Session-based Authentication

In case when there is some external authorization portal, that provides authorized users with access to media resources (such as UMS:// links and pages with embedded ActiveX controls), a session-based authentication is a preferred way to handle secure access. In session-based authentication Unreal Media Server doesn't know anything about users. A secure Web-page that handles the authentication by any means, creates a session for an authorized user. When the session is created, its ID has to be added into Unreal Media Server session manager, and when the session is expired, the session ID must be removed from its internal collection of active sessions. Also, when web server returns HTML page to the client, session ID needs to be appended to UMS:// links, or UseSessionID method needs to be called in the client-side scripting for embedded ActiveX control. That way when the client sends a request for streaming media to Unreal Media Server, the session ID will be passed along, and Unreal Media Server will be able to find this Session ID in its internal collection of active sessions. If matching session ID is found, the request will be trusted and served.

Unreal Media Server exposes a COM object to programmatically add and remove session IDs to/from its internal session manager.

COM Object 

ProgID

UMediaServer.ExternalSession

Defined in UMediaServer.tlb
Exposed by UMediaServer.exe

Description

Used to add to and remove session IDs from Media Server internal session manager.

UMediaServer.ExternalSession object exposes a single interface described below.

Interface Description

Interface

IExternalSession

Interface Type

Dual Interface

Defined in UMediaServer.tlb

Description

Exposed by UMediaServer.ExternalSession COM object. Provides access to Media Server internal session manager.

IExternalSession interface provides the following 2 methods.

IExternalSession  

Type

Method

Function

AddSession

Parameters

BSTR

sNewSessionID

Session ID.

BSTR

sUserLogID

User name or ID that will appear in the log file..

Return

HRESULT

S_OK or error if call failed.

Description

Adds session ID to the Media Server internal session manager. 

Call this method when the user is authorized and session has been created.

 

IExternalSession  

Type

Method

Function

RemoveSession

Parameters

BSTR

sExistingSessionID

Session ID.

Return

HRESULT

S_OK or error if call failed.

Description

Removes session ID from the Media Server internal session manager. 

Call this method when the session is expired.

 

Important: If you call AddSession and never call RemoveSession, the session will be active for 24 hours, then the automatic garbage collector will remove it.

Note: Make sure that DCOM security for UMediaServer.ExternalSession object set up such that the account under which the object's methods are called has full access to the object. For example if IExternalSession methods are called from ASP page, Internet Guest Account should have access to the UMediaServer. ASP.NET uses ASPNET account. Use DCOMCnfg utility to adjust security settings for Unreal Media Server.