Encrypt one asset for HLS with Playready and JWT token

1. Having the asset described above the first step we need is to create a content key policy that includes DRM with Playready and with JWT token associated, for this go to section "Content Key Policies" in MK/IO UI and click on "Create content key policy"
      
   
   
2. Give a name you will be familiar with later on and provide some description (optional).
   At this moment you will have to choose if you create a content key policy for MultiDRM or MultiDRMCENC.|
   The difference between the 2 is that the MultiDRM policy requires you to have Playready, Widevine and Fairplay on it (even if you plan to use only fairplay), and MultiDRMCENC policy requires you to have Playready and Widevine (even if you dont plan to use one or the other).
   
   In this case, I will create a MultiDRM content key policy with JWT token that includes Playready, Widevine and FairPlay (and in the last use case I will create a MultiDRMCENC content key policy).
     
   After given the name and description click on + Add in the Digital Rights Management section and start with + Add Widevine
   
   
3. Complete a name
   
   use token restriction select yes
   
   Token type: Jwt
   
   Issuer: sergioco (I put here sergioco but you can put a string of characters)
   
   Audience: audience (I put here audience but you can put a strign of characters)
   
   Primary verification key: c2VyZ2lvY29hdWRpZW5jZQ==
   
    

   This is a base64 encoded string that can be generated from websites like https://www.base64encode.org/ in this case you can go to that website and encoded the following string of characters into base64: sergiocoaudience resulting in this value: c2VyZ2lvY29hdWRpZW5jZQ==, feel free to generate yourself this Primary Verification Key.

   
   
   Widevine template: here you can leave by default {} unless you want to use a widevine template.
   
       
   
   
   Finally click on Add. At this time we are back to the previous screen and we have added the widevine protection.
   
   
   
4. Now under Digital Rights Management we will add a Playready protection, + Add Playready:
      
   Here give it a name that is easy recognizable and do the same selections we did before with Widevine protection:
   use token restriction select yes
   Token type: Jwt
   Issuer: sergioco (I put here sergioco but you can put a string of characters)
   Audience: audience (I put here audience but you can put a strign of characters)
   Primary verification key: c2VyZ2lvY29hdWRpZW5jZQ==
   Rest of options can be left by default unless you require specific playready protection.
     
   At the bottom click on Add and we are back to the previous screen of content key policy and we have added Playready protection.
5. Finally, we will add fairplay protection on this content key policy, click + add fairplay
   
     
   Here give it a name that is easy recognizable and do the same selections we did before with Widevine and playready protection:
   use token restriction select yes
   Token type: Jwt
   Issuer: sergioco (I put here sergioco but you can put a string of characters)
   Audience: audience (I put here audience but you can put a strign of characters)
   Primary verification key: c2VyZ2lvY29hdWRpZW5jZQ==
   To use fairplay DRM encryption, you should have a certificate given from Apple, with a password and application secret key, please use this at this time.
     
    At the bottom click on Add and we are back to the previous screen of content key policy and we have added Fairplay protection.
   Finally click on Create at the bottom and we should have our content key policy created.
            
   
   
6. Before going back to the asset, we are going to generate the JWT token based on the parameters we have configured our content key policy with, for this go to https://jwt.io/, here we will generate our JWT token.
   Modify the payload including the issuer and audience we configured previously and at the bottom paste the Primary Verification Key in the space at the bottom for your-256-bit-secret (base64 encoded)

               

      7. Now go back to the Asset in the MK.IO UI and create a new streaming locator|
        

      8. Give it a name and choose Predefined_MultiDrmStreaming (which requires to have Fairplay, Playready and Widevine) and as Content Key Policy, the one we just created:
        
At this time, if you try to use a content key policy that only has fairplay or only has playready or only has widevine or a combination of 2 of these, it will show an error since you need to have the 3 DRM options added in the content key policy. Click on Add and we are back to the asset window in the UI.

      9. Now select the streaming locator we just created (MultiDRMWToken) and a streaming endpoint Running and click Apply, you will get a list of playback URLs and the window may show an error, this is becuase             we need to use MKPlayer with some configs to use these Playback URLS.
            In this Use case we will playback HLS with Playready with Token so we will need these:
        
PlaybackURL: https://ep-rtmp-mediakind-eastus.eastus.streaming.mediakind.com/4c20d40d-02d0-41d1-bdd5-17d125693e32/manifest.ism/manifest(format=m3u8-cmaf,encryption=cbcs-aapl)
Playready LA: https://ottapp-appgw-amp.prodc.mkio.tv3cloud.com/drm/playready-license?ownerUid=azuki
Notice that PlaybackURL has cbcs-aapl at the end of the URL, this is a bug that will be fixed soon in the UI, for now you can change it from cbcs-aapl to cenc, to this:

PlaybackURL: https://ep-rtmp-mediakind-eastus.eastus.streaming.mediakind.com/4c20d40d-02d0-41d1-bdd5-17d125693e32/manifest.ism/manifest(format=m3u8-cmaf,encryption=cenc)
Playready LA: https://ottapp-appgw-amp.prodc.mkio.tv3cloud.com/drm/playready-license?ownerUid=azuki

Now on MKPlayer, we will choose, HLS, playready and paste the URLs on Source URL and License URL and complete the License request headers with the Authorization we created (JWT token) as follows:
  

Encrypt one asset for DASH with Widevine and no token

1. Having the asset described above the first step we need is to create a content key policy that includes DRM with Widevine, for this go to section "Content Key Policies" in MK/IO UI and click on "Create content key policy"
     
   
   
2. Give a name you will be familiar with later on and provide some description (optional).
   At this moment we choose to create a MultiDRMCENC content key policy that includes Playready and Widevine and no fairplay and no JWT token.
   This type of content key policy can be used if you plan to use playready, widevine or both but not fairplay.|
      
   
   After given the name and description click on + Add in the Digital Rights Management section and start with + Add Widevine
   
   
3. Complete a name
   use token restriction select no
   Widevine template: here you can leave by default {} unless you want to use a widevine template      
    
   Finally click on Add. At this time we are back to the previous screen and we have added the widevine protection.
   
   
4. Now under Digital Rights Management we will add a Playready protection, + Add Playready:
      
   Here give it a name that is easy recognizable and do the same selections we did before with Widevine protection:
   use token restriction select no
   Rest of options can be left by default unless you require specific playready protection.
                
    At the bottom click on Add and we are back to the previous screen of content key policy and we have added Playready protection.
   
   Finally click on Create at the bottom and we should have our content key policy created.
     
5. Now go back to the Asset in the MK.IO UI and create a new streaming locator: 

            

       

       6. Give it a name and choose Predefined_MultiDrmCencStreaming (which requires to have Playready and Widevine) and as Content Key Policy, the one we just created:

             

   

      At this time, if you try to use a content key policy that only has fairplay or only has playready or only has widevine or a combination of 3 of these, it will show an error since you need to have the 2 DRM options added in the content key policy. Click on Add and we are back to the asset window in the UI.

               

      8. Now on MKPlayer, we will choose, DASH, Widevine and paste the URLs on Source URL and License URL:

            

                  

Playback Asset with HLS or DASH with ClearKey and JWT token

1. Having the asset described above the first step we need is to create a content key policy that includes clearkey with token associated, for this go to section "Content Key Policies" in MK/IO UI and click on "Create content key policy"
        
2. Give a name you will be familiar with later on and provide some description (optional), now click on "Add" next to Clear Key section:
   
       
          
   
3. You can provide a name to the clearkey that you will understand later, for example you can use the same than your content key policy to be clearer and choose Yes under 'Use token restriction'.
   
4. Now in Token type, let selected Jwt, and complete the next 3 fields:
   
1. Issuer: mediakindco (here add the name of the issuer, can be your company, your department, your customer, etc, in this example Im using mediakindco)
   
2. Audience: mediakindcoaudience (here just add the target audience you want to use this token, it can be any name you prefer, in this case I will use mediakindcoaudience.
   
3. Primary Verification Key: bWVkaWFraW5kY29hdWRpZW5jZSA= (this is a base64 encoded string, what I will do is convert mediakindcoaudience to base64 using the web base64encode.org and do it in the encode section, the resultant base64 is the value bWVkaWFraW5kY29hdWRpZW5jZSA=)
   

                   

This will create the content key policy with JWT requirement to be used for playback.
                    

                 

1. This time we will choose a name that will identify this streaming locator and a Streaming Policy of the type Predefined_ClearKey, notice that below Streaming policy name the format of the encryption will be described. Below this, select the content key policy we created eariler with Clear Key only
    
   Rest of fields can be left empty unless you want to use them, click on add at the bottom and we are back to the asset screen UI
2. Now, select the streaming locator we just created and click on Apply and the 2 URLs for DASH and HLS with clearkey protection will be exposed: 
   
          
   
3. It is completely normal to see the error DRM_FAILED_LICENSE_REQUEST on the player screen because we are protecting the content with an authorization token that is not provided by default, we will create and provide this in the coming steps.
   
4. Now, before going to the MKPlayer screen, we need to generate our JWT token to be used as HTTP Authorization header on the playback requests, for this, we need to go to a website like jwt.io to generate the token:
   
5. Open jwt.io in your browser, modify the PAYLOAD: DATA section on the right including the issuer and audience we configured previously in the content key policy (mediakindco and mediakindcoaudience) and at the bottom paste the Primary Verification Key in the space at the bottom for your-256-bit-secret (base64 encoded) in our case this value was: bWVkaWFraW5kY29hdWRpZW5jZSA= , and remember to click the checkmark indicating is base64 encoded
6.                
   

         In essence, this will be the format of the payload to use: {"iss":"<issuer>", "aud": "<audience>"}, you can optionally add an optional expiry date with "exp":<date>.

         It results in the encoded token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtZWRpYWtpbmRjbyIsImF1ZCI6Im1lZGlha2luZGNvYXVkaWVuY2UifQ.orTsFDpLHT7ngD__-IXUekT0XBrGQ-glD7BAlqgmxrA
         This will be the Bearer token we will use later on
7. Finally, for HLS, navigate to the MKPlayer section and try to playback the HLS URL with clear key protection selecting as Protocol: HLS and DRM: ClearKey, as License URL provide HLS_AES (at the bottom it will be added by MKPlayer) and at the bottom, on section License request headers add the authorization header with the jwt token we created in the previous step
     
8. For DASH, navigate to the MKPlayer section and try to playback the DASH URL with clear key protection selecting as Protocol: DASH and DRM: ClearKey, as License URL provide: https://ottapp-appgw-amp.prodc.mkio.tv3cloud.com/drm/clear-key?ownerUid=azuki and at the bottom, on section License request headers add the authorization header with the JWT token we created in the previous step: