# MediaSecurity AddOn Package (SecureToken, RTMP & RTSP Authentication and more)

**URL:** <https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45>\
**Category:** Wowza Developer Dojo\
**Tags:** wowza-streaming-server-java-api\
**Created:** [April 28, 2008, 6:58am UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45 "2008-04-28T06:58:51Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/system/32/447_2.png) [@system](https://community.wowza.com/u/system)\
**Post date:** [April 28, 2008, 6:58am UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/1 "2008-04-28T06:58:51Z")

</div>

[https://www.wowza.com/docs/media-security-overview](https://www.wowza.com/docs/media-security-overview)

---

<div class="post-metadata">

**Author:** ![Charlie\_Good](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/charlie_good/32/383_2.png) [@Charlie\_Good](https://community.wowza.com/u/Charlie_Good)\
**Post date:** [February 25, 2010, 4:20pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/2 "2010-02-25T16:20:57Z")

</div>

The jar file is in the package. In the lib folder of the zip archive.

Charlie

---

<div class="post-metadata">

**Author:** ![Charlie\_Good](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/charlie_good/32/383_2.png) [@Charlie\_Good](https://community.wowza.com/u/Charlie_Good)\
**Post date:** [February 26, 2010, 8:28am UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/3 "2010-02-26T08:28:44Z")

</div>

We do not distribute the source for this module. You can create a class that implements the IAuthenticateUsernamePasswordProvider interface and it will intercept the authentication events. First, install the latest patch:

[https://www.wowza.com/devbuild.html](https://www.wowza.com/devbuild.html)

Then take a look at this forum post. It explains the basics.

Charlie

---

<div class="post-metadata">

**Author:** ![Kelly\_Rinne](https://avatars.discourse-cdn.com/v4/letter/k/51bf81/32.png) [@Kelly\_Rinne](https://community.wowza.com/u/Kelly_Rinne)\
**Post date:** [June 2, 2010, 3:58pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/4 "2010-06-02T15:58:25Z")

</div>

Hi all -

The User guide for the Media Security package indicates this URL shows how to setup JW Player, but the link is broken:

[https://www.wowza.com/forums/showthread.php?t=1665](https://www.wowza.com/forums/showthread.php?t=1665)

I couldn’t find it in a search.

---

<div class="post-metadata">

**Author:** ![sam\_ola](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@sam\_ola](https://community.wowza.com/u/sam_ola)\
**Post date:** [January 23, 2010, 12:46am UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/5 "2010-01-23T00:46:43Z")

</div>

The documentation for version 2.0 says:

ModuleSecureToken

ModuleSecureToken

**com.wowza.wms.plugin.security.ModuleSecureToken**

But the file inside the “lib” folder is called “wms.plugin.security.jar”. Is there a different file to look for.

When I try to use secure connection on the server its coming up with these errors:

Missing function: FCPublish

WARN server comment 2010-01-23 00:22:45 - - - - - 149.38 - - - - - - - Missing function: createStream

WARN server comment 2010-01-23 00:22:56 - - - - - 159.633 - - - - - - - Missing function: deleteStream

WARN server comment 2010-01-23 00:22:59 - - - - - 162.57 - - - - - - - Missing function: releaseStream

WARN server comment 2010-01-23 00:22:59 - - - - - 162.57 - - - - - - - Missing function: FCPublish

WARN server comment 2010-01-23 00:22:59 - - - - - 162.571 - - - - - - - Missing function: createStream

Not sure what that means.

Thanks for any help

---

<div class="post-metadata">

**Author:** ![Cesar\_Aracena](https://avatars.discourse-cdn.com/v4/letter/c/ecc23a/32.png) [@Cesar\_Aracena](https://community.wowza.com/u/Cesar_Aracena)\
**Post date:** [August 19, 2010, 1:46pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/6 "2010-08-19T13:46:30Z")

</div>

Hi guys,

I’ve been having problems with the security settings since day one so I’m back to basics. I’m just trying to use ModuleRTMPAuthenticate so nobody else can stream into my server.

