Configuration Options
This document describes configuration options for Axinom DRM License Service for Widevine, FairPlay, and PlayReady.
Conventions
In this document, the <APP_PATH> refers to the application root path.
When a relative path is specified as an option, it is relative to the <APP_PATH>.
The application root path is defined as follows:
- FairPlay - location of FairPlayApi.exe
- PlayReady - location of PlayReadyNetCore.exe
- Widevine - location of WidevineApi.exe
Common Options
The following options are supported for all DRM technologies.
AllowProxy
Specifies whether a reverse proxy is used.
If set to "true", the app assumes that all requests come through a trusted proxy.
It then determines the HTTP scheme and the IP of the client via the
X-Forwarded-For and X-Forwarded-Proto HTTP headers (set by the proxy),
respectively.
If set to "false", the actual HTTP scheme and the IP of the HTTP request are used.
If no proxy is present, a setting of "true" creates a security risk as clients can then forge their HTTP scheme and IP address by manipulating the headers. Change this setting only if you understand the consequences.
By default, the setting is "true" for FairPlay and Widevine, as the default container image includes an Nginx reverse proxy that provides HTTPS support.
For PlayReady, the default is "false", since it is an ASP.NET app integrated with the IIS web server.
|
Required |
No |
|
Default value |
FairPlay and Widevine - "true", PlayReady - "false" |
|
Data type |
Boolean |
|
Supported values |
|
ConfigurationFolderPath
Specifies the folder where the app searches for its configuration and other DRM technology-specific files. Within this document, this path is referred to as the <CONFIG_PATH>.
| Required | No |
| Default value | PlayReady - "C:\Config" (on Windows), Widevine and FairPlay - "/Config" |
| Data type | String |
| Supported values | Any path in string format. |
EncryptedEncryptionKeyAsBase64
Specifies the encryption key, provided in an encrypted form, that the app uses
for encrypting and decrypting configuration data in KeySeeds.json, CommunicationKeys.json.
The value is encrypted with the key known to Axinom DRM License Service.
| Required | Yes |
| Data type | Base64 string |
| Supported values | Any base64 string that represents an array of 16 bytes. For example: "MlypQgoalSkaX/x1YvnRiA==". |
FrontendDataFolderPath
Specifies the location where frontend data is stored.
| Required | No |
| Default value | "<CONFIG_PATH>" |
| Data type | String |
| Supported values | Any path in string format. |
FrontendDataUpdateInterval
Specifies the interval at which the tenant configuration data (=Frontend Data) is reloaded. The interval begins when the application is started or when the last update occurs.
To disable automatic updates, the value can be set to "0".
See also: Updating On-board Configuration.
|
Required |
No |
|
Default value |
"5:00" (5 minutes) |
|
Data type |
TimeSpan string |
|
Supported values |
|
FairPlay
There are no FairPlay-specific configuration options.
PlayReady
RevocationDataUpdateInterval
Specifies the interval at which the Revocation List file is reloaded. The interval begins when the application is started or when the last update occurs.
To disable automatic updates, the value can be set to "0".
See also: Revocation List.
| Required | No |
| Default value | "7.00:00:00" |
| Data type | String |
| Supported values | Any string in "days.hours:minutes:seconds" format. Examples: "7.12.00:05" (7 days, 12 hours and 5 seconds), "12.00:00" (12 hours), "5:00" (5 minutes), "30" (30 seconds). |
ServerCertificateFilePath
Specifies the location of the PlayReady server certificate file.
| Required | No |
| Default value | "<CONFIG_PATH>/ServerCertificate.xml" |
| Data type | String |
| Supported values | Any file path in string format that points to a PlayReady server certificate XML file. |
ServiceId
Specifies the PlayReady Service ID. Use the value you have received from Microsoft as part of your PlayReady License Server agreement or deliverables, if present. If you have received no fixed Service ID from Microsoft, freely generate a GUID and use that value consistently in your deployments. In the current feature-set provided by Axinom, only the value of Device IDs reported by the PlayReady SDK and API is affected by the Service ID. A Service ID must be set for the app to function.
| Required | Yes |
| Data type | GUID string |
| Supported values | Any valid GUID string in the 00000000-0000-0000-0000-000000000000 format. |
Widevine
AllowUnknownDevices
Specifies whether to allow unknown devices, i.e. the devices not present in the device certificate status list, to obtain licenses.
Enabling this option to allow unknown devices poses a security risk.
See also: Allowing Unknown Devices.
|
Required |
No |
|
Default value |
"false" |
|
Data type |
Boolean |
|
Supported values |
|
DeviceCertificateStatusListExpirationTime
Specifies the duration after which the device certificate status list expires.
The expiration time is relative to the creation timestamp embedded into the device
certificate status list data structure. This time must be at least 1 minute longer
than DeviceCertificateStatusListUpdateInterval and cannot be "0".
The default value is 50 years to simplify offline deployments.
| Required | No |
| Default value | "18250.00:00:00" (50 years) |
| Data type | TimeSpan string |
| Supported values | Any string in the "days.hours:minutes:seconds" format. For example: "7.12.00:05" (7 days, 12 hours and 5 seconds), "12.00:00" (12 hours), "5:00" (5 minutes), "30" (30 seconds). |
DeviceCertificateStatusListUpdateInterval
Specifies the interval at which the Device Certificate Status List file is reloaded. The interval begins when the application is started or when the last update occurs.
To disable automatic updates, the value can be set to "0".
See also: Device Certificate Status List.
| Required | No |
| Default value | "24:00:00" |
| Data type | TimeSpan string |
| Supported values | Any string in the "days.hours:minutes:seconds" format. Examples: "7.12.00:05" (7 days, 12 hours and 5 seconds), "12.00:00" (12 hours), "5:00" (5 minutes), "30" (30 seconds). |
ServiceCertificateFilePath
Specifies the path to the service certificate file.
|
Required |
No |
|
Default value |
"<CONFIG_PATH>/ServiceCertificate.bin" |
|
Data type |
String |
|
Supported values |
Any file path in string format that points to the DER-encoded service certificate file. |
ServiceCertificatePrivateKeyFilePath
Specifies the path to the private key file that is paired with the service certificate.
| Required | No |
| Default value | "<CONFIG_PATH>/PrivateKey.der" |
| Data type | String |
| Supported values | Any file path in string format that points to the service certificate’s private key file. The file must contain a PKCS#8 private key in DER format. |
EncryptedServiceCertificatePrivateKeyPasswordAsBase64
Specifies the service certificate’s private key’s password in an encrypted form. If you have your own certificate and password, provide the password to Axinom to get the encrypted value.
| Required | Yes |
| Data type | Base64 string |
| Supported values | Any base64 string. For example: "MlypQgoalSkaX/x1YvnRiA==". |