Use dual-token authentication

Ed25519 signature

1. Generate a private key:

   openssl genpkey -algorithm ed25519 -outform PEM -out SSL_KEY_NAME.private.key
   

   Replace SSL_KEY_NAME with a key name.

2. Generate a public key from the private key:

   openssl pkey -outform DER -pubout -in SSL_KEY_NAME.private.key |\
   tail -c +13 |\
   python3 -c "import base64, sys; print(('%s' % base64.urlsafe_b64encode(sys.stdin.buffer.read()))[2:-1])"
   

3. Create a new keyset with a single public key:

   Console

   1. In the Google Cloud console, go to the Media CDN page.

      Go to Media CDN

   2. Click the Keysets tab.

   3. Click addCreate keyset.

   4. For Name, enter a unique keyset name.

   5. Optional: For Description, enter a description for your keyset.

   6. Optional: Click Add label, and then enter one or more key-value pairs for your keyset.

   7. Click Add public key, and then do the following:

      1. For ID, enter an alphanumeric ID.
      2. Select Enter the value, and then specify the base64-encoded value of your Ed25519 public key.

   8. Click Create keyset.

   gcloud

   Use the gcloud edge-cache keysets create command.

   gcloud edge-cache keysets create SHORT_KEYSET_NAME \
     --public-key='id=SSL_PUBLIC_KEY_NAME,value=SSL_PUBLIC_KEY_VALUE'
   

   Replace the following:

   • SHORT_KEYSET_NAME: a unique keyset name—for example, prod-vod-keyset
   • SSL_PUBLIC_KEY_NAME: the name of your SSL public key
   • SSL_PUBLIC_KEY_VALUE: the value of your SSL public key

   To review the keys associated with the keyset, use the gcloud edge-cache keysets describe command.

   gcloud edge-cache keysets describe prod-vod-keyset
   

   The output is similar to the following:

   name: prod-vod-keyset
   description: "Keyset for prod.example.com"
   publicKeys:
   - id: "key-20200918"
     value: "DThVLjhAKm3VYOvLBAwFZ5XbjVyF98Ias8NZU0WEM9w"
   - id: "key-20200808"
     value: "Lw7LDSaDUrbDdqpPA6JEmMF5BA5GPtd7sAjvsnh7uDA="
   

   Terraform

   resource "google_network_services_edge_cache_keyset" "default" {
     name        = "prod-vod-keyset"
     description = "Keyset for prod.example.com"
     public_key {
       id    = "key-20200918"
       value = "FHsTyFHNmvNpw4o7-rp-M1yqMyBF8vXSBRkZtkQ0RKY" # Update Ed25519 public key
     }
     public_key {
       id    = "key-20200808"
       value = "Lw7LDSaDUrbDdqpPA6JEmMF5BA5GPtd7sAjvsnh7uDA=" # Update Ed25519 public key
     }
   }

Symmetric-key HMAC

1. If you haven't used Secret Manager before, configure Secret Manager.

2. Create a secret.

3. Add a secret version in binary format.

4. Grant the Secret Manager Access role (roles/secretmanager.secretAccessor) to the Media CDN service account:

   Console

   1. In the Google Cloud console, go to the Secret Manager page.

      Go to Secret Manager

   2. Select the checkbox next to the name of the secret.

   3. Click Show Info Panel.

   4. In the info panel, click Add principal.

   5. For New principals, enter the Media CDN service account in this format:

      service-PROJECT_NUMBER@gcp-sa-mediaedgefill.iam.gserviceaccount.com
      

      Replace PROJECT_NUMBER with your project number.

   6. For Select a role, select Secret Manager, and then select Secret Manager Secret Accessor.

   gcloud

   Use the gcloud secrets add-iam-policy-binding command.

   gcloud secrets add-iam-policy-binding projects/PROJECT_NUMBER/secrets/SECRET_ID \
     --member="serviceAccount:service-PROJECT_NUMBER@gcp-sa-mediaedgefill.iam.gserviceaccount.com" \
     --role="roles/secretmanager.secretAccessor"
   

   Replace the following:

   • PROJECT_NUMBER: your project number
   • SECRET_ID: the ID of the secret

5. Access your secret versions and copy the secret paths, including version numbers.

6. Create a new keyset with the shared secrets in a validation shared key:

   Console

   1. In the Google Cloud console, go to the Media CDN page.

      Go to Media CDN

   2. Click the Keysets tab.

   3. Click addCreate keyset.

   4. For Name, enter a unique keyset name.

   5. Optional: For Description, enter a description for your keyset.

   6. Optional: Click Add label, and then enter one or more key-value pairs for your keyset.

   7. To specify a validation shared key, click Add validation shared key, and then do the following:

      1. For Secret, select a secret from the list, enter a secret manually by specifying its resource ID, or create a new secret and then select it.

