Use dual-token authentication

Ed25519 signature

1. Generate a private key:

    openssl genpkey -algorithm ed25519 -outform PEM -out SSL_KEY_NAME 
   .private.key 
   

   Replace SSL_KEY_NAME with a key name.

2. Generate a public key from the private key:

    openssl pkey -outform DER -pubout -in SSL_KEY_NAME 
   .private.key |\
   tail -c +13 |\
   python3 -c "import base64, sys; print(('%s' % base64.urlsafe_b64encode(sys.stdin.buffer.read()))[2:-1])" 
   

3. Create a new keyset with a single public key:

   Console

   1. In the Google Cloud console, go to the Media CDNpage.

      Go to Media CDN

   2. Click the Keysetstab.

   3. Click add Create keyset.

   4. For Name, enter a unique keyset name.

   5. Optional: For Description, enter a description for your keyset.

   6. Optional: Click Add label, and then enter one or more key-value pairs for your keyset.

   7. Click Add public key, and then do the following:

      1. For ID, enter an alphanumeric ID.
      2. Select Enter the value, and then specify the base64-encoded value of your Ed25519 public key.

   8. Click Create keyset.

   gcloud

   Use the gcloud edge-cache keysets create command .

   gcloud edge-cache keysets create SHORT_KEYSET_NAME 
   \
     --public-key='id= SSL_PUBLIC_KEY_NAME 
   ,value= SSL_PUBLIC_KEY_VALUE 
   '

   Replace the following:

   • SHORT_KEYSET_NAME : a unique keyset name—for example, prod-vod-keyset
   • SSL_PUBLIC_KEY_NAME : the name of your SSL public key
   • SSL_PUBLIC_KEY_VALUE : the value of your SSL public key

   To review the keys associated with the keyset, use the gcloud edge-cache keysets describe command .

   gcloud edge-cache keysets describe prod-vod-keyset

   The output is similar to the following:

   name: prod-vod-keyset
   description: "Keyset for prod.example.com"
   publicKeys:
   - id: "key-20200918"
     value: "DThVLjhAKm3VYOvLBAwFZ5XbjVyF98Ias8NZU0WEM9w"
   - id: "key-20200808"
     value: "Lw7LDSaDUrbDdqpPA6JEmMF5BA5GPtd7sAjvsnh7uDA="

   Terraform

    resource "google_network_services_edge_cache_keyset" "default" {
     name        = "prod-vod-keyset"
     description = "Keyset for prod.example.com"
     public_key {
       id    = "key-20200918"
       value = "FHsTyFHNmvNpw4o7-rp-M1yqMyBF8vXSBRkZtkQ0RKY" # Update Ed25519 public key
     }
     public_key {
       id    = "key-20200808"
       value = "Lw7LDSaDUrbDdqpPA6JEmMF5BA5GPtd7sAjvsnh7uDA=" # Update Ed25519 public key
     }
   } 
   

Symmetric-key HMAC

1. If you haven't used Secret Manager before, configure Secret Manager .

2. Create a secret .

3. Add a secret version in binary format.

4. Grant the Secret Manager Access role ( roles/secretmanager.secretAccessor ) to the Media CDN service account:

   Console

   1. In the Google Cloud console, go to the Secret Managerpage.

      Go to Secret Manager

   2. Select the checkbox next to the name of the secret.

   3. Click Show Info Panel.

   4. In the info panel, click Add principal.

   5. For New principals, enter the Media CDN service account in this format:

      service- PROJECT_NUMBER 
      @gcp-sa-mediaedgefill.iam.gserviceaccount.com

      Replace PROJECT_NUMBER with your project number.

   6. For Select a role, select Secret Manager, and then select Secret Manager Secret Accessor.

   gcloud

   Use the gcloud secrets add-iam-policy-binding command .

   gcloud secrets add-iam-policy-binding projects/ PROJECT_NUMBER 
   /secrets/ SECRET_ID 
   \
     --member="serviceAccount:service- PROJECT_NUMBER 
   @gcp-sa-mediaedgefill.iam.gserviceaccount.com" \
     --role="roles/secretmanager.secretAccessor"

   Replace the following:

   • PROJECT_NUMBER : your project number
   • SECRET_ID : the ID of the secret

5. Access your secret versions and copy the secret paths, including version numbers.

6. Create a new keyset with the shared secrets in a validation shared key:

   Console

   1. In the Google Cloud console, go to the Media CDNpage.

      Go to Media CDN

   2. Click the Keysetstab.

   3. Click add Create keyset.

   4. For Name, enter a unique keyset name.

   5. Optional: For Description, enter a description for your keyset.

   6. Optional: Click Add label, and then enter one or more key-value pairs for your keyset.

   7. To specify a validation shared key, click Add validation shared key, and then do the following:

      1. For Secret, select a secret from the list, enter a secret manually by specifying its resource ID, or create a new secret and then select it.

