[Feature request] Add support for fetching keys from Licence Server

[lavish440]

Describe the feature

I was trying to get a MPD stream working with clearkeys.
I am using my own licence server to supply the clearkeys in the format kid:key.
The keys are rotated after sometime, so I can't hardcode them in the m3u.

I am using the following format to supply the keys:
#KODIPROP:inputstream.adaptive.drm_legacy=org.w3.clearkey|http://localhost:5000/stream1

But it fails with the error:
License server URL not found

Motivation

The reason is that the keys keep changing so they can't be directly hard coded in the playlist.

Are you willing to contribute in development?

No

Should a possible backport be considered?

No

[CastagnaIT]

fetching keys from the license server works, but currently only when the license url is provided by manifest
anyway also if you try add the licenseurl to manifest there is no key rotation support in ISA

set the license url by using drm_legacy prop, for clearkey is not supported atm

this request is somewhat similar to #1602
when the time comes we will need a stream that we can test in order to do the implementation

[lavish440]

I don't require Key Rotation because it is handled by my server. I just need a way to specify the License URL using drm_legacy

[CastagnaIT]

you have written key rotation so i misinterpreted that you need the key rotation support

if so should not be too much effort to add it,
can you attach a manifest so that i can understand better the use case?

[lavish440]

Here is the manifest. Some things have been redacted.
manifest.txt

[CastagnaIT]

i made the implementation
you can test under Kodi 22 (backport later) by using test builds from:
https://jenkins.kodi.tv/blue/organizations/jenkins/xbmc%2Finputstream.adaptive/detail/PR-1638/3/artifacts

you can set drm_legacy with the license server url

[lavish440]

What should be the response of the licence server?
Many other players will look for the keys property in the response JSON.
Here is my response JSON:

"title": "Custom Serve",
    "data": {
        "id": "90",
        "title": "stream name here",
        "initialUrl": "redacted",
        "logo": "redacted",
    },
    "key": {
        "keys": [
            {
                "kty": "oct",
                "k": "redacted",
                "kid": "redacted"
            }
        ],
        "type": "temporary"
    }

[CastagnaIT]

there is only a single standard for the license respose data
this is specified on https://www.w3.org/TR/encrypted-media/#clear-key-license-format chapter 9.1.4
on chapter 9.1.4.1 there is the example

[lavish440]

So the server should only return the key array or will InputStream be able to find the key array from the sample response that I provided?

[CastagnaIT]

you should return the "keys" array wrapped in a dictionary as shown in the example
the provided KID's from license server must match the KID's of the MPD manifest

in your JSON response above, seem to match the requirements if the redacted data are right, just need to remove uneeded things

[lavish440]

you should return the "keys" array wrapped in a dictionary as shown in the example

I think I am not getting it sorry.
So my provided example should work?

[CastagnaIT]

as is no. as already said above, the license server need to return the JSON format as specified on linked specs and its example

[CastagnaIT]

in other words,
you license server need to pick the dict value from "key" entry of your JSON,
and then return to the HTTP license response that dict data

[lavish440]

I built Kodi and InputStream Adaptive from their default branch.
My stream still fails to play. After further investigation, I found out that there is no request made to the license Server for keys.

Edit: My bad. I thought the PR had been merged.
Anyways, I compiled from the clearkey_improvs branch from your repo and the addon seems to make a post request to the server with the kid as the request body.

It works!!!
Thanks a lot.

[lavish440]

Also, if the server returns multiple keyid: key pairs, will it be able to extract the key corresponding with the keyid in the request body?

[CastagnaIT]

if the server returns multiple keyid: key pairs

no, it is expected that a license server will reply appropriately to ISA license request
by providing the KID/keys for the requested KID's, and not a random response

so your license server must meet the ISA license request data,
if there is one single KID requested must reply with one KID/Key pair, if multiple KID's are requested, multiple KID/Key's replied

if for any reason your license server go in error or is unable to meet the request, must reply with an http error such as HTTP error 500

atm ISA should make a separate license request for each single KID, and not all-in-one,
but it is not guaranteed that this will still be the case in the future, so the server must comply with what is requested

[lavish440]

Closing this issue for now as everything is working as expected.
Will provide feedback if anything unusual occurs.

[lavish440]

@CastagnaIT After using this for some time, I have found an issue, if there is a _ in the response KID or KEY, InputStream Adaptive will fail but if that is replaced by a / it works.
But on the w3 specification, _ is used.

[CastagnaIT]

you are right, there is an oversight, i will fixit

[lavish440]

I also want to report another bug. Don't know what's causing it.
It happened when I updated to Kodi master and ISA master.
The issue: If the manifest URL contains two or more consecutive /, ISA will treat it as a single / causing the playback to fail.
Happens on both PVR and Video plug-in.

[CastagnaIT]

urls have a standard RFC definition, if you do not follow the standards urls cannot be handled correctly,
please provide examples or non working urls

[lavish440]

They worked previously. But they don't now.
I can't provide the exact URLs as the stream is Geo-Locked and needs JWTs and Cookies to access it.
Here is an example:
https://example.com//stream/index.m3u8

[CastagnaIT]

yeah no need to test it just to look at url string

two backslashes is an unusual thing, it should means empty/no folder

the first thing is make sure that the original url from the website is the same, and not copied wrongly

it could be replaced as https://example.com/stream/index.m3u8
but if the website really use it, it could means specific things on the webserver so not so good remove it

so verify that the website actually uses it, if so, please open a separate issue thanks

[lavish440]

Opening a separate issue.