Limiting access to room and streams.

[rob]

I am trying to create a streaming platform that limits rooms, streams, and recordings to only certain users. I am aware of the token system, but it appears that when you have a token you are allowed to publish or play whatever stream you want. I want to control the access that authenticated users have and limit them. Is this possible with the current Ant Media server? 

[rahul7827]

Quote

Little explanation would be helpful, How/what you would like to control?

 

[Burak]

Hi @rob,

Generally you can create tokens for a specific stream id and specific role (publish or play). You may give some details about your use case if these don't meet your requirement.
Also I want to put the for token documentation here if someone needs while reading this discussion.
https://resources.antmedia.io/docs/en/stream-security

[rob]

@burak @rahul7827 I am trying to support having different groups of users. One group has their streams, rooms, and recordings that they only have access to and are not playable or publishable by another group.

[rahul7827]

@rob

Is it something like membership ?

A year back i got a requirement like this where

On the site there were two type of membership

1. FANCLUB (Having 5 video of each course). Also gets 20% discount of each video lesson of any instructor.

2. VIP (Can have unlimited video and document access) and can join any live video lecture with discounted price.

This all we used to manage at the application end, Or you can make use of custom media server plugin as per use case.

Edited December 22, 2022 by rahul7827

[rob]

@rahul7827 Similar but its even simpler than that. I am going to support multiple organizations using the media server. Organization A should not be able to access Organization B's resources and Organization B should not be able to access Organization A's resources (recordings, streams, etc.). Is that easily doable?

Edited December 22, 2022 by rob
elaboration

[rahul7827]

1 hour ago, rob said:

@rahul7827 Similar but its even simpler than that. I am going to support multiple organizations using the media server. Organization A should not be able to access Organization B's resources and Organization B should not be able to access Organization A's resources (recordings, streams, etc.). Is that easily doable?

Hi @rob

You can create two separate application at media server console panel, with unique and unguessable names.

Each organization data is now separate from each other, Now you can use custom AMS plugin which will act as middleware to authenticate your application's users from their DB.

Also you are aware of token security.  May be some other member can help you from here. If i get something i will ping you.

BTW rob, What is the language you are using/planning to use for your application ?

 

Thank you for asking this question.

Edited December 22, 2022 by rahul7827

[lastpeony]

generated tokens are used for each application.

creating multiple applications with tokens should be the way

other than that it sounds like you need to implement your room logic for authentication on your application side.

 

 

 

[rahul7827]

1 hour ago, lastpeony said:

generated tokens are used for each application.

creating multiple applications with tokens should be the way

other than that it sounds like you need to implement your room logic for authentication on your application side.

 

 

 

Welcome to the community @lastpeony.

Thanks for your contribution.

[Connessione]

On 12/23/2022 at 12:47 AM, rob said:

@rahul7827 Similar but its even simpler than that. I am going to support multiple organizations using the media server. Organization A should not be able to access Organization B's resources and Organization B should not be able to access Organization A's resources (recordings, streams, etc.). Is that easily doable?

@rob Just to add to what @rahul7827 and others have already explained...

in media servers, the top level division (logical separation) is the application, next you have rooms and then streams. You can easily visualise this as hard drive partitions, folders and then file names. So first opt for application separation if you can that is the simplest thing (even though not the most professional). Otherwise even though rooms seem like the next logical option, using unique stream names to separate operations is a better thing than using rooms.  why?.... 

Think of it as a act of streaming discipline. when you develop a large platform like twitch for example it does not make sense to use multiple applications..does it? Also it isnt very scalable (does not matter if you have just 2 organisation at the moment). If you make use of stream names and security tokens to protect streams over the same application it will be truly scalable to N organisations over N media server instances. Always a highly scalable solution option and then apply it to low scale. the reverse is a receipt of design complications.

Additionally keeping away from scopes will mean your application will be easily portable to and compatible with other media server solutions that do not support rooms (in case the management decides to try a different media server). This makes the application design flexible.