Mosaic DRM Service
The Mosaic DRM Service is the recommended way to set up and operate Axinom DRM for a Mosaic environment.
It is a managed service that you enable for an environment like any other Mosaic service. Once enabled, your DRM configuration lives in the Management System, next to your videos and other content, and the License Service and Key Service endpoints for that environment are shown to you directly.
Why use it​
Traditionally, a DRM configuration was created in Axinom Portal, and its secrets were then copied into every system that needed them. The Mosaic DRM Service removes that step.
- No management key to store. Key seeds, communication keys, and FairPlay credentials are managed in the Management System, and access is controlled by ordinary Mosaic permissions. There is no separate secret that can be lost or leaked.
- No DRM credentials in encoding jobs. The token that authorizes an encoding job is also used to request content keys, so you no longer pass a tenant ID, a management key, or a key seed, and you no longer need credentials protection for DRM. See Protecting Videos in Mosaic.
- One place for DRM settings. License Service and Key Service configuration sit in the same Management System as the rest of your workflow.
- Clean separation per environment. Each environment keeps its own DRM settings, so your development, test, and production setups never share secrets.
DRM configurations created in Axinom Portal continue to work, and their documentation remains available. See DRM Managed Mode if you integrate Axinom DRM from outside Mosaic, or if you are not ready to migrate.
Enabling the service​
Enable the DRM Service for an environment from the Environment Details station in the Admin Portal, the same way you enable any other managed service. See Enabling and Disabling Services for the full procedure.
That is the whole setup. The environment is ready for DRM, and the Axinom FairPlay Streaming Test certificate is available so you can evaluate FairPlay right away.
You can start protecting and playing content immediately. Before going to production, register your own FairPlay certificate, as described under FairPlay Credentials.
Disabling the service purges its data, including key seeds and communication keys. Content that was encrypted with a purged key seed can no longer be played.
Service endpoints​
Open the DRM Service station in the Management System, under Admin Settings, to see the endpoints assigned to your environment. Each URL can be copied directly from the station.
License Service API URLs
| API | Purpose |
|---|---|
| Management API | Managing License Service configuration, such as blocked users and Widevine data sets |
| PlayReady API | License requests from PlayReady clients |
| Widevine API | License requests from Widevine clients |
| FairPlay API | License requests from FairPlay clients |
Configure your video player with the PlayReady, Widevine, and FairPlay URLs.
Key Service API URLs
| API | Purpose |
|---|---|
| Management API | Acquiring content keys, for example from the Encoding Service in DRM Managed Mode |
| Speke | SPEKE key exchange |
| Speke V2 | SPEKE 2.0 key exchange |
| CENC | Widevine Common Encryption key exchange |
| Anevia | Key exchange with Anevia packagers |
| Harmonic | Key exchange with Harmonic packagers |
| Broadpeak | Key exchange with Broadpeak packagers |
The Key Service Management API URL is the value you pass as ApiUrl when you protect videos during encoding.
The remaining Key Service URLs let third-party encoders and packagers acquire keys over the protocol they support.
Working with the Video Service​
The DRM Service is the content protection half of the Video Service workflow. With both services enabled for an environment, protecting a video is one setting rather than a configuration exercise:
| Step | Where |
|---|---|
| Enable the DRM Service | Environment Details, in the Admin Portal |
| Switch on DRM Protection in a processing profile | Settings / Processing, in the Management System |
| Encode the video | The Video Service, or its GraphQL API and messaging commands |
The Encoding Service requests the content keys for the job from the Key Service of the environment, authorized by the Mosaic JWT that started the job. Nothing has to be entered in the DRM Settings of the Video Service, and no DRM secret travels with the job. See Protecting Videos in Mosaic and Set up Encoding Profiles.
Playback follows the same environment:
- The Key IDs of a protected video are stored with the video, so your Entitlement Service can name them in the entitlement message it issues.
- The entitlement message is signed with a communication key of the environment, and redeemed at its License Service endpoints.
- Editors can play protected videos in the Management System, see Previewing Videos in the Management System.
Permissions​
Access to the DRM settings is granted through the DRM Service permissions of a user or service account:
| Permission | Grants |
|---|---|
| SETTINGS_VIEW | Read access to the DRM settings |
| SETTINGS_EDIT | Creating and changing key seeds, communication keys, and certificates |
| ADMIN | Full access to the service |
Because DRM secrets are protected by these permissions, grant SETTINGS_EDIT and ADMIN only to the users who administer content protection. See User Roles for how permissions are assigned.
Next steps​
- Configuring DRM in the Management System - key seeds, communication keys, FairPlay credentials, and Widevine settings
- Protecting Videos in Mosaic - protect videos during encoding without passing DRM credentials
- Set up Encoding Profiles - encode and protect videos from the Video Service