      2. For Secret version, select a version from the list or create a new secret version and then select it.

   8. Click Create keyset.

   gcloud

   Use the gcloud edge-cache keysets create command.

   gcloud edge-cache keysets create SHORT_KEYSET_NAME \
     --validation-shared-key='secret_version=projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION'
   

   Replace the following:

   • SHORT_KEYSET_NAME: a unique name for the keyset—for example, prod-vod-keyset
   • PROJECT_NUMBER: your project ID
   • SECRET_ID: the resource ID of the secret
   • KEY_VERSION: the secret version that you want to use

Console

1. Create or modify a keyset.

2. In the Keys section, select Use Google-owned and managed key for dual-token authentication.

gcloud and YAML

Use either of the following options:

• Create a Google-managed signing key:

  gcloud edge-cache keysets create LONG_KEYSET_NAME \
      --public-key='id=google-managed-key,managed=true'
  

  Replace LONG_KEYSET_NAME with a key name—for example, prod-vod-keyset-long.

• Modify an existing keyset:

  1. Export your keyset to a YAML file. Use the gcloud edge-cache keysets export command.

     gcloud edge-cache keysets export LONG_KEYSET_NAME \
        --destination=prod-vod-keyset-long.yaml
     

  2. In a text editor or in your configuration management tooling, edit your keyset configuration so that it looks similar to the following:

     name: projects/my-project/locations/global/edgeCacheKeysets/LONG_KEYSET_NAME
     publicKeys:
     - id: some-key
       value: MC4CAQAwBQYDK2VwBCIEINV2iYugIWBuvGBJUQ_Ab69E4v4zcVqvgYHw-iZxGzcd
     - id: google-managed-key
       managed: true
     

  3. Import the edited keyset. Use the gcloud edge-cache keysets import command:

     gcloud edge-cache keysets import LONG_KEYSET_NAME \
         --source=prod-vod-keyset-long.yaml
     

Console

Enable short-duration token authentication on the primary manifest route:

1. In the Google Cloud console, go to the Media CDN page.

   Go to Media CDN

2. To open the Details page of a service, click the service name.

3. To switch to the edit mode, click the Edit button.

4. To navigate to the Routing section, click Next.

5. Expand the host rule to which you'd like to add the primary manifest route rule.

6. Click Add route rule.

   Alternatively, to edit a route rule, click editEdit on the respective row.

7. In the Edit route rule pane, for Priority, set a value—for example, 1.

8. For Description, provide a brief description that can help identify the rule in the list of rules.

9. In the Match section, click Add a match condition. Then, do the following:

   1. For Match type, select Path template match.
   2. For Path match, specify the names or path templates for the HLS primary playlist (M3U8) or DASH manifest (MPD) file. For more information, see Path matching.

10. Click Advanced configurations.

11. In the Route action section, click Add an item.

12. For Type, select CDN policy.

13. In the Signed request section, for Signed request mode, select Require tokens.

14. In the Signed request keyset section, do the following:

    1. To specify the keyset for short-duration tokens, click Select a keyset and select your short-duration token keyset.

       Alternatively, to create a new keyset that has the keys that you need, click Create new keyset. Then, select it.

    2. For Signature algorithm, select Ed25519 using public keys.

    3. For Token query parameter, retain the default value, edge-cache-token.

       Alternatively, if you plan to use HLS manifest URL query parameters rather than cookies for authentication, specify the parameter in which to store the request tokens.

    4. For Max time to live, specify, in seconds, the maximum lifespan of incoming request tokens.

15. To save the changes in the Route action section, click Done.

16. To save the changes in the route rule, click Save.

gcloud and YAML

1. Export your Media CDN configuration into a YAML file. Use the gcloud edge-cache services export command.

   gcloud edge-cache services export SERVICE_NAME \
       --destination=FILENAME.yaml
   

   Replace the following:

   • SERVICE_NAME: the name of your service
   • FILENAME : the name of your YAML file

2. To enable short-duration token authentication in the primary manifest route rule, in the route's cdnPolicy section of the YAML file, specify a signedTokensOptions configuration.

     pathMatchers:
     - name: "ROUTE_NAME"
       routeRules:
       - priority: 1
         description: