Create Azure Media services Job from Azure Shared Website

Question 1

It is crashing in: https://github.com/WindowsAzure/azure-sdk-for-media-services/blob/3b2d5e227b2622c6d78fb10b1a733b188f1a6767/src/net/Client/DuplicatedFiles/EncryptionUtils.cs

During SaveCertificateToStore, specifically, in store.Open(OpenFlags.ReadWrite).

Where in: https://github.com/WindowsAzure/azure-sdk-for-media-services/blob/3b2d5e227b2622c6d78fb10b1a733b188f1a6767/src/net/Client/ContentKeyBaseCollection.cs

The save is called from here:

    /// <summary>
    /// Gets the certificate for protection key id.
    /// </summary>
    /// <param name="dataContext">The data context.</param>
    /// <param name="protectionKeyId">The protection key id.</param>
    /// <returns>The content key.</returns>
    internal static X509Certificate2 GetCertificateForProtectionKeyId(DataServiceContext dataContext, string protectionKeyId)
    {
        // First check to see if we have the cert in our store already.
        X509Certificate2 certToUse = EncryptionUtils.GetCertificateFromStore(protectionKeyId);

        if ((certToUse == null) && (dataContext != null))
        {
            // If not, download it from Nimbus to use.
            Uri uriGetProtectionKey = new Uri(string.Format(CultureInfo.InvariantCulture, "/GetProtectionKey?protectionKeyId='{0}'", protectionKeyId), UriKind.Relative);
            IEnumerable<string> results2 = dataContext.Execute<string>(uriGetProtectionKey);
            string certString = results2.Single();

            byte[] certBytes = Convert.FromBase64String(certString);
            certToUse = new X509Certificate2(certBytes);

            // Finally save it for next time.
            EncryptionUtils.SaveCertificateToStore(certToUse);
        }

        return certToUse;
    }

This should catch the exception and sit on it because it’s serialization is not mandatory (and impossible in WebSites due to privilege restrictions).

Something like:

// Finally try to save it for next time, as an optimization.
try{
  EncryptionUtils.SaveCertificateToStore(certToUse);
}
catch()
{
  //Do nothing, this is not mandatory and breaks Azure WebSites deployment scenarios where they do not have rights to X509Stor.Open().
  //Ref: http://stackoverflow.com/questions/18056707/create-azure-media-services-job-from-azure-shared-website
}

At this time, we don’t have the resources to test/confirm this. If you can re-build the GitHub of the SDK with the above changes, then you’d should be able to move past this.

Question 2

Problem that in order to work with certificates which are used by media services sdk to encrypt content asp.net process need to have required permissions to operate with certificates.

Unfortunately, the behavior described in question is expected and there is no current way to relax this security policy within the Window Azure Websites.

If it is not critical for your case to use any encryption method for assets, Try to explicitly set AssetCreateOptions to AssetCreationOptions.None to avoid operating with certificates

IAsset asset = _dataContext.Assets.Create("Test", AssetCreationOptions.None);

Question 3

Doesn't appear to be any straightforward way to accomplish. It would be possible by writing your own MediaServices client library, so to avoid the certificate limitation. That's obviously a huge amount of work.

I resolved it by moving the Website into an Azure WebRole. Which isn't ideal due to the increased deployment time or cost. But it appears to be the only way.

An alternative would be to use Message Queueing and a WorkerRole or a separate Services WebRole to communicate with WAMS. Then have the website still reside as an Azure website. But communicate with the new middle-man.

Question 4

It's important to use also

TaskOptions.None

see https://github.com/Azure/azure-sdk-for-media-services/issues/82