I’ve followed every step in the guide and I can still stream from Wirecast without credentials. I’m working with the **live** application to record my streams to my S3 bucket. Here’s my current conf/live/Application.xml:

```auto
<Root>
	<Application>
		<Connections>
			<AutoAccept>true</AutoAccept>
			<AllowDomains></AllowDomains>
		</Connections>
		<!--
			StorageDir path variables
			
			${com.wowza.wms.AppHome} - Application home directory
			${com.wowza.wms.ConfigHome} - Configuration home directory
			${com.wowza.wms.context.VHost} - Virtual host name
			${com.wowza.wms.context.VHostConfigHome} - Virtual host config directory
			${com.wowza.wms.context.Application} - Application name
			${com.wowza.wms.context.ApplicationInstance} - Application instance name
			
		-->
		<Streams>
			<StreamType>live-record</StreamType>
			<StorageDir>${com.wowza.wms.context.VHostConfigHome}/content</StorageDir>
			<KeyDir>${com.wowza.wms.context.VHostConfigHome}/keys</KeyDir>
			<!-- LiveStreamPacketizers (separate with commas): cupertinostreamingpacketizer, smoothstreamingpacketizer, cupertinostreamingrepeater, smoothstreamingrepeater -->
			<LiveStreamPacketizers>smoothstreamingpacketizer,cupertinostreamingpacketizer</LiveStreamPacketizers>			
			<!-- Properties defined here will override any properties defined in conf/Streams.xml for any streams types loaded by this application -->
			<Properties>
			</Properties>
		</Streams>
		<!-- HTTPStreamers (separate with commas): cupertinostreaming, smoothstreaming -->
		<HTTPStreamers>cupertinostreaming,smoothstreaming</HTTPStreamers>			
		<SharedObjects>
			<StorageDir></StorageDir>
		</SharedObjects>
		<Client>
			<IdleFrequency>-1</IdleFrequency>
			<Access>
				<StreamReadAccess>*</StreamReadAccess>
				<StreamWriteAccess>*</StreamWriteAccess>
				<StreamAudioSampleAccess></StreamAudioSampleAccess>
				<StreamVideoSampleAccess></StreamVideoSampleAccess>
				<SharedObjectReadAccess>*</SharedObjectReadAccess>
				<SharedObjectWriteAccess>*</SharedObjectWriteAccess>
			</Access>
		</Client>
		<RTP>
			<!-- RTP/Authentication/[type]Methods defined in Authentication.xml. Default setup includes; none, basic, digest -->
			<Authentication>
				<PublishMethod>digest</PublishMethod>
				<PlayMethod>none</PlayMethod>
			</Authentication>
			<!-- RTP/AVSyncMethod. Valid values are: senderreport, systemclock, rtptimecode -->
			<AVSyncMethod>senderreport</AVSyncMethod>
			<MaxRTCPWaitTime>12000</MaxRTCPWaitTime>
			<IdleFrequency>75</IdleFrequency>
			<RTSPSessionTimeout>90000</RTSPSessionTimeout>
			<RTSPMaximumPendingWriteBytes>0</RTSPMaximumPendingWriteBytes>
			<RTSPBindIpAddress></RTSPBindIpAddress>
			<RTSPConnectionIpAddress>0.0.0.0</RTSPConnectionIpAddress>
			<RTSPOriginIpAddress>127.0.0.1</RTSPOriginIpAddress>
			<IncomingDatagramPortRanges>*</IncomingDatagramPortRanges>
			<Properties>
			</Properties>
		</RTP>
		<MediaCaster>
			<Properties>
			</Properties>
		</MediaCaster>
		<MediaReader>
			<Properties>
			</Properties>
		</MediaReader>
		<MediaWriter>
			<Properties>
			</Properties>
		</MediaWriter>
		<LiveStreamPacketizer>
			<Properties>
			</Properties>
		</LiveStreamPacketizer>
		<HTTPStreamer>
			<Properties>
			</Properties>
		</HTTPStreamer>
		<Repeater>
			<OriginURL></OriginURL>
			<QueryString><![CDATA[]]></QueryString>
		</Repeater> 
		<Modules>
			<Module>
				<Name>base</Name>
				<Description>Base</Description>
				<Class>com.wowza.wms.module.ModuleCore</Class>
			</Module>
			<Module>
				<Name>properties</Name>
				<Description>Properties</Description>
				<Class>com.wowza.wms.module.ModuleProperties</Class>
			</Module>
			<Module>
				<Name>logging</Name>
				<Description>Client Logging</Description>
				<Class>com.wowza.wms.module.ModuleClientLogging</Class>
			</Module>
			<Module>
				<Name>flvplayback</Name>
				<Description>FLVPlayback</Description>
				<Class>com.wowza.wms.module.ModuleFLVPlayback</Class>
			</Module>
			<Module>
				<Name>ModuleRTMPAuthenticate</Name>
				<Description>ModuleRTMPAuthenticate</Description>
				<Class>com.wowza.wms.plugin.security.ModuleRTMPAuthenticate</Class>
			</Module>
			<Module>
				<Name>ModuleMediaWriterFileMover</Name>
				<Description>ModuleMediaWriterFileMover</Description>
				<Class>com.wowza.wms.module.ModuleMediaWriterFileMover</Class>
			</Module>
		</Modules>
		<Properties>
			<Property>
				<Name>fileMoverDestinationPath</Name>
				<Value>/mnt/s3</Value>
			</Property>
			<Property>
				<Name>fileMoverDeleteOriginal</Name>
				<Value>true</Value>
				<Type>Boolean</Type>
			</Property>
			<Property>
				<Name>fileMoverVersionFile</Name>
				<Value>true</Value>
				<Type>Boolean</Type>
			</Property>
		</Properties>
	</Application>
</Root>

```

I’ve tried none, basic and digest for PublishMethod and the video gets streamed/recorded no matter what. What can be the problem?

