Audio Streaming Via Agilicus AnyX
Hosted Icecast
In this example, we will show setting up an “Icecast” audio streaming system
Overview
In this example, we will show setting up an “Icecast” audio streaming system, and force users to be authenticated via OpenID Connect. We will also show Authorisation: a set of “viewers” who can stream the music, and an Administrator.
For this example we will use an onsite connector as a means of reaching the Icecast server. Go through the steps to install this now (or use one already installed).
First, let us open the “New Application” menu. We will do this manually (without a template) to demonstrate.
![Sample: Hosted Icecast 2 c4ed3c57 image](https://www.agilicus.com/www/c4ed3c57-image.png)
Give the application a name. This must be a valid hostname (it will be part of the URL a user will use, e.g. https://<NAME>.<DOMAIN>
. You may describe the application and give it a category, these are just used for reporting purposes.
![Sample: Hosted Icecast 3 950db2f0 image](https://www.agilicus.com/www/950db2f0-image.png)
You have a choice: you can supply your own domain name (in which case you must put a CNAME in your DNS pointing to our domain ca-1.agilicus.ca), or you may use a name from the CNAME you set up when you created the organisation initially.
![Sample: Hosted Icecast 4 cd35e726 image](https://www.agilicus.com/www/cd35e726-image.png)
Now we indicate how the upstream Icecast application is accessed. We will do this via the onsite connector.
![Sample: Hosted Icecast 5 e1abbf61 image](https://www.agilicus.com/www/e1abbf61-image.png)
Select the specific connector (which we previously created and installed).
![Sample: Hosted Icecast 6 2d7652f4 image](https://www.agilicus.com/www/2d7652f4-image.png)
You now have 2 choices. You may have a full web application firewall with fine-grained (e.g. per transaction) audit logs, or you may have a perfect TLS session end to end transparent (in which case the private key will be solely on your site: we will have no access). For this demonstration, we will use the Enhanced Web Application Firewall.
![Sample: Hosted Icecast 7 f8f42442 image](https://www.agilicus.com/www/f8f42442-image.png)
We now enter the coordinates (in the private network, e.g. as would be reachable by that onsite connector) for the Icecast server.
![Sample: Hosted Icecast 8 b1a20ad7 image](https://www.agilicus.com/www/b1a20ad7-image.png)
We wish to have the OpenID Connect Proxy handle authentication and authorisation. We can also enter a URL that, when fetched, will force a logout.
![Sample: Hosted Icecast 9 144e934f image](https://www.agilicus.com/www/144e934f-image.png)
We are later going to have 2 types of users (viewers, admins). You might choose an “auto-create” user type for the viewer, allowing anonymous but attributable access.
![Sample: Hosted Icecast 10 01db9f3b image](https://www.agilicus.com/www/01db9f3b-image.png)
At this stage we are done creating the application, we will now set up the identity aware web application firewall authorisation.
Create Authorisation Roles, Firewall Rules
On the “Define” screen we can fine tune. First add a “viewer” role, then an “admin” role which includes viewer. Make the default role “viewer”.
![Sample: Hosted Icecast 11 253457eb image](https://www.agilicus.com/www/253457eb-image-1024x701.png)
Now let us set up the firewall. We will allow ‘viewer’ to GET anything except /admin. We will allow administrators to do any (GET/PUT/POST/…) on /admin/ tree.
![Sample: Hosted Icecast 12 23ec7eab image](https://www.agilicus.com/www/23ec7eab-image-1024x654.png)
At this stage we can open up our Icecast server (https://APPLICATION.DOMAIN), we will be challenged to provide credentials, after that, single sign-on, we are streaming our sweet music.