# scure streaming with authentication

**URL:** <https://community.wowza.com/t/scure-streaming-with-authentication/37094>\
**Category:** Wowza Streaming Engine\
**Created:** [February 21, 2012, 6:07am UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094 "2012-02-21T06:07:53Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![asher\_davidof](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@asher\_davidof](https://community.wowza.com/u/asher_davidof)\
**Post date:** [February 21, 2012, 6:07am UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094/1 "2012-02-21T06:07:53Z")

</div>

Hi

I have implemented an authentication model for rtsp and HTTP with my database.

I had collected some questions that i have regarding secure streaming and authentication.

I hope you will be able to clear some things for me.

1. I don’t fully understand the RTP/Authentication section in the application.xml. if i have my own rtsp auth model does it use the RTP/Authentication section

how does the rtp authentication section works.? do i need to reference my model in /conf/Authentication.xml /Digest Properties list?

1. i have seen that there is an aes 128 inscription for hls can it work also with flash http?

2. there is a reference to rtmp auth [Integrate user authentication with external systems](https://www.wowza.com/docs/how-to-integrate-wowza-user-authentication-with-external-authentication-systems-modulertmpauthenticate) it says in the api that it is

> Base class for implementing HTTP and RTSP based custom authentication class.

can someone tell me how it works to implement HTTP and rtsp auth i used onrtpseesion and onhttpsession and here i relay dont understand how it works

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 21, 2012, 6:17pm UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094/2 "2012-02-21T18:17:48Z")

</div>

1. Take a look at this post:

[https://www.wowza.com/forums/showthread.php?6704-what-is-the-best-way-to-protect-streaming-to-wowza/page3#22](https://www.wowza.com/forums/showthread.php?6704-what-is-the-best-way-to-protect-streaming-to-wowza/page3#22)

(I will update the guide with the above)

1. Wowza AES encryption doesn’t work with Flash HTTP

2. See 1

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 26, 2012, 10:52pm UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094/3 "2012-02-26T22:52:30Z")

</div>

What do you have?

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 27, 2012, 3:28pm UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094/4 "2012-02-27T15:28:33Z")

</div>

To secure the player, use ModuleSecureToken from the MediaSecurity package:

[https://www.wowza.com/docs/media-security-overview](https://www.wowza.com/docs/media-security-overview)

Re-compile JW Player with your SecureToken:

[https://www.wowza.com/docs/how-to-add-securetoken-protection-to-jw-player](https://www.wowza.com/docs/how-to-add-securetoken-protection-to-jw-player)

Secure the publishing point with ModuleSecureURLParams (alternative to ModuleRTMPAuthenticate):

[https://www.wowza.com/docs/how-to-secure-publishing-from-an-rtmp-encoder-that-does-not-support-authentication-modulesecureurlparams](https://www.wowza.com/docs/how-to-secure-publishing-from-an-rtmp-encoder-that-does-not-support-authentication-modulesecureurlparams)

For iOS, you can encrypt streams with one of these methods:

[https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method](https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method)

[https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming](https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming)

For iOS you can also authenticate querystring params to control access:

[https://www.wowza.com/docs/how-to-control-access-to-http-streams-cupertinostreaming-sanjosestreaming-smoothstreaming-mpegdashstreaming](https://www.wowza.com/docs/how-to-control-access-to-http-streams-cupertinostreaming-sanjosestreaming-smoothstreaming-mpegdashstreaming)

For RTSP to Android (recommended delivery method at this time), similar to the above, you can authenticate using data from querystring (There isn’t any other security for RTSP):

[https://www.wowza.com/docs/how-to-control-access-to-rtsp-rtp-streams](https://www.wowza.com/docs/how-to-control-access-to-rtsp-rtp-streams)

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 27, 2012, 4:48pm UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094/5 "2012-02-27T16:48:22Z")

</div>

Asaf,

You can either do it with NetConnection.connect and process in onConnect, or with NetStream.play and process in server-side override of play command. Examples of each:

[https://www.wowza.com/docs/how-to-do-user-authentication-for-flash-rtmp-client-using-jdbc-connection-to-mysql-database](https://www.wowza.com/docs/how-to-do-user-authentication-for-flash-rtmp-client-using-jdbc-connection-to-mysql-database)

[https://www.wowza.com/docs/how-to-override-play-to-control-access](https://www.wowza.com/docs/how-to-override-play-to-control-access)

Richard

---

<div class="post-metadata">

**Author:** ![asher\_davidof](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@asher\_davidof](https://community.wowza.com/u/asher_davidof)\
**Post date:** [February 26, 2012, 2:06pm UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094/6 "2012-02-26T14:06:23Z")

</div>

I am a little bit confused but I have a relative simple questions.

I don’t have a rtmp based encoder but i want to use the benefits of wowza media security.

how can i make an rtmp authentication with my database? will it work with rtmps if i enable so with wowza?

can i use it with the security token and how does the client pass the information to me?

---

<div class="post-metadata">

**Author:** ![asher\_davidof](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@asher\_davidof](https://community.wowza.com/u/asher_davidof)\
**Post date:** [February 27, 2012, 12:33am UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094/7 "2012-02-27T00:33:59Z")

</div>

I am planing to build for my clients (ios,android,googletv)a flash application that will view wowza streams via rtmp.

when they will log on to the application wjth user and pass i will pass it as a part of the stream.

also i want to use the security token ability.

currently i am streaming to wowza via vlc and i want to stream out via rtmp + additional security.

as i understand the mediasecurity with AuthenticateUsernamePasswordProviderBase workes only with wirecast and other rtmp based encoders maybe i am mistaken.

for the website client maybe i will use jw player or something similer.

i want to build the best security system as i can the only thing i came up with is useing the securetoken + pass additional arguments if there is a batter solution please let me now.

beside wowza i dont have anyone else to consult with.

---

<div class="post-metadata">

**Author:** ![asher\_davidof](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@asher\_davidof](https://community.wowza.com/u/asher_davidof)\
**Post date:** [February 27, 2012, 8:33am UTC](https://community.wowza.com/t/scure-streaming-with-authentication/37094/8 "2012-02-27T08:33:58Z")

</div>

wow richard thank you very much

i have already implemented authentication with rtsp and http and authenticate it with my database.

last question is there a wey to pass arguments via rtmp similer for rtsp and http and authenticate it with my database something like rtmp://xxxxxx/querystring ?

will the rtmpe be more “heavy” then regular rtmp?

I relay want to check rtmp for GoogleTv because of it’s added value of security also HLS (on Android 4) if it will interest anyone a will publish all of my test cancellations.

again thank you for your patient and time your support is great!!!

/Asaf