      2. For Secret version, select a version from the list or create a new secret version and then select it.

   8. Click Create keyset.

   gcloud

   Use the gcloud edge-cache keysets create command .

   gcloud edge-cache keysets create SHORT_KEYSET_NAME 
   \
     --validation-shared-key='secret_version=projects/ PROJECT_NUMBER 
   /secrets/ SECRET_ID 
   /versions/ KEY_VERSION 
   '

   Replace the following:

   • SHORT_KEYSET_NAME : a unique name for the keyset—for example, prod-vod-keyset
   • PROJECT_NUMBER : your project ID
   • SECRET_ID : the resource ID of the secret
   • KEY_VERSION : the secret version that you want to use

Console

1. Create or modify a keyset .

2. In the Keyssection, select Use Google-owned and managed key for dual-token authentication.

gcloud and YAML

Use either of the following options:

• Create a Google-managed signing key:

   gcloud edge-cache keysets create LONG_KEYSET_NAME 
  \
      --public-key='id=google-managed-key,managed=true' 
  

  Replace LONG_KEYSET_NAME with a key name—for example, prod-vod-keyset-long .

• Modify an existing keyset:

  1. Export your keyset to a YAML file. Use the gcloud edge-cache keysets export command .

       gcloud 
       
      edge 
      - 
      cache 
       
      keysets 
       
      export 
       
       LONG_KEYSET_NAME 
      
       
     \  
      -- 
      destination 
      = 
      prod 
      - 
      vod 
      - 
      keyset 
      - 
      long 
      . 
      yaml 
      
     

  2. In a text editor or in your configuration management tooling, edit your keyset configuration so that it looks similar to the following:

       name 
      : 
       
      projects/my-project/locations/global/edgeCacheKeysets/ LONG_KEYSET_NAME 
      
      publicKeys 
      : 
      - 
       
      id 
      : 
       
      some-key 
       
      value 
      : 
       
      MC4CAQAwBQYDK2VwBCIEINV2iYugIWBuvGBJUQ_Ab69E4v4zcVqvgYHw-iZxGzcd 
      - 
       
      id 
      : 
       
      google-managed-key 
       
      managed 
      : 
       
      true 
      
     

  3. Import the edited keyset. Use the gcloud edge-cache keysets import command :

       gcloud 
      edge 
      - 
      cache 
      keysets 
      import 
       
       LONG_KEYSET_NAME 
      
     \ -- 
      source 
      = 
      prod 
      - 
      vod 
      - 
      keyset 
      - 
      long 
      . 
      yaml 
      
     

Console

Enable short-duration token authentication on the primary manifest route:

1. In the Google Cloud console, go to the Media CDNpage.

   Go to Media CDN

2. To open the Detailspage of a service, click the service name.

3. To switch to the edit mode, click the Editbutton.

4. To navigate to the Routingsection, click Next.

5. Expand the host rule to which you'd like to add the primary manifest route rule.

6. Click Add route rule.

   Alternatively, to edit a route rule, click edit Editon the respective row.

7. In the Edit route rulepane, for Priority, set a value—for example, 1 .

8. For Description, provide a brief description that can help identify the rule in the list of rules.

9. In the Matchsection, click Add a match condition. Then, do the following:

   1. For Match type, select Path template match.
   2. For Path match, specify the names or path templates for the HLS primary playlist (M3U8) or DASH manifest (MPD) file. For more information, see Path matching .

10. Click Advanced configurations.

11. In the Route actionsection, click Add an item.

12. For Type, select CDN policy.

13. In the Signed requestsection, for Signed request mode, select Require tokens.

14. In the Signed request keysetsection, do the following:

    1. To specify the keyset for short-duration tokens, click Select a keysetand select your short-duration token keyset .

       Alternatively, to create a new keyset that has the keys that you need, click Create new keyset. Then, select it.

    2. For Signature algorithm, select Ed25519 using public keys.

    3. For Token query parameter, retain the default value, edge-cache-token .

       Alternatively, if you plan to use HLS manifest URL query parameters rather than cookies for authentication, specify the parameter in which to store the request tokens.

