How does Wrench authentication and authorization work?

The purpose of this article is to give you an architectural overview on the security (authentication and authorization) mechanism that you can achive using Wrench module.

This diagram below shows the way Wrench associates identity to clients on Wowza side.

Wrench authentication flow

The most important thing here is the so-called token, which is practically a one-time random password that is generated on your webserver, after having successfully authenticated your website’s visitor using your custom authentication mechanism. Performing this authentication and generating and inserting the token into the database is completely under your responsibility. If you are familiar with web programming, then it should be a fairly straightforward thing to do.

In the database (which can be any JDBC-compliant RDBMS, as Wrench is completely db-agnostic) you have to store the generated token along with minimally the username and optionally you can store the IP address and the generation timestamp. You can use the IP and the timestamp to perform extra checks upon connection (see wrench.token.ip.check and wrench.token.expiry.sec in the reference docs for details)

The token is sent back to the client in the form of a video link, such as rtmp:// If you are using an embedded video player like JW Player or equivalent, you need to set up its video link accordingly.

The below diagram shows the possible checking mechanisms that you can enable.

Wrench authorization flow

First, Wrench parses the token from the connection url and fetches the associated username (and optionally IP address and timestamp) from the database using the wrench.token.resolver.sql query you configure. If the token is not present, the connection is still accepted if switchable public mode is enabled, and the current state is the public mode. (See wrench.switchable.public for details in the reference docs)

Each of the following checks is optional and can be switched on or off in the Application.xml configuration: