none
NOTICE: Customer impacting issue - Asset Storage Encryption

    General discussion

  • Due to a recent change in the Windows Azure Media Services backend, customers who use the .Net SDK are not able to create non-Storage-Encrypted assets.  This is for all jobs processed, or assets uploaded, since earlier this week.  
    We are aware of this issue and apologize for the inconvenience this may have caused our Preview customers.  We have begun steps to roll out a hotfix to the service and will be providing an update on that soon.

    Windows Azure Media Services team.

    Wednesday, October 10, 2012 4:28 PM
    Owner

All replies

  • To add on Nick's point,

    if you use the following code and hit error at GetStreamingOriginLocator

                task.OutputMediaAssets.AddNew("Output asset", true, AssetCreationOptions.None);
    

                ILocator originLocator = mediaContext.Locators.CreateOriginLocator(assetToStream,
                    streamingPolicy,
                    DateTime.UtcNow.AddMinutes(-5));
    We are aware of the issue and we are fixing it.
     
    Wednesday, October 10, 2012 5:06 PM
    Moderator
  • The thing is that there is no way to create a non encrypted output asset on the .NET SDK, so you stuck on this point. 

    Also if you try to use the Azure Decryption media processor to decrypt the asset it fails all the times.

    Wednesday, October 10, 2012 5:09 PM
  • The Hotfix for this issue is being pushed to production at this time. We will update this thread on the Forum with details when the fix is finally in place across all data centers.

    Again, we sincerely apologize for this interruption during your evaluation of our Preview release.

    There was no data lost during this issue.  Once the fix is in place, you will be able to unencrypt any files that you may have encoded using the Storage Decryption Media Processor. Additional details on how to do that will follow on this thread.

    Thanks,
    The Windows Azure Media Services team

    Wednesday, October 10, 2012 8:52 PM
    Owner
  • Hello,

    It's great, however I am facing another potential issue. The PUBLISH action does not really works for me. Here is trace of actions performed and the asset is still in "Initialized" state:

     

    POST https://wamsamsclus001rest-hs.cloudapp.net/api/Assets('nb:cid:UUID:f17d1447-6aa0-4d48-9069-2010bdab930c')/Publish
    HTTP/1.1

    User-Agent: Microsoft ADO.NET Data Services

    Accept-Charset: UTF-8

    MaxDataServiceVersion: 3.0;NetFx

    Accept: application/atom+xml,application/xml

    Authorization: Bearer http__STRIPPED_FOR_SECURITY_CONCERNS__%3d

    x-ms-version: 1.0

    Host: wamsamsclus001rest-hs.cloudapp.net

    Content-Length: 0

     

     

    HTTP/1.1

    204 No Content

    Cache-Control: no-cache

    Server: Microsoft-IIS/7.5

    request-id: fc546a42-bd54-4945-8dd0-903d3219c667

    x-ms-request-id: fc546a42-bd54-4945-8dd0-903d3219c667

    X-Content-Type-Options: nosniff

    DataServiceVersion: 1.0;

    X-AspNet-Version: 4.0.30319

    X-Powered-By: ASP.NET

    Date: Thu, 11 Oct 2012 08:14:51 GMT


    Thursday, October 11, 2012 8:24 AM
  • Update: the Hotfix has been rolled out across all data centers. Spot checking in some data centers show that the issue has been resolved. Customers should now be able to create assets that are not storage encrypted - either while uploading assets, or at the output of tasks.

    We will follow up with a separate post on the PUBLISH action - there have been changes in this area.

    Thanks for your patience,

    The Windows Azure Media Services team

    Thursday, October 11, 2012 8:31 AM
  • For your convenience, please find below some sample code to convert a Storage Encrypted asset to clear.  Once in the clear, you will be able to request origin locators on your new asset. 

    private static void ConvertAssetToClear(IAsset asset, IMediaProcessor decryptMP)
    {
        IJob job = _context.Jobs.Create("Convert Encrypted to Clear");
        ITask task = job.Tasks.AddNew("decrypt task", decryptMP, String.Empty, TaskCreationOptions.None);
        task.InputMediaAssets.Add(asset);
        task.OutputMediaAssets.AddNew("Clear" + asset.Name, true, AssetCreationOptions.None);
        job.Submit();
        // Checks job progress and prints to the console. 
        CheckJobProgress(job.Id);
        // Get an updated job reference, after waiting for the job on the thread in the CheckJobProgress method.
        job = GetJob(job.Id);
        // Get a reference to the output asset from the job.
        IAsset outputAsset = job.OutputMediaAssets[0];
        if (outputAsset.Options != AssetCreationOptions.None)
        {
            Console.WriteLine(" Could not convert asset {0} with Id {0}", asset.Name, asset.Id);
        }
        else
        {
            Console.WriteLine("Converted Encrypted asset :{0} to clear asset: {1}", asset.Name, outputAsset.Name);
            Console.WriteLine("Encrypted Asset Id:{0}", asset.Id);
            Console.WriteLine("Unencrypted Asset Id:{0}", outputAsset.Id);
        }
    }

    This code snippet works in conjunction with the .Net SDK samples.  In particular, it uses CheckJobProgress() and GetJob().  It assumes that you have enumerated the assets which may be of interest to you: those which are Storage Encrypted and have been created in the last two days.  You can identify these using:

    //
    // Look for encrypted assets in the last two days
    //
    _context= GetContext();
    IMediaProcessor decryptMP=GetMediaProcessor("Storage Decryption");
    List<IAsset> encryptedAssets = GetEncryptedAssets(System.DateTime.Now.AddDays(-2));
    //
    // Use the list to run a decryption job
    //
    foreach (IAsset asset in encryptedAssets)
    {
        ConvertAssetToClear(asset, decryptMP);
    }
    //
    //
    // Where:
    //
    static List<IAsset> GetEncryptedAssets(DateTime startDate)
    {
        var encryptedAssets = from p in _context.Assets
                              where (p.Options == AssetCreationOptions.StorageEncrypted) && (p.Created > startDate)
                              select p;
        System.Console.WriteLine(encryptedAssets.Count());
        return encryptedAssets.ToList<IAsset>();
    }

    If you have no need for a Storage Encrypted version of your asset, you can delete it once you've validated your clear asset.

    Thursday, October 11, 2012 2:36 PM
    Owner
  • Looks like the encryption problem still there. Particularly thumbnail task (using Windows Azure Media Encoder processor and .net SDK) produces encrypted images. Is it a bug which will be fixed or I should consider this behavior as correct and attach decryption tasks for each job of my web app?
    Wednesday, October 17, 2012 10:03 AM