    4. For Max time to live, specify, in seconds, the maximum lifespan of incoming request tokens.

15. To save the changes in the Route actionsection, click Done.

16. To save the changes in the route rule, click Save.

gcloud and YAML

1. Export your Media CDN configuration into a YAML file. Use the gcloud edge-cache services export command .

     gcloud 
     
    edge 
    - 
    cache 
     
    services 
     
    export 
     
     SERVICE_NAME 
    
     
   \  
    -- 
    destination 
    = 
     FILENAME 
    
    . 
    yaml 
    
   

   Replace the following:

   • SERVICE_NAME : the name of your service
   • FILENAME : the name of your YAML file

2. To enable short-duration token authentication in the primary manifest route rule, in the route's cdnPolicy section of the YAML file, specify a signedTokensOptions configuration.

      
    pathMatchers 
    : 
     
    - 
     
    name 
    : 
     
    " ROUTE_NAME 
   " 
     
    routeRules 
    : 
     
    - 
     
    priority 
    : 
     
    1 
     
    description 
    : 
     
    " ROUTE_DESCRIPTION 
   " 
     
    origin 
    : 
     
    " ORIGIN_NAME 
   " 
     
    matchRules 
    : 
     
    - 
     
    pathTemplateMatch 
    : 
     
    "/ MANIFEST_OR_PLAYLIST 
   " 
     
    routeAction 
    : 
     
    cdnPolicy 
    : 
     
    cacheMode 
    : 
     
    CACHE_ALL_STATIC 
     
    signedRequestMode 
    : 
     
    REQUIRE_TOKENS 
     
    signedRequestKeyset 
    : 
     
     SHORT_KEYSET_NAME 
    
     
    signedRequestMaximumExpirationTtl 
    : 
     
     SIGNED_REQUEST_MAXIMUM_EXPIRATION_TIME 
    
     
    signedTokenOptions 
    : 
     
    tokenQueryParameter 
    : 
     
     SHORT_TOKEN_NAME 
    
    
   

   Replace the following:

   • ROUTE_NAME : the name of the route rule
   • ROUTE_DESCRIPTION : a description of the route rule
   • ORIGIN_NAME : the origin name
   • MANIFEST_OR_PLAYLIST : the name of the HLS primary playlist (M3U8) or DASH manifest (MPD) file. For more information, see Path matching .
   • SHORT_KEYSET_NAME : the keyset name to use for short-duration tokens
   • SIGNED_REQUEST_MAXIMUM_EXPIRATION_TIME : the expiration time for signed requests—for example, 600s . For more information, see signedRequestMaximumExpirationTtl .
   • Optional: SHORT_TOKEN_NAME : the query parameter in which to find the short token. The default value is edge-cache-token . For more information, see SignedTokenOptions .

   When using symmetric-key HMACs, in the signedTokenOptions section, append allowedSignatureAlgorithms with its value as HMAC_SHA_256 :

      
    allowedSignatureAlgorithms 
    : 
     
    - 
     
    HMAC_SHA_256 
    
   

3. To update the service, import your Media CDN configuration from the YAML file. Use the gcloud edge-cache services import command .

     gcloud 
    edge 
    - 
    cache 
    services 
    import 
     
     SERVICE_NAME 
    
   \ -- 
    source 
    = 
     FILENAME 
    
    . 
    yaml 
    
   

Console

Modify the primary manifest route rule so that Media CDN can generate long-duration tokens on the route:

1. On the Edit route rulepage, click Advanced configurations.
2. For Type, select CDN policy.
3. Expand Dual-token authentication.
4. For Signature action, select Generate new long-duration token.

5. For Signature type, select either of the following options:

   • via cookies (for HLS and DASH streaming): configures Media CDN to return an Edge-Cache-Cookie with the primary manifest response.
   • via HLS manifest URL query parameters (cookieless): configures Media CDN to manipulate the HLS primary manifest by appending a long-duration token to each URL.

6. In the Generate new long-duration tokensection, do the following:

   1. To specify a keyset for long-duration tokens, click Select a keysetand select your long-duration token keyset .

      Alternatively, click Create new keysetto create a new keyset that has the keys that you need. Then, select it.

   2. For Token TTL, specify, in seconds, the maximum lifespan of the long-duration token.

   3. For Signature type, if you selected the via cookiesoption, then, in the Copied parameterssection, select the parameters that you want Media CDN to copy from the short-duration token to the long-duration token. To use dual-token authentication, you must select either PathGlobs (or either of its aliases, acl or paths ) or URLPrefix .

