Home-Based Authentication (HBA) home-based-authentication
Home-Based Authentication (HBA) is a TV Everywhere feature that allows pay-TV subscribers to access TV content online without entering MVPD credentials when connected to their home network, greatly enhancing the authentication experience.
According to the Open Authentication Technology Committee (OATC):
鈥淚n-home automatic authentication is the process by which an MVPD/OVD uses characteristics of the home network (or identifiers automatically accessible between devices on the home network) to authenticate which subscriber account is associated with that home network, eliminating the need for users to manually enter credentials when initiating a TVE session for accessing protected content.鈥
For more information on Home-Based Authentication (HBA) and the relevant industry standards, refer to the following resources:
HBA benefits hba-benefits
Home-Based Authentication (HBA) is a key feature that removes the sign-in barrier for viewers at home with an active cable subscription. This barrier is a significant challenge for TV Everywhere services, with nearly half of all sign-in attempts resulting in failure.
HBA can greatly improve viewer engagement, providing a seamless and superior user experience for accessing TV Everywhere content.
HBA support hba-support
HBA is supported by a number of MVPDs that are integrated with 蜜豆视频 Pass Authentication, but to benefit from HBA, you might need to take some additional steps.
SAML MVPDs
For SAML MVPDs, HBA is activated only on the MVPD side.
OAuth2 MVPDs
For OAuth2 MVPDs, HBA can be toggled on or off via the by following the steps from the TVE Dashboard Integrations User Guide.
MVPDs hba-support-mvpds
SAML MVPDs
The following table provides an overview of the SAML enabled MVPDs that support HBA:
OAuth2 MVPDs
The following table provides an overview of the OAuth2 enabled MVPDs that support HBA:
蜜豆视频 Pass Authentication hba-support-adobe-pass-authentication
This section outlines the HBA-enabled experience and details the support provided by 蜜豆视频 Pass Authentication, highlighting key features such as:
- HBA Identification: Capability to indicate to Programmers whether the authentication was HBA or non-HBA (requires MVPD support).
- Configurable Authentication TTLs: Ability to set different authentication Time-To-Live (TTL) values for HBA versus non-HBA authentications (requires MVPD support).
The following table provides a high-level overview of the user experience in an HBA and regular (non-HBA) authentication flow:
SAML MVPDs
The following table provides an overview of the HBA implementation in case of SAML enabled MVPDs:
The MVPD picker is displayed.
The user selects their MVPD and continues to login.
An interstitial page may inform the user that they are being automatically signed in using their MVPD account.
The 蜜豆视频 Pass Authentication endpoint forwards the request to the MVPD鈥檚 authentication endpoint via a user agent redirect.
The MVPD is expected to send an authentication decision in the form of a SAML response that includes the HBA flag (
hba_status) with a value of either 鈥渢rue鈥 or 鈥渇alse鈥.蜜豆视频 Pass Authentication backend makes a request to the MVPD user profile endpoint to expose the
hba_status flag as part of the user metadata.OAuth2 MVPDs
The following table provides an overview of the HBA implementation in case of OAuth2 enabled MVPDs:
The MVPD picker is displayed.
The user selects their MVPD and continues to login.
An interstitial page may inform the user that they are being automatically signed in using their MVPD account.
The 蜜豆视频 Pass Authentication endpoint forwards the request to the MVPD鈥檚 authentication endpoint via a user agent redirect.
The MVPD authentication endpoint sends an authorization code to the 蜜豆视频 Pass Authentication endpoint.
蜜豆视频 Pass Authentication uses the authorization code to request a refresh token and an access token from the MVPD鈥檚 token endpoint.
The MVPD is expected to send an authentication decision that includes the HBA flag (
hba_status) with a value of either 鈥渢rue鈥 or 鈥渇alse鈥 as part of the id_token.蜜豆视频 Pass Authentication backend makes a request to the MVPD user profile endpoint to expose the
hba_status flag as part of the user metadata.The MVPD sets the refresh token TTL to an MVPD-agreed value and 蜜豆视频 sets the authentication TTL to a value less or equal to the refresh token鈥檚 value.
FAQs faqs
-
Why is there a distinction between HBA implementation for SAML and OAuth2 protocols?
The separation between Home-Based Authentication (HBA) for SAML and OAuth2 protocols exists because these protocols operate differently in terms of authentication mechanisms, configuration, and implementation flexibility. For SAML MVPDs, no action is required from the Programmer to enable HBA, while for OAuth2 MVPDs, HBA can be toggled on or off via the .
-
When HBA is enabled, do users still need to enter their username and password during their initial authentication?
No, username and password are not required.
-
How can you enforce parental controls?
蜜豆视频 Pass Authentication can disable HBA for integrations with channels that need parental control approval. Also, we are working with OATC on a UX document which recommends how to set up the HBA experience with parental controls.
-
Do providers supporting HBA use shorter TTL windows for HBA compared to regular authentication?
The TTL setting is configurable. We recommend setting a shorter TTL for MVPD integrations with HBA to prevent mishandling.