Live-Streaming (HLS) and Smooth Streams encrypted with AES128 (Advanced Encryption Standard using 128-bit encryption keys). To easily demonstrate a simple szenario for using AES123 encryption, I developed a self-contained solution that you can find in my GitHub repository. The use case is an intranet video portal to show training videos to employees. Depending on their role in a directory service (e.g. Active Directory) they can see different content. This demo can be started easily, without the need of setting up a directory service. Here you can see an overview of the architecture: I want to give a short description of what happens:

An employee logs in to the CMS using corp credentials.
The CMS will redirect the user to the ADFS (in this demo: a mockup using IdentityServer) for authentication.
If the validation of the client credentials is successful, ADFS returns a bearer token and redirects the user back to the CMS.
The user is now signed in to the intranet application. In this demo, this is a simple website showing the videos dedicated to this user. At this point, the video is encrypted.
CMS requests a JWT Token from the Identity Provider (in this demo: a class in my CMS project (JWT Helper)). The Identity Provider checks the rights of the user and queries the database (in this demo: database mockup using a simple JSON file) for available videos for this user. A JWT Token is generated using the primary verification key of the video.
JWT Token is returned.
The video player shows the JWT token to Azure Media Key Services and gets the decryption key for the videos, if valid.
The video fragments are decrypted dynamically in the browser.

A more detailed description of the components of the solution can be found in the GitHub Readme. In the following article, I will focus on how to do the encryption of the assets. So, what do I have to do to encrypt my assets? To encrypt an asset, you need to associate an content key with the asset, configure a authorization policy for the key and define a delivery policy for the asset:

Content key Is used to dynamically encrypt your content using AES encryption when a stream is requested.
Authorization Policy Or: how do you get the encryption key (from a service specified in the Delivery Policy), via a token or PlayReady? If token: TokenRestrictionTemplate - Authorization via JWT or SWT (JSON Web Token or Simple Web Token)? - Who is the issuer of the token? - Who has access (audience)?
Delivery Policy The Delivery Policy for an asset specifies how this asset will be delivered: - Key Acquisition URL (where can I get the encryption key for this asset? (AMS Key Services || PlayReady || Widevine) - Into which streaming protocol should your asset be packaged? (HLS, DASH, Smooth Streaming) - Should the asset be dynamically encrypted? And how? (envelope || common encryption)

