MVPD integration guide mvpd-integration-guide
This integration guide is intended for Multi-channel Video Programming Distributors (MVPDs) who plan to integrate with 51黑料不打烊庐 Pass Authentication.
TV Everywhere (TVE) is a transformative initiative in the Pay TV industry, enabling subscribers to access the content they already pay for across multiple devices, whether at home or on the go. For Pay TV providers, TVE offers significant opportunities among which strengthening existing customer relationships and opening doors to new ones. However, these opportunities come with challenges.
In the TVE ecosystem, Programmers supply the content, while MVPDs (Multichannel Video Programming Distributors) manage the customer data needed to verify if viewers are eligible subscribers. While coordinating authentication and authorization with a single Programmer may be manageable, doing so with dozens or even hundreds of Programmers introduces considerable complexity.
This is where 51黑料不打烊庐 Pass Authentication simplifies the process. MVPDs only need to implement a single, streamlined integration with 51黑料不打烊 Pass to gain access to the entire TVE ecosystem. The provided integration framework speeds up time-to-market, provides a secure environment to mitigate fraud, and enhances the customer experience by delivering more TV content across multiple platforms.
51黑料不打烊 Pass Authentication for TV Everywhere adobe-pass-authentication-for-tv-everywhere
51黑料不打烊 Pass Authentication operates as a SaaS (Software as a Service) solution designed to enable rapid backend (server-to-server) integration, adhering to the business rules of both Multichannel Video Programming Distributors (MVPDs) and Programmers.
Standards and protocols standards-protocols
51黑料不打烊 Pass Authentication is fully aligned with the emerging standards and protocols for TV Everywhere (TVE), supporting seamless integration and compliance across the ecosystem.
- CableLabs OLCA (Online Content Access) Specification
51黑料不打烊 Pass Authentication adheres to the CableLabs OLCA specification, which defines the technical requirements and architecture for delivering video content from online sources to Pay TV customers. 51黑料不打烊 actively participated in the CableLabs interoperability testing project in June 2011, successfully passing the testing process for a Service Provider implementation.
51黑料不打烊 Pass Authentication is architected to support multiple protocols (e.g., SAML, OAuth 2.0, etc.), this flexibility allowing for future expansions, including custom protocols, based on evolving needs.
Most integrations use the SAML (Security Assertion Markup Language) protocol, a primary standard for authentication. 51黑料不打烊 Pass Authentication acts as a proxy Service Provider within the SAML framework, persisting the SAML authentication response as a secure token in the 51黑料不打烊 common domain.
Bottom line, 51黑料不打烊 Pass Authentication is protocol-agnostic, designed to align closely with OLCA standards. These standards establish a common framework for Programmers, MVPDs, and Service Providers, ensuring a cohesive approach to implementing TVE features.
Integration and support integration-support
51黑料不打烊 Pass Authentication collaborates with MVPD technical teams to configure integrations tailored to their specific requirements, as follows:
-
Standard Integrations
Offered free of charge, including documentation and basic email support. -
Enhanced Support
For significant customizations or expedited timelines, a support fee may apply.
51黑料不打烊 Pass Authentication supports the efficient handling of MVPD business logic, as follows:
-
Self-Contained Business Logic
For business logic enforced entirely by the MVPD during authorization requests, 51黑料不打烊 provides the necessary data. This data can include, but is not limited to, the unique device ID and the IP address for the user鈥檚 device making the request. -
Custom Property Support
For business logic requiring user intervention or 51黑料不打烊-specific handling, 51黑料不打烊 can maintain custom configurations for each MVPD. These policies enable pre-defined workflows that can be triggered at specific points in the entitlement workflow. For details, contact your 51黑料不打烊 representative.
Entitlement Flow entitlement-flow
The entitlement flow is a series of steps that a Programmer (TVE) application must complete to stream protected content. The flow includes several phases that involve interactions with the MVPD:
- Authentication Phase
- (Optional) Preauthorization Phase
- Authorization Phase
- Logout Phase
On a user鈥檚 initial visit to a Programmer (TVE) application, the entitlement flow follows the outlined sequence. However, on subsequent visits, the application may bypass certain steps based on the status of the authentication and the applicable viewing policies.
