Security

Greetings!

We've got a working installation with Aruba Controller version 6.1.2.6 and Amigopod 3.5.1 with Advertising Services.

Now - we want to show a Youtube video during self-registration as an interstatial page. I've created the material as Youtube Video and while it works well for PC and Android devices, it doesn't for iPhone and iPads. For iPad the page just wants to me to download Flash Player, while on iPhone there is the typical image for lack of Flash (crossed over playbutton).

This is an excerpt from the Advertising Services Deployment Guide 1.3:

As the playback of YouTube videos requires a Flash player plugin, some
users may not be able to view a YouTube video. Even though the iPhone
does not support Flash, it does support YouTube videos.

That clearly says this should be working, or am I interpreting that text the wrong way?

I believe Advertising Services doesn't implement either the detection script nor the youtube embed/iframe correctly. Looking at the sourcecode it definately looks this way...

They should just leave the detection to youtube. Found this snippet posted from youtube a year or so ago:

An enhancement to our video embed capability is now available through a new embed code style. This new style uses <i-frame> and looks like this:

<iframe type="text/html" width="640" height="385" src="http://www.youtube.com/embed/VIDEO_ID" frameborder="0"></iframe>

---

And now while writing this - I checked an Amigopod demosite and fond the same issue there from my iPad, meaning it's alteast not our implementation that is faulty. Surf here from a iPhone or iPad: http://demo.amigopod.com/demo/bk/logina.php and you'll see.

Anyone got a workaround, or is this something I should open a ticket and call a bug or missing feature?

Thanks!

..John

Hi John,

We have recently noticed that the iPad was not being detected correctly in our Advertisiing Services plugin and therefore the device was falling through and a the flash based YouTube content was being displayed. This has been patched and will be available in our soon to be released 3.7 software update.

If you require access to this code asap you can contact the Aruba TAC and they will assist with getting your deployment updated to a beta release of software.

The issue should only be happening on an iPad so we would be interested to learn more if you are seeing this on an iPhone as well.

Hope this helps

Cam.

Hi Cam!

I opened a TAC Case on the issue to get the fix for iPad, but we also see other issues using iPhone (and iPad for that matter):

The YouTube video is not autoplayed

 - This is closed down from IOS5 it seems, and there is no solution to this that I've found.

The YouTube video is opened in YouTube app.

 - This have to be changed so it plays within browser

Once the YouTube movie (in the app) is done you're kicked back to the the browser, but it doesn't redirect to the login page

 - This I hope will be corrected once the movie is played within the browser

.. John

John,

Can you confirm that you are having the same issue with iOS 4.x iPhones as this workflow was known to work in the past. Inthis version the handoff between the youtube player and safari was working as expected.

I will try to follow up on the TAC case and see where things are at.

Rgds

Cam.

Hi Cam.

Yes, it was the same for both IOS 4 and 5.

We've now upgraded to the latest 3.7 release of Amigopod which - thankfully - solved the issue with iPad detection.

Still the functionality is not as it should be since redirect after the movie is played does not happen.

Also we have an issue where the loading of the Youtube player within the browser fails. This only happens on IOS devices as on PC and Android it's fine. It works if I add "allowall" policy to the pre-auth role role so something must be opened for this to work completely for IOS devices.

It seems TAC has reproduced the issue in lab and is working to find a solution, and I'm keeping my fingers crossed that will happen soon.

..John

John,

Good to hear the iPad detection issue is resolved.

If you are having some success playing the youtube content within the browser with an allowall rule, it would be great to see a packet capture of what services are requested in this working state so the appropriate entries can be added to your walled garden whitellist.

Have you been able to successfully play the youtube content within the browser in a post authentication page where you can legitimately have a more open firewall policy.

Rgds

Cam.

Hi again,

Got a small step further.

Today I used  Monitor - Client - Status with User Firewall State - to see what the iPad wanted to chat with when trying to load the youtube video/player. IP's belonging to google.com popped up for both port http and https.

Adding those to whitelist (any google.com svc-https + svc-http) for the pre-auth role made the player load with the video. Adding only for http or for https wasn't enough - had to be both. BUT - when I pressed play it just gave me the "The server is not correctly configured".

It's not really ideal tho since we now allow both youtube.com and google.com without having to login.

"The server is not correctly configured" - found some pointers in this regard, but no idea how to implement that on the Aruba Controller:

Encountered the same problems on a DMZ behind a Watchguard corporate firewall. YouTube worked fine on Mac or any PC through a browser. The iPad and iPhone Youtube apps displayed the video selections, but as soon as a video was selected, the message "Server not correctly configured" displayed. Looking at the traffic log inside the firewall showed that no packets were being blocked, so policy setting were suspect. Sure enough, Http range requests were not being allowed by in the HTTP policy. Several web sources state that the iPhone and Touch use range requests for video download, so suspected that iPad does too. Changed the policy setting to pass range requests and problem solved. I agree that some of the complaints here are being caused by similar settings in other firewalls as range requests are blocked by default in Watchguards HTTP policy.

I will be a very happy camper if anyone has feedback that could help me on this. As mentionened AllowAll does the trick, and changing my policies to "any google.com any permit" doesn't help either.

Cam, for post-authentication for guests we have allow-all at the end so yea - it works there.

..John

Hi! 
Added the following in a firewall policy to the user role policy made the player load and video play... 

user alias google.com any permit 
user alias youtube.com any permit 

Just adding youtube.com alone is not enough. Addinggoogle.com was needed for the player to load. 

Still it doesn't auto-redirect.

.. John

So - I'm at the end of this story - for anyone who's been following ;)

The recent patch Amigopod 3.7.2 saved the day (thanks Nimal!). Now you've got a choice to use the new YouTube script for either none, all or only IOS devices. I had some minor snags using Android when I only had IOS devices active, so I activated it globally which seems to work better... At the same time I had issues using bandwidth-contracts so might not be the scripts fault that Android acted up :)

So there you go - if you want to use Advertising Service with YouTube material then 3.7.2 is the patch for you! And - you need google.com and youtube.com opened for guest-logon role...

.. John