Access control

Introduction

URL signing works with your business server to provide a secure method for protecting live stream resources. Workflow:

1. Your business server generates a signed URL that contains authentication information.

2. The end user use this signed URL to initiate a stream ingest request to ApsaraVideo Live.

3. An edge node of ApsaraVideo Live decodes and validates the URL signature. If invalid, it rejects the request.

For more information about applicable scenarios, signed URL structure, and working principles, see Signed ingest and streaming URLs.

Procedure

1. Log on to the ApsaraVideo Live console.

2. In the left navigation pane, click Domain Names. The Domain Management page appears.

3. Find the ingest domain that you want to manage and click Domain Settings in the Actions column.

4. Choose Streaming Management > Access Control.

5. Click the URL Signing tab and then click Modify.

   The authentication configuration section includes the URL Signing toggle, Authentication Type (for example, Type A), Primary Key, Secondary Key, and Validity Period (in minutes).

   Note

   • URL signing is enabled by default when you add a domain. To disable it for the first time, you must acknowledge the risk of unauthorized usage and sign the Liability Waiver Agreement.

   • If URL signing is enabled, click Modify to update the settings. If you previously disabled URL signing, simply turn on the URL Signing toggle to reconfigure it.

6. Configure the URL signing settings and click OK.

   Parameter	Description
   Authentication Type	Ingest domains support only Type A signing. Note All URL signing errors return a 403 error. If you encounter this, recalculate the signature. To diagnose the exact cause of the failure, check the X-Tengine-Error header in the HTTP response: MD5 calculation errors Example: X-Tengine-Error:denied by req auth: invalid md5hash=de7bfdc915ced05e17380a149bd760be Timestamp errors Example: X-Tengine-Error:denied by req auth: expired timestamp=1439469547
   Primary Key	When you add a domain, the console randomly generates a primary key. You can also enter a custom primary key.
   Secondary Key	Enter a backup password for URL authentication. Note The primary and secondary keys have equal validity. The secondary key is mainly used for smooth key rotation. If you update the primary key, all URLs signed with the old primary key become invalid. To avoid disruption, copy the old primary key to the secondary key field so it continues to work during the transition.
   Validity Period	The validity period defines how long the signed URL remains valid for initiating ingest or playback. Live ingest and playback use long-lived connections. Once started within the validity period, these sessions continue even after expiration. However, new ingest or playback requests fail if the URL has expired. The default validity period for a newly added domain is 1 day (1440 minutes). You can customize this value in minutes.

Introduction

• IP blacklist: IP addresses added to the blacklist will be denied access to the accelerated domain.

• IP whitlist: Only IP addresses added to the whitelist are allowed to access the accelerated domain.

Procedure

1. Log on to the ApsaraVideo Live console.

2. In the left navigation pane, click Domain Names. The Domain Management page appears.

3. Find the ingest domain that you want to manage and click Domain Settings in the Actions column.

4. Choose Streaming Management > Access Control.

5. Click the IP Blacklist or Whitelist tab and enable the feature.

6. Set the List Type and Rule, then click OK.

   Blacklist and whitelist are mutually exclusive; only one can be active at a time. You can configure a maximum of 1,000 IPv6 addresses or 3,000 IPv4 addresses. Separate entries with line breaks, with no duplicate entries. CIDR notation is supported (for example, 127.0.0.0/24). IPv6 addresses are case-insensitive and do not support the :: abbreviated format.

   Type	Description
   IP Blacklist	IP addresses added to the blacklist will be denied access to the accelerated domain.
   Whitelist	Only IP addresses added to the whitelist are allowed to access the accelerated domain.

Introduction

Both remote authentication and URL signing protect live stream resources by ensuring only authorized users can access them. They differ in implementation:

• URL signing: You provide the authentication rules to the live center, which handles the entire authentication process.

• Remote authentication: You maintain your own authentication server. When the live center receives a user request, it forwards the request to your authentication server for validation. You are responsible for setting up and managing this server. Remote authentication does not support HTTP Live Streaming (HLS).

The data flow for remote authentication is as follows:

Procedure