In my demo, the AuthorizationPolicy is set to a token-based authorization. To get the encryption key, the player will request it from the Azure Media Services Key Delivery Service using a JWT Token: Got it! And how does it look like in code? [code language="csharp"] private static async void SetupAESEncryptionAsync(CloudMediaContext context, IAsset encodedAsset, string audience, Settings settings) { //1.Create a content key and associate it with the encoded asset IContentKey key = CreateEnvelopeTypeContentKey(encodedAsset, context); //2.Configure the content keys authorization policy string tokenTemplateString = await AddTokenRestrictedAuthorizationPolicy(context: context, contentKey: key, audience: audience, contentKeyIdentifierClaim: true, issuer: settings.Issuer, primaryVerificationKey: settings.primaryVerificationKey); //3.Create Asset Delivery Policy (Dynamic or non-dynamic encryption) CreateAssetDeliveryPolicy(encodedAsset, key, context); } [/code] Let's step through this! 1.Create a content key and associate it with the encoded asset You have to use ContentKeyType.EnvelopeEncryption in order to use AES-128 encryption. [code highlight="13" language="csharp"] static public IContentKey CreateEnvelopeTypeContentKey(IAsset asset, CloudMediaContext context) { //Check if there is already a content key associated with the asset IContentKey contentKey = asset.ContentKeys.FirstOrDefault(k => k.ContentKeyType == ContentKeyType.EnvelopeEncryption); // Create envelope encryption content key, Associate the key with the asset if (contentKey == null) { contentKey = context.ContentKeys.Create( keyId: Guid.NewGuid(), contentKey: GetKeyBytes(16), name: "ContentKey", contentKeyType: ContentKeyType.EnvelopeEncryption); asset.ContentKeys.Add(contentKey); } return contentKey; } [/code] 2.Configure the Authorization Policy for the content key ContentKeyDeliveryType.BaselineHttp specifies to use the AES key server from AMS. [code highlight="6,7,23" language="csharp"] public static async Task AddTokenRestrictedAuthorizationPolicy(CloudMediaContext context, IContentKey contentKey, string issuer, string audience, bool contentKeyIdentifierClaim, byte[] primaryVerificationKey) { string tokenTemplateString = GenerateTokenRequirements( issuer: issuer, audience: audience, contentKeyIdentifierClaim: contentKeyIdentifierClaim, primaryVerificationKey: primaryVerificationKey); IContentKeyAuthorizationPolicy policy = await context.ContentKeyAuthorizationPolicies.CreateAsync(name: "Token restricted authorization policy"); List restrictionList = new List { new ContentKeyAuthorizationPolicyRestriction { Name = "Token Authorization Policy", KeyRestrictionType = (int)ContentKeyRestrictionType.TokenRestricted, Requirements = tokenTemplateString } }; //You could have multiple options; BaselineHttp specifies that we use the AES key server from AMS IContentKeyAuthorizationPolicyOption policyOption = context.ContentKeyAuthorizationPolicyOptions.CreateAsync( name: "Token Authorization policy option", deliveryType: ContentKeyDeliveryType.BaselineHttp, restrictions: restrictionList, keyDeliveryConfiguration: null).Result; // no key delivery data is needed for HLS policy.Options.Add(policyOption); // Add ContentKeyAutorizationPolicy to ContentKey contentKey.AuthorizationPolicyId = policy.Id; IContentKey updatedKey = await contentKey.UpdateAsync(); return tokenTemplateString; } [/code] 3.Create Asset Delivery Policy (Dynamic or non-dynamic encryption) [code highlight="3,14,15" language="csharp"] static public async void CreateAssetDeliveryPolicy(IAsset asset, IContentKey key, CloudMediaContext context) { Uri keyAcquisitionUri = await key.GetKeyDeliveryUrlAsync(ContentKeyDeliveryType.BaselineHttp); const string assetDeliveryPolicyName = "AssetDeliveryPolicy for HLS, SmoothStreaming and MPEG-DASH"; IAssetDeliveryPolicy assetDeliveryPolicy = context.AssetDeliveryPolicies .Where(p => p.Name == assetDeliveryPolicyName) .ToList().FirstOrDefault(); if (assetDeliveryPolicy == null) { assetDeliveryPolicy = await context.AssetDeliveryPolicies.CreateAsync( name: assetDeliveryPolicyName, policyType: AssetDeliveryPolicyType.DynamicEnvelopeEncryption, deliveryProtocol: AssetDeliveryProtocol.SmoothStreaming | AssetDeliveryProtocol.HLS | AssetDeliveryProtocol.Dash, configuration: new Dictionary {{ AssetDeliveryPolicyConfigurationKey.EnvelopeBaseKeyAcquisitionUrl, keyAcquisitionUri.AbsoluteUri }}); // Add AssetDelivery Policy to the asset asset.DeliveryPolicies.Add(assetDeliveryPolicy); } } [/code] In the TokenRestrictionTemplate you define three things:

The type of the Token (JWT || SWT)
The issuer of the Token. In my case the issuer is IdentityServer (ADFS-mockup in my solution), running locally ("https://localhost:5000/identity"). In a production scenario, this could be any IdentityProvider.
The audience of the token - the people who are able to view the video. I defined two audiences in IdentityServer: staff and management. In a production scenario, this could be e.g. groups in your Active Directory.

[code highlight="3,11" language="csharp"] static private string GenerateTokenRequirements(string issuer, string audience, bool contentKeyIdentifierClaim, byte[] primaryVerificationKey) { var template = new TokenRestrictionTemplate(TokenType.JWT) { PrimaryVerificationKey = new SymmetricVerificationKey(primaryVerificationKey), Issuer = issuer, Audience = audience }; if (contentKeyIdentifierClaim) template.RequiredClaims.Add(TokenClaim.ContentKeyIdentifierClaim); //You can create a test token, useful to debug your final token if anything is not working as you want string testToken = TokenRestrictionTemplateSerializer.GenerateTestToken(template); return TokenRestrictionTemplateSerializer.Serialize(template); } [/code] You can specify if your token should include the ContentKeyIdentifierClaim. Here is a picture of a sample JWT token (grabbed using Fiddler), using https://jwt.io/ to take a closer look at the token of the Azure Media Player Sample with AES128 encryption sample with ContentKeyIdentifierClaim (urn:microsoft: ...): The complete solution and code can be found on GitHub. Please reach out to me if you have any questions! I'm also on Twitter: @blaujule.

Create Azure billing alerts

juliajauss — Thu, 28 Apr 2016 15:49:36 GMT

Go to this website and select "Try it now" for the Billing Alert Service:

Afterwards you can see the Alerts section when you select a subscription here:

Quick deletion and shutdown of Azure Resources

juliajauss — Thu, 28 Apr 2016 14:06:57 GMT

[caption id="attachment_95" align="aligncenter" width="300"] Click to play gif![/caption] You played with Azure all the day and you are in a hurry getting home on time? Here is how you can delete your resource group (or shut down all your VMs) with only one Powershell command - like you can see in the gif. Just type DeleteResourceGroup, login to your Azure Account and select the Resource Group you want to delete - finished. More exiting: Type ShutDownAllVMs and all your VMs are stopped and no costs will be produced anymore (of course except of the vhd storage costs, but these are just a few cents). So, how am I doing this? The whole magic comes with Powershell profiles.

Do you already have one? Check it with: Test-Path $profile
If it returns True you already have a profile. If it returns False you can create one by using this command: New-Item -path $profile -type file -force
You can edit your profile at everytime using: notepad $profile
So these are the lines in my Powershell Profile to use the Shortcuts (= functions) ShutDownAllVMs: function ShutDownAllVMs{ Invoke-Expression "& 'C:\Users\jule\Scripts\ShutDown-All-VMs-in-All-RGs.ps1' "}

Scripts for deleting a selected Resource Group, stopping all VMs and stopping all VMs in a selected Resource Group are available on GitHub. I hope your 150€ trial money will now remain a bit longer :)

Install Custom Script Extension via Powershell on existing Azure VM

juliajauss — Wed, 27 Apr 2016 16:25:59 GMT

You want to install something on your Windows VM on Azure using a Custom Script Extension via Powershell? Here is how you can do it! I wanted to install the AzCopy (Windows command-line utility designed for copying data to and from Microsoft Azure Blob, File, and Table storage using simple commands with optimal performance) Tool on my Windows Server VM. To do so, I uploaded a Powershell script to my Storage Account that downloads and installs AzCopy. This script should be executed on my Windows Server VM using Custom Script Extension. Therefore, I wrote and executed this Powershell script on my local Machine. The most important command is this one, which grabs your VM and sets the CustomScriptExtension by providing the location of your custom script and tells your VM to run this script. [code language="powershell"] Get-AzureRmVM -Name $myVM.Name -ResourceGroupName $rg.ResourceGroupName | Set-AzureRmVMCustomScriptExtension -Name MyCSETest -VMName $myVM.Name -ResourceGroupName $rg.ResourceGroupName -StorageAccountName $storageAccount.StorageAccountName -StorageAccountKey $storageAccountKey.Key1 -ContainerName $storageContainer -FileName $fileName -Run $fileName [/code] The other lines are just basics, like logging in to Azure and selecting the Subscription you want to work in; selecting the Resource Group of your VM; selecting the VM you want to attach the Custom Script Extension; the Storage Account and Container which contains the custom script and its file name. After running this script, AzCopy (or any other tool you want to install) is installed on your Windows VM :)