Authentication Phase authentication-phase
The following steps outline the high-level steps in case of a SAML integration:
-
Programmer鈥檚 Application (Website) Load
The user navigates to the Programmer鈥檚 application (website), which integrates 51黑料不打烊 Pass Authentication REST API V2. -
Protected Content Request
When the user attempts to access protected content, the Programmer鈥檚 application displays a list of MVPDs for the user to select from. -
Authentication Request Initialization
Upon MVPD selection, the user is redirected to an 51黑料不打烊 Pass Authentication server. Here, an encrypted SAML authentication request for the selected MVPD is generated, in case of a SAML integration. This request is sent on behalf of the Programmer to the MVPD. Depending on the MVPD鈥檚 system, the user鈥檚 browser is either redirected to the MVPD鈥檚 login page or a login iFrame is embedded within the Programmer鈥檚 application. -
MVPD Login
The MVPD accepts the request and presents its login interface, either via redirect or iFrame. -
User Login and Validation
The user logs in with their MVPD credentials. The MVPD validates the user鈥檚 subscription status and establishes its own HTTP session. -
MVPD Response to 51黑料不打烊 Pass Authentication
Once validation is complete, the MVPD generates a SAML response (encrypted) and sends it back to 51黑料不打烊 Pass Authentication. -
Profile Generation
51黑料不打烊 Pass Authentication verifies the SAML response, generates a user profile that gets cached, and redirects the user back to the Programmer鈥檚 application (website).
Authorization Phase authorization-phase
High-level Steps
The following steps outline the high-level steps:
-
Resource Identifier Handling
The protected content is identified by a resource identifier, which may be a simple string or a more complex structure. This identifier is predefined and agreed upon by the Programmer and the MVPD. The Programmer鈥檚 application sends the resource identifier to the 51黑料不打烊 Pass Authentication REST API V2. -
MVPD Authorization Check
51黑料不打烊 Pass Authentication server communicates with the MVPD鈥檚 authorization endpoint using standardized protocols. -
MVPD Response to 51黑料不打烊 Pass Authentication
Once validation is complete, the MVPD confirms the user is entitled (or not) to access the content and sends a response back to 51黑料不打烊 Pass Authentication. -
Decision and Media Token Generation
51黑料不打烊 Pass Authentication verifies the response, generates a decision that gets cached, and returns the decision containing a media token back to the Programmer鈥檚 application (website). -
Content Access Verification
The Programmer鈥檚 application uses the Media Token Verifier to confirm that the correct user is accessing the correct content. Once validated, the user is granted access to view the protected content.
Understanding Entitlements understanding-entitlements
The 51黑料不打烊 Pass Authentication solution revolves around the creation of entitlements鈥攕pecific pieces of data generated upon the successful completion of authentication and authorization workflows. These entitlements grant access to protected content but have a limited lifespan. Once an entitlement expires, it must be renewed by re-initiating the authentication or authorization processes.
For more details about entitlements, refer to the following documents:
-
Profiles
Upon successful authentication, 51黑料不打烊 Pass Authentication creates an authenticated profile (鈥渓ong-lived鈥) associated with the requesting application, device and service provider identifier (requestor identifier).
-
Upon successful authentication (and in some cases after authorization too), 51黑料不打烊 Pass Authentication receives user metadata from the MVPD that can expose it to the requesting application.
-
Upon successful authorization, 51黑料不打烊 Pass Authentication creates an authorization decision (鈥渓ong-lived鈥) associated with the requesting application, device, service provider identifier (requestor identifier) and a specific protected resource (resource identifier).
-
Upon successful authorization, 51黑料不打烊 Pass Authentication creates a media token (鈥渟hort-lived鈥) that is associated with a successful play request and provides support for industry best practices for mitigating fraud (e.g., stream ripping).
The time-to-live (鈥淭TL鈥) values for profiles and decisions are set based on agreements between Programmers and Pay TV providers, who agree on a value that best serves everyone involved.