I have a similar problem if I try to use (in a clean application) the **ModuleRequireSecureConnection**. I can stream with both RTMP and RTMPE. Is it possible that I have to “turn on” these modules in my Wowza Server somewhere else? Simply adding them to my Application.xml doesn’t seem to affect anything at all.

BTW I did put a new username and password in the publish.password file.

Any thoughts?

Thanks 😉

---

<div class="post-metadata">

**Author:** ![Charlie\_Good](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/charlie_good/32/383_2.png) [@Charlie\_Good](https://community.wowza.com/u/Charlie_Good)\
**Post date:** [February 24, 2010, 9:52am UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/7 "2010-02-24T09:52:14Z")

</div>

Are you connecting using RTMPE? This is required if you have requireSecureConnection set.

Charlie

---

<div class="post-metadata">

**Author:** ![Charlie\_Good](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/charlie_good/32/383_2.png) [@Charlie\_Good](https://community.wowza.com/u/Charlie_Good)\
**Post date:** [May 7, 2010, 9:12am UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/8 "2010-05-07T09:12:44Z")

</div>

It is in the packaged referenced in the first post.

Charlie

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 23, 2010, 12:55am UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/9 "2010-01-23T00:55:12Z")

</div>

That’s the right jar file for that Module.

The errors indicate the Application.xml is malformed, something is out of place. If you can’t spot it, just start over with a new copy from /conf/Application.xml

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 24, 2010, 2:08am UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/10 "2010-01-24T02:08:40Z")

</div>

A jar file might have any number of Classes inside, the name is not going to indicate what those are.

You don’t need ModuleSecureToken because you already have the ModuleRTMPAuthentication, which includes SecureToken.

Refer to the ModuleRTMPAuthentication section of Security Addon guide.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 25, 2010, 9:13pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/11 "2010-01-25T21:13:01Z")

</div>

With requireSecureConnection you need to use rtmpe protocol in the player.

rtmpe://[wowza-address]/live

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 25, 2010, 9:32pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/12 "2010-01-25T21:32:55Z")

</div>

Right, that’s still just malformed Application.xml

If you can’t see the problem, it’s best to get a new copy and start over.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 25, 2010, 10:19pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/13 "2010-01-25T22:19:37Z")

</div>

If you use a new copy and remake your changes it will fix it. Try it.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 25, 2010, 10:27pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/14 "2010-01-25T22:27:10Z")

</div>

I put it in an xml validator:

[http://www.xmlvalidation.com/](http://www.xmlvalidation.com/)

And I think the problem might be your secret token, the ampersand maybe. Take out the secret token completely, see if that fixes it, then try a new one token, don’t use ampersand.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 31, 2010, 12:33pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/15 "2010-01-31T12:33:55Z")

</div>

When I try it in LiveVideoStreaming example player, the message is “Application rejected connection”. Check the doConnect token.

Try getting it to work in the example player first.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 31, 2010, 2:11pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/16 "2010-01-31T14:11:10Z")

</div>

You have the **requireSecureConnection** Property set to “true”, so you have to use a secure protocol like rtmpe (or rtmps or rtmpte).

rtmpe://destinyradiotv.org/live

This working for me on the example player. SecureToken is still not setup, or SecureURLParams connect. (SecureToken is better, use that.)

You can add SecureToken to the example player. Look for the NetConnection.Connect.Success notification and add this

```auto
if (infoObject.info.code == "NetConnection.Connect.Success")
			{
				[B]if (infoObject.info.secureToken != undefined) //<--- SecureToken change here - respond with decoded secureToken
				{
					var secureResult:Object = new Object();
					secureResult.onResult = function(isSuccessful:Boolean):void
					{
						trace("secureTokenResponse: "+isSuccessful);
					}
					nc.call("secureTokenResponse", new Responder(secureResult.onResult), TEA.decrypt(infoObject.info.secureToken, "sharedSecret"));		
				}[/B]
			}

```

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 31, 2010, 2:28pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/17 "2010-01-31T14:28:35Z")

</div>

Also, copy examples/LiveVideoStreaming/clientFlex/src/com to examples/LiveVideoStreaming/client and add import to Actionscript:

```auto
import com.meychi.ascrypt.TEA;

```

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 1, 2010, 8:05pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/18 "2010-02-01T20:05:03Z")

</div>

You recompiled in Flash CS3 or CS4? Were there errors when you did so? Did you debug in Flash CS3? Sounds like there is an error in the Actionscript.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 1, 2010, 8:14pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/19 "2010-02-01T20:14:33Z")

</div>

Does the player come up when you debug?

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 1, 2010, 8:25pm UTC](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45/20 "2010-02-01T20:25:49Z")

</div>

I am asking if the player appears in Flash CS3 or CS4 when you you select Debug \> Debug Movie from the menu.

Richard

[Next page](https://community.wowza.com/t/mediasecurity-addon-package-securetoken-rtmp-rtsp-authentication-and-more/45.md?page=2)