      If you selected the via HLS manifest URL query parametersoption, for Token query parameter, retain the default value, edge-cache-token .

7. To save the changes in the Route actionsection, click Done.

8. To save the changes in the route rule, click Save.

   A message appears asking if you'd like to create the routes for media playlists and segments automatically or manually. If you select the automatic option, a single new route is created for the cookies signature and two routes for the cookieless signature. If you select the manual option, proceed to the next section.

gcloud and YAML

Modify the addSignatures section of the primary manifest route rule so that Media CDN can generate long-duration tokens on the route:

   
 addSignatures 
 : 
  
 actions 
 : 
  
 - 
  
 GENERATE_COOKIE 
  
 keyset 
 : 
  
  LONG_KEYSET_NAME 
 
  
 tokenTtl 
 : 
  
  TOKEN_EXPIRATION_TIME 
 
  
 copiedParameters 
 : 
  
 - 
  
 PathGlobs 
  
 - 
  
 SessionID 
 

Set-Cookie: Edge-Cache-Cookie=PathGlobs= PATHS 
~SessionID= SESSION_ID 
~Expires= EXPIRATION 
~_GO=Generated~Signature= SIGNATURE 

   
 addSignatures 
 : 
  
 actions 
 : 
  
 - 
  
 GENERATE_TOKEN_HLS_COOKIELESS 
  
 keyset 
 : 
  
  LONG_KEYSET_NAME 
 
  
 tokenTtl 
 : 
  
  TOKEN_EXPIRATION_TIME 
 
  
 copiedParameters 
 : 
  
 - 
  
 PathGlobs 
  
 - 
  
 SessionID 
  
 tokenQueryParameter 
 : 
  
  LONG_TOKEN_NAME 
 
 

#EXTM3U
#EXT-X-STREAM-INF:BANDWIDTH=1280000,AVERAGE-BANDWIDTH=1000000
http://example.com/HLS_PRIMARY_PLAYLIST.m3u8? LONG_TOKEN_NAME 
=PathGlobs= PATHS 
~SessionID= SESSION_ID 
~Expires= EXPIRATION 
~_GO=Generated~Signature= SIGNATURE 

Console

gcloud and YAML

Edit the YAML file:

   
 - 
  
 priority 
 : 
  
 2 
  
 description 
 : 
  
 " SEGMENTS_ROUTE_DESCRIPTION 
" 
  
 origin 
 : 
  
 " ORIGIN_NAME 
" 
  
 matchRules 
 : 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/**.m3u8" 
  
 # HLS media playlists 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/**.ts" 
  
 # HLS segments 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/**.m4s" 
  
 # DASH / CMAF segments 
  
 routeAction 
 : 
  
 cdnPolicy 
 : 
  
 cacheMode 
 : 
  
 CACHE_ALL_STATIC 
  
 signedRequestMode 
 : 
  
 REQUIRE_TOKENS 
  
 signedRequestKeyset 
 : 
  
  LONG_KEYSET_NAME 
 
 

Cookies

  name 
 : 
  
  SERVICE_NAME 
 
 routing 
 : 
  
 hostRules 
 : 
  
 - 
  
 hosts 
 : 
  
 - 
  
  DOMAIN_NAME 
 
  
 pathMatcher 
 : 
  
 routes 
  
 pathMatchers 
 : 
  
 - 
  
 name 
 : 
  
 " ROUTE_NAME 
" 
  
 routeRules 
 : 
  
 - 
  
 priority 
 : 
  
 1 
  
 description 
 : 
  
 " ROUTE_DESCRIPTION 
" 
  
 origin 
 : 
  
 " ORIGIN_NAME 
" 
  
 matchRules 
 : 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/ HLS_MASTER_PLAYLIST 
.m3u8" 
  
 # HLS primary playlists 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/ DASH_MANIFESTS 
.mpd" 
  
 # DASH manifests 
  
 routeAction 
 : 
  
 cdnPolicy 
 : 
  
 cacheMode 
 : 
  
 CACHE_ALL_STATIC 
  
 signedRequestMode 
 : 
  
 REQUIRE_TOKENS 
  
 signedRequestKeyset 
 : 
  
  SHORT_KEYSET_NAME 
 
  
 signedRequestMaximumExpirationTtl 
 : 
  
  SIGNED_REQUEST_MAXIMUM_EXPIRATION_TIME 
 
  
 addSignatures 
 : 
  
 actions 
 : 
  
 - 
  
 GENERATE_COOKIE 
  
 keyset 
 : 
  
