[Proposal] Disable Streaming Authentication (1 Viewer)

[hkjensen]

Hi

Since MediaPortal experimental IPTV filter can't handle authentication I like would like to propose the following feature:

Disable Authentication for Streaming
- when a stream is requested ex http://xxx.xxx.xx:8080/Stream/TV?item=1012&transcoder=IPTV
- Check if authentication for streaming is disabled
- if disabled begin streaming
- else redirect to login page (normal behavior)

Requires only changes to 3 files:

Changes:

 .../Controllers/StreamController.cs                |    4 ++++
Config/Authentication.xml                          |    2 +-
.../Authentication.cs                              |    2 ++
3 files changed, 7 insertions(+), 1 deletions(-)
 
diff --git a/Applications/MPExtended.Applications.WebMediaPortal/Controllers/StreamController.cs b/Applications/MPExtended.Applications.WebMediaPortal/Controllers/StreamController.cs
index 1c4adaa..40cff28 100644
--- a/Applications/MPExtended.Applications.WebMediaPortal/Controllers/StreamController.cs
+++ b/Applications/MPExtended.Applications.WebMediaPortal/Controllers/StreamController.cs
@@ -86,6 +86,10 @@ public class StreamController : BaseController
 
        protected bool IsUserAuthenticated()
        {
+            // No authentication for streaming
+            if (!Configuration.Authentication.Streaming)
+                return true;
+
            if (PlayerOpenedBy.Contains(Request.UserHostAddress) || User.Identity.IsAuthenticated)
                return true;
 
diff --git a/Config/Authentication.xml b/Config/Authentication.xml
index a602bf4..6ada6c7 100644
--- a/Config/Authentication.xml
+++ b/Config/Authentication.xml
@@ -1,7 +1,7 @@
<?xml version="1.0" encoding="utf-8"?>
<Authentication xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://mpextended.github.com/schema/config/Users/1">
  <Enabled>true</Enabled>
- 
+  <Streaming>true</Streaming>
  <Users>
    <User>
      <Username>admin</Username>
diff --git a/Libraries/MPExtended.Libraries.Service.Config/Authentication.cs b/Libraries/MPExtended.Libraries.Service.Config/Authentication.cs
index 9306ab4..147ef9d 100644
--- a/Libraries/MPExtended.Libraries.Service.Config/Authentication.cs
+++ b/Libraries/MPExtended.Libraries.Service.Config/Authentication.cs
@@ -57,6 +57,8 @@ public class Authentication
    {
        public bool Enabled { get; set; }
 
+        public bool Streaming { get; set; }
+
        [XmlArray(Namespace = "http://mpextended.github.com/schema/config/Users/1", ElementName = "Users")]
        [XmlArrayItem(ElementName = "User")]
        public List<User> Users { get; set; }

 

[Oxan]

The patch is a bit more complicated (this disables streaming authentication for people upgrading their installation), but I'll think about it.

 

[hkjensen]

The patch doesn't disable authentication for streaming when upgrading, default value is set to authentication when streaming:
<Streaming>true</Streaming>

!Configuration.Authentication.Streaming
- returns false and therefore normal authentication is performed.

 

[Oxan]

The patch doesn't disable authentication for streaming when upgrading, default value is set to authentication when streaming:
<Streaming>true</Streaming>

Yes, but that's only the default value in the configuration files used by a new install. During an upgrade, these configuration files aren't used, but instead the default vaule of the field type (false for a boolean) is used instead. We don't have any support for introducing new configuration fields with default value yet.

 

[hkjensen]

Oh see you point - so switching the meaning off Configuration.Authentication.Streaming to "Disable Authentication for streaming" would have default value false, and then wouldn't break functionality when upgrading ??

 

[Oxan]

Yes, exactly.

 

[Oxan]

Hmm, I wanted to add this, but it seems a bit redunant for the generic disable authentication setting (which also works for streams in the upcoming 0.5.2 release). Any reason why you want to enable authentication on the API but disable it on streams?

 

[hkjensen]

Yes
Because I'm streaming tv-channels from home to other location over the internet, where a second installation of tv-server receives the tv-streams

tv-server (dvb-c) -> mpextended / webmediaportal -> internet -> tv-server (iptv) (lower bitrate) -> mediaportal client

and since current version of mediaportal tv-server iptv can't do authentication of http-streams, it has to be disabled, and since the webmediaportal is accessible from the internet i need authentication if people try to access it. I am fully aware of that streaming is accessibul to any one but, they have to generate the streaming-url by hand.

 

[Oxan]

However, if the streaming is accessible to anyone, they can perform a DOS-attack and browse through your media library (though a bit more limited) anyway, so I'm not really sure what the advantage of having the interface password-protected is.

 

[hkjensen]

I know that, but at least the webpage is not fully public available.
I don't want every one have a look at my collection.
But at the same time i need streaming with no authentication, in order to stream live-tv to another tv-server/mediaportal installation