Media Services offline streaming

Prerequisites

Before you implement offline DRM for FairPlay on an iOS 10+ device:

• Read Apple FairPlay license requirements and configuration
• Obtain the FPS SDK from the Apple Developer Network. The FPS SDK contains two components:
  • The FPS Server SDK, which contains the Key Security Module (KSM), client samples, a specification, and a set of test vectors.
  • The FPS Deployment Pack, which contains the D function specification, along with instructions about how to generate the FPS Certificate customer-specific private key, and Application Secret Key. Apple issues the FPS Deployment Pack only to licensed content providers.
• The .der/.cer certificate files you receive as part of the generation of the FPS certificate contain a public key and can be made available to the client. The private key (.pfx) should be secured in Azure Key Vault or another secure location.

Store a FairPlay Private Key (.pfx) in Azure Key Vault

The private key (.pfx) that you receive from Apple should be treated as a secure certificate and can be stored in the Azure Key Vault.

• The .pfx certificate file should first be converted to base 64 text file by the admin
• Once converted, this file can be stored in Azure DevOps Services as a secure text file.
• The string can then be stored in Azure KeyVault manually as a "secret object", or as part of a deployment/build script for your solution. An example of storing the FairPlay private certificate in Azure KeyVault can be seen in the Gridwich project sample code
• Optionally, store the password for the .pfx file as a secret in the key vault.

Example CLI script

To copy the base64 encoded private key file to the Azure KeyVault:

set -eu
echo key vault : $SHARED_KV_NAME
echo "Copying FairPlay certificate to key vault as secret"
az keyvault secret set --vault-name $SHARED_KV_NAME -n ams-fairPlay-certificate-b64 -f $(FairPlayCertificate.secureFilePath) --output none

Clone the sample

Clone the Media Services .Net samples.

git clone https://github.com/Azure-Samples/media-services-v3-dotnet-tutorials.git

Modify the code

Modify the code in Encrypt with DRM using .NET to add FairPlay configurations.

The smooth streaming (PIFF) file format with H264/AAC has a binding with PlayReady (AES-128 CTR). The smooth streaming .ismv file, assuming audio is muxed in video, is itself an fMP4 and can be used for playback. If smooth streaming content goes through PlayReady encryption, each .ismv file becomes a PlayReady protected MP4 fragment. You can choose an .ismv file with the preferred bitrate and rename it as .mp4 for download.

There are two options for hosting the PlayReady protected MP4 for progressive download:

1. You can put the MP4 in the same container/media service asset and use Azure Media Services streaming endpoint for progressive download.
2. You can use the SAS URL for progressive download directly from Azure Storage.

You can use two types of PlayReady license delivery:

1. PlayReady license delivery service in Azure Media Services
2. PlayReady license servers hosted anywhere.

To obtain a PlayReady license with the AMS delivery service, see the Media Services v3 with PlayReady license template.

For playback testing, you can use a Universal Windows Application on Windows 10. In Windows 10 Universal samples, there is a basic player sample called Adaptive Streaming Sample. Add the code for choosing the downloaded video and use it as the source, instead of the adaptive streaming source.