  LONG_KEYSET_NAME 
 
  
 tokenTtl 
 : 
  
  TOKEN_EXPIRATION_TIME 
 
  
 copiedParameters 
 : 
  
 - 
  
 PathGlobs 
  
 - 
  
 SessionID 
  
 - 
  
 priority 
 : 
  
 2 
  
 description 
 : 
  
 " SEGMENTS_ROUTE_DESCRIPTION 
" 
  
 origin 
 : 
  
 " ORIGN_NAME 
" 
  
 matchRules 
 : 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/**.m3u8" 
  
 # HLS media playlists 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/**.ts" 
  
 # HLS segments 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/**.m4s" 
  
 # DASH / CMAF segments 
  
 routeAction 
 : 
  
 cdnPolicy 
 : 
  
 cacheMode 
 : 
  
 CACHE_ALL_STATIC 
  
 signedRequestMode 
 : 
  
 REQUIRE_TOKENS 
  
 signedRequestKeyset 
 : 
  
  LONG_KEYSET_NAME 
 
 

URL query parameters

  name 
 : 
  
  SERVICE_NAME 
 
 routing 
 : 
  
 hostRules 
 : 
  
 - 
  
 hosts 
 : 
  
 - 
  
  DOMAIN_NAME 
 
  
 pathMatcher 
 : 
  
 routes 
  
 pathMatchers 
 : 
  
 - 
  
 name 
 : 
  
 " ROUTE_NAME 
" 
  
 routeRules 
 : 
  
 - 
  
 priority 
 : 
  
 1 
  
 description 
 : 
  
 " ROUTE_DESCRIPTION 
" 
  
 origin 
 : 
  
 " ORIGIN_NAME 
" 
  
 matchRules 
 : 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/ HLS_PRIMARY_PLAYLIST 
.m3u8" 
  
 # HLS primary playlists 
  
 routeAction 
 : 
  
 cdnPolicy 
 : 
  
 cacheMode 
 : 
  
 CACHE_ALL_STATIC 
  
 signedRequestMode 
 : 
  
 REQUIRE_TOKENS 
  
 signedRequestKeyset 
 : 
  
  SHORT_KEYSET_NAME 
 
  
 signedRequestMaximumExpirationTtl 
 : 
  
  SIGNED_REQUEST_MAXIMUM_EXPIRATION_TIME 
 
  
 signedTokenOptions 
 : 
  
 tokenQueryParameter 
 : 
  
  SHORT_TOKEN_NAME 
 
  
 addSignatures 
 : 
  
 actions 
 : 
  
 - 
  
 GENERATE_TOKEN_HLS_COOKIELESS 
  
 keyset 
 : 
  
  LONG_KEYSET_NAME 
 
  
 tokenTtl 
 : 
  
  TOKEN_EXPIRATION_TIME 
 
  
 tokenQueryParameter 
 : 
  
  LONG_TOKEN_NAME 
 
  
 copiedParameters 
 : 
  
 - 
  
 PathGlobs 
  
 - 
  
 SessionID 
  
 - 
  
 priority 
 : 
  
 2 
  
 description 
 : 
  
 " PLAYLIST_ROUTE_DESCRIPTION 
" 
  
 origin 
 : 
  
 " ORIGIN_NAME 
" 
  
 matchRules 
 : 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/**.m3u8" 
  
 # HLS media playlists 
  
 routeAction 
 : 
  
 cdnPolicy 
 : 
  
 cacheMode 
 : 
  
 CACHE_ALL_STATIC 
  
 signedRequestMode 
 : 
  
 REQUIRE_TOKENS 
  
 signedRequestKeyset 
 : 
  
  LONG_KEYSET_NAME 
 
  
 addSignatures 
 : 
  
 actions 
 : 
  
 - 
  
 PROPAGATE_TOKEN_HLS_COOKIELESS 
  
 - 
  
 priority 
 : 
  
 3 
  
 description 
 : 
  
 " SEGMENTS_ROUTE_DESCRIPTION 
" 
  
 origin 
 : 
  
 " ORIGIN_NAME 
" 
  
 matchRules 
 : 
  
 - 
  
 pathTemplateMatch 
 : 
  
 "/**.ts" 
  
 # HLS segments 
  
 routeAction 
 : 
  
 cdnPolicy 
 : 
  
 cacheMode 
 : 
  
 CACHE_ALL_STATIC 
  
 signedRequestMode 
 : 
  
 REQUIRE_TOKENS 
  
 signedRequestKeyset 
 : 
  
  LONG_KEYSET_NAME