Access Control Model - Content Management

Access Control Model

Architecture

An access control profile (KalturaAccessControlProfile) contains an ordered array of rules (KalturaRule). Each rule has:

• conditions -- array of KalturaCondition objects (AND logic: ALL must be true)
• actions -- array of KalturaAccessControlAction objects (what to enforce)
• contexts -- array of KalturaAccessControlContextTypeHolder (when to evaluate: PLAY, DOWNLOAD, THUMBNAIL)
• message -- message to return to the player when rule fires
• stopProcessing -- if true and conditions met, skip remaining rules

Rule Evaluation Logic

1. Rules evaluate in array order
2. Each rule evaluates only if its contexts match the current request context (PLAY for playManifest, DOWNLOAD for raw/download, THUMBNAIL for thumbnails). A rule with no contexts evaluates in all contexts.
3. A rule is fulfilled when ALL its conditions evaluate to true (AND logic)
4. When fulfilled, the rule's actions are added to the outcome and its message is added to the outcome messages
5. If stopProcessing is true on a fulfilled rule, remaining rules are skipped
6. All accumulated actions execute
7. If no rule matches, content is allowed (default: allow)

Access Control Scope

When access control is evaluated, the server constructs a KalturaAccessControlScope from the request:

Field	Type	Description
contexts	array	Which contexts to test (no context = any context)
ip	string	Request IP address for geographic conditions
ks	string	Kaltura session for authentication/user conditions
referrer	string	Page URL for domain conditions
time	integer	Unix timestamp for scheduling (null = server time)
userAgent	string	Browser/client application for agent conditions