ASP.NET Framework 4.8 video DRM integration

The three places you customize#

1. ConfigureApp_Code/DrmXPlayback.cs: Settings

   Set request-time content lookup and server-owned policy.

2. Authorize

   Your Application_Start

   Assign ApplicationServices.Authorize using your own permission query.

3. Embed

   Default.aspx or your existing page

   Copy the player markup and route it to Playback.ashx.

1. Add the adapter to Windows/IIS#

Use .NET Framework 4.8 or 4.8.1. This integration ships source rather than a NuGet SDK. Copy App_Code/DrmXPlayback.cs and Playback.ashx into a Web Site project; in a Web Application/MVC project compile the C# file as application source. Merge the relevant Web.config settings with your existing authentication.

2. Test one Content ID#

Set ContentId and Policy in Settings. Set the server process variables DRMX_PLAYBACK_SITE_ID, DRMX_PLAYBACK_SITE_KEY, DRMX_PLAYBACK_ACCESS_KEY and DRMX_PUBLIC_ORIGIN.

# Local IIS Express only, after setting the three credentials:
$env:DRMX_PUBLIC_ORIGIN = "http://localhost:48087"
$env:DRMX_LOCAL_DEMO = "1"
& "$env:ProgramFiles/IIS Express/iisexpress.exe" "/path:$PWD" /port:48087 /systray:false

Run from examples/aspnet-framework, then open http://localhost:48087/Default.aspx. IIS inherits the server environment. Recycle your application pool after changing its deployment settings.

3. Connect your existing permissions#

In your application startup, assign the delegate. The repository call is illustrative:

ApplicationServices.Authorize = (userId, contentId, contentType) =>
    customerPermissions.CanWatch(userId, contentId, contentType);

The handler reads authenticated HttpContext.User, preferring NameIdentifier and falling back to Identity.Name. Use a stable account identifier. Resolve the selected website video to its Content ID at request time; preserve that selection in both the page and handler URL if your lookup needs it.

4. Reuse the player markup#

Copy the script tags and Web Component from Default.aspx. Keep the session handler on the same origin; adjust application-relative URLs for an IIS virtual directory. Retain request validation, response Content ID binding and your application’s CSRF/session protections. Disable DRMX_LOCAL_DEMO before deployment.

Check before going live#

• Sign in as an allowed user and play a published video in a supported browser.
• Try signed-out and unpaid users, then revoke or expire access. New session requests must be denied.
• Change the browser Content ID or website video ID. The server must check the new selection.
• Set the exact public HTTPS origin, keep your framework’s session/CSRF protection, and disable demo identity code.

Existing sessions and DRM licenses have their own lifetimes. Permission changes are checked on new requests; they do not erase a license already issued.