Youtube Restriction and Kiosk mode

[Justin_W]

We're having an event on campus where they want to be able to show a Youtube Live stream on a couple different displays.

 Since the displays are just out in a common area, I figured it'd be easiest to just treat them like a standard Kiosk.  We've got the URL to the live stream, should be straight forward, right?

Seems not.

Some setting, somewhere is blocking the livestream/video.  We get the

"Video Unavailable. This video is restricted. Please check the Google Workspace administrator and/or the network administrator restrictions" message. 

It's not all of Youtube that is blocked from the kiosk (for example, I can just click on "Shorts" and it'll start playing shorts or a search for some other random video will work.

So I'm thinking of any/all the different policies/restrictions that may be in place - but pretty much all of them are applied at the USER level, and since this is in kiosk mode, there is no "user"

The only setting I found at the device level at"Devices->Chrome->Settings->Managed guest sessions->SafeSearch and Restricted Mode"

For the OU that this device is in, it's set to "Do not enforce Restricted Mode on Youtube"

We do use Securly too - but again, that loads at the user level.

Anyone gotten this to work? What am I missing?

[9330cashmore]

Im not familiar with Securly but does it have a network appliance that blocks based on DNS? In KIOSK mode there is not a real user logged into the Chromebook. So there would be no way for Securly to associate the traffic to a user. Look to see if there are some settings in Securly for subnet level rules or if there are any "pass on failure or pass on unknown user." Knowing that the later could cause some unintended issues like students getting past the filter.

[Justin_W]

Securly is just a browser-based filter.  No appliance, no DNS.

We do have a different appliance for additional on-campus filtering (Linewize), but I've got SafeSearch/Youtube disabled there.

Good thought though - the down side to the whole "security in layers" and redundancy is that often when there's an issue, you may spend a large amount of time pinning down which layer is causing the issue... Which is exactly where I'm at.

[MarkLoundy]

Might just have something to do with the fact that YouTube is now an 18+ app. Users from within your domain need to be in an OU that certified that they are over 18.

[Justin_W]

Youtube falls under our Google platform as far as our parent/legal guardian permissions are concerned.  Students and teachers use Youtube daily.

When I view the stream from my account, the video says  "Watchable by *mydomain*"

Also, since it's a "live feed" vs. a standard video, I can't seem to just whitelist the video URL anywhere (which may be a moot point anyhow since those whitelist tend to apply to users, not devices)

[Justin_W]

Hold on, I thought more about what you've suggested - and I think I get what you're saying.

But I'm pretty confident guest /non domain accounts can view YouTube just fine on our wifi. 

So unless the device being in kiosk mode makes a difference? 

[sundermannc]

You said you have a different appliance for additional on-campus filtering....  We have a similar setup (using Umbrella.)

I had the issue you are speaking of when I was trying to show Live youtube video.  Turns out it was because of the additional Umbrella appliance. That appliance forced safe search, which in turn disabled live video unless the user was authenticated as over 18 (which it was not since it's a kiosk appliance).

Even someone connected to our guest wifi on their own account would have to sign in to their school account to be able to watch Live youtube.

To resolve it for us, we had to set specific IPs on the devices (chromeboxes attached to TVs), then route those IPs around our Umbrella filter.  So maybe double check that your traffic from your displays is actually excluded from your Linewize filter and isn't getting caught up in there.

[jwisniewski]

Have you checked the default and global policies in Securly? While user-based, if there is no user profile to apply, the default and global policies will be in effect. This would include Youtube settings and categories. You can also clear the URL for the feed as well. Also check the Youtube settings for the feed and make sure you approve it for your domain.

[Justin_W]

Yeah, I did "whitelist" the steam URL at the Global settings level.  And have Default policy set to "Unrestricted access"

Regardless, while the policy may apply a "default" or " global" policy if no other policy is applied to a user, it can't/won't apply ANY policy if the extension isn't active - and I don't believe the extension is active for the kiosk account.

Anyway, it seems to be working now - I suspect a change I had done earlier was just taking a while to take effect, so now it's working (and I don't know exactly which setting fixed it...)