Role-Based Access Control
Cardinal Media Server includes a powerful Role-Based Access Control system that allows you to manage your users' roles, so that you can easily control the content that they are allowed to access.
The system is straightforward, comprising of only two main concepts: Roles and Capabilities.
Roles
Roles are assigned directly to users, and each role represents a set of capabilities. Users can have a single role, or multiple roles.
Built-in Roles
Your Media Server comes with these built-in roles, which are designed to reflect typical use cases.
Owner
The Owner role is the most powerful role, with unrestricted capabilities. It is automatically assigned to the first Cardinal Account that logs into the server, and can only be removed by performing a factory reset.
It grants the user complete administrative control over the server, allowing them to invite users, delegate roles, index media, and more.
The Owner role also links the Media Server to Cardinal's Cloud, allowing the Media Server to use the features included in the owner's subscription. It is the only role that is limited to a single user.
Administrator
The Administrator role is a powerful role with the same capabilities as the Owner role, but it can be assigned to multiple users, and does not trigger any Cardinal Cloud side effects.
It is automatically assigned to the Guest Account, allowing users to access all of their server's features without needing to create a Cardinal account. It cannot be revoked from the Guest Account.
Media Apps User
The Media Apps User role grants access to all media apps, allowing the user to access the Music, Photos, and Cinema apps, and also future media applications.
It is the ideal role for someone that should have access to everything except the Administration app.
Music User
The Music User role grants access exclusively to the Music app and all of its features.
Photos User
The Photos User role grants access exclusively to the Photos app and all of its features.
Cinema User
The Cinema User role grants access exclusively to the Cinema app and all of its features.
Newcomer
The Newcomer role is the default role assigned to users when they first join your server. It lets users log into the apps, but does not allow them to access any media.
The role exists as a waiting room for new users, allowing server administrators to start each new user from a position of least privilege.
Automatically Assigned Roles
Some roles will automatically be assigned for you.
- The Owner role can only be assigned by the system.
- The Guest Account will be assigned the Administrator role by the system.
- All new users are automatically assigned the Newcomer role by the system.
Capabilities
Capabilities are granular permissions. Each one is a string made of two parts: an Aspect and an Action. Take this capability for example:
Users.Read
Here, the aspect is "Users" and the action is "Read". Users that have been assigned a role with this capability will be allowed to read data that the Users aspect provides. This one capability applies to all applications that are bundled with the Media Server, and also to the Media Server's API endpoints.
While there are some capabilities that are scoped to single applications (e.g., CinemaApp.Login applies to Cardinal Cinema), most capabilities are designed to be cross-application (e.g., Libraries.Read applies to all applications).
Aspects
Aspect is a generic term that refers to anything that can have its access restricted. It includes everything from high level concepts like resources, features, applications, and services, to UI components and URLs, and everything in between.
Aspects are meant to be flexible but purposeful, creating sensible boundaries that roles can compose together.
Actions
An action is something that can be done to an aspect. There are some common self-explanatory actions such as List and Read that many aspects use, but actions can also be very specific.
Complete List of Capabilities
- CurrentUser.Read
- AdminApp.Login
- Users.Create
- Users.Read
- Users.Update
- Invitations.Create
- Invitations.Read
- Invitations.Update
- Invitations.Delete
- RoleAssignments.Create
- RoleAssignments.Read
- RoleAssignments.Delete
- Indexing.Read
- Indexing.Operate
- Indexing.Deindex
- Jobs.Create
- Jobs.Read
- Jobs.Operate
- Libraries.Create
- Libraries.Read
- Libraries.Update
- Libraries.Delete
- MusicApp.Login
- MusicArtists.Read
- MusicReleases.Read
- MusicGenres.Read
