Player 4.2.32 · release · Manual updated 31 October 2026

Accounts, identity and security

Use the player’s controls within the venue’s documented security and recovery procedures.

Accounts and permissions

Licences and current-state interlocks apply in addition to role permissions. A disabled button can indicate SCHED, Casting, pending work or unsupported hardware rather than an account problem.

Login and password changes

Config → Login lists configured accounts and session timeout. Only an administrator can change account passwords on this screen; the form requires the current administrator password, target account and the new password twice. Do not put credentials into screenshots or support reports. Web accounts and operating-system/SSH accounts are separate.

Lock the web session when leaving. Session expiry, logout and closing the browser do not themselves stop playback, scheduling or ingest. Closing the application through Shift+Q or the Power page does stop its services.

Identity, licences and certificates

The issued product serial follows licence registration. A demo has no issued serial; recipient-certificate serials are different identifiers. An installation UUID, licence serial and certificate fingerprint must not be used interchangeably. Licence activation/registration does not by itself establish that an existing KDM targets the current recipient or is valid. Read the actual public certificate and KDM window.

Protect private keys and identity backups. Never copy one live player identity onto multiple production installations. Fresh clone provisioning is an offline commissioning operation; normal upgrades and certificate rotation preserve the installation ID. See identity and metadata.

Network and output baseline

• Restrict web/API, FTP, automation and presentation networks to authorised systems. Use an appropriately protected network/transport for deployment; plain HTTP/FTP does not encrypt credentials.
• Keep the presentation interface deliberate. Casting uses its selected interface/IP and a per-entry connection code; it is not an Internet streaming gateway.
• The public discovery exception exposes only minimal identity and a public leaf certificate. Operational APIs, detailed metadata and control retain authentication.
• Use trusted time and investigate clock/journal faults before time-sensitive operations.
• Enforce the content’s KDM/integrity/output policy. Declaring installed 3D/captions/audio or connecting a projector does not certify a screen or create a trusted KDM recipient.
• Install approved signed releases and qualify the final display/audio path.

Operational evidence and external requirements

Status, Telemetry, the operational audit journal and display-activity history help investigate and document operation. Operational audit records are unsigned and do not establish certified DCI/SMPTE security logging. EAR‑Tech’s authenticated media encryption is one control within a broader workflow, not a facility or application assessment result.

Use the content owner’s current requirements and the applicable MPA/TPN process for your site/application. This offline manual does not certify compliance. See the official TPN assessment FAQ. EAR‑Tech workflow scope.

Backup and recovery

Back up configuration, identity, licence registration, database and show definitions with access restricted to the recovery owner. Encrypt sensitive backups and test restores separately from media. Preserve relevant audit history and command identities. Document compromise handling for player private keys and EAR mastering keys. Do not expose credentials or private material in a public website export.