Download Azure Billing and Usage Information automatically

juliajauss — Thu, 31 Mar 2016 15:40:27 GMT

Using the Billing API to download your Azure Billing and Usage information requires a manual authentification against Azure everytime. I will show you how to programatically fetch the information without the requirement of a manual login using a certificate (of course we don't want to hardcode the password). You can find this instruction in German and the Code on GitHub. The steps in the Azure Portal and all other steps can also be done by a Powershell script. What do I need?

Visual Studio 2015
Visual Studio Developer Command Prompt
makecert.exe (Windows SDK)
Azure AD module for Powershell
Internet Connection
Azure Subscription

Steps

Download the Code on GitHub.
Create an Azure AD Web App.
Create a Certificate.
Convert your Certificate to a X509 Certificate
Add the Certificate to the local certificate store
Create a Service Principal.
Modify the C# Project configuration.
Automatically download your Billing Information! :)

Step 2: Create an Azure AD Web App [caption id="attachment_33" align="alignnone" width="300"] Click to Play this gif[/caption] Note down the following for step 7: Client Id: 038c63e3-f657-4c62-a139-b58c1781185d-********** Tenant Id: c015601b-39cc-441b-a15b-************ Subscription Id: 00dd302a-92a9-*--*********** How can I find the Client ID? Select your App JuliaBillingBlog in your Default Directory. Select Configure and copy the Client Id. How can I find the Tenant ID? Select your App JuliaBillingBlog in your Default Directory. Select View Endpoints (at the bottom of the page) and copy the Tenant Id. How can I find my Subscription ID? Select Settings in the left navigation pane. your Default Directory. Select View Endpoints and copy the Subscription Id. Step 3: Create a Certificate 1. Open Visual Studio Command Prompt. 2. Create a Certificate: makecert -r -pe -n "CN=JuliasCertificate" -ss My -len 2048 “C:\JuliasCertificate.cer“ Step 4: Convert your Certificate to a X509 Certificate 1. Open Powershell. 2. Create a new X509 Certificate: $cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate 3. Import the Certificate created in the previous step (Step 3: Create a Certificate): $cer.Import("C:\JuliasCertificate.cer”) 4. Save the raw data of the Certificate: $binCert = $cer.GetRawCertData() 5. Convert the raw data from unsigned 8-bit integers into base 64 : $credValue = [System.Convert]::ToBase64String($binCert) Step 5: Add the Certificate to the local certificate store 1. Get the Thumbprint of your created Certificate: dir Cert:\LocalMachine\My 2. Add the Certificate to your trusted root store:

$cert = (get-item cert:\LocalMachine\My\A70E0D9E39C32B482E8A8D7776462A9470DEF441)
$store = (get-item cert:\Localmachine\Root)
$store.Open("ReadWrite")
$store.Add($cert)
$store.Close()

3. Check if the Certificate was added: dir Cert:\LocalMachine\Root Step 6: Create a Service Principal 1. Open Azure Powershell as Admin. 2. Login to Azure: Login-AzureRmAccount #This will pop up a login dialogue 3. Select your subscription: Select-AzureRmSubscription -SubscriptionId "" 4. Open Windows Azure Active Directory Powershell Modul and connect to Azure AD. connect-msolservice 5. Create a new Service Principal: New-AzureRmADServicePrincipal -ApplicationId "" New-AzureRmRoleAssignment -ServicePrincipalName "" -RoleDefinitionName Contributor 6. Check with Get-AzureRmRoleAssignment if the assignment was successful. Step 7: Modify the C# Project configuration 1. Open Visual Studio and the Project from GitHub. 2. Open the App.config file and replace the parameters with your Parameters you noted in Step2. 3. Run the Project and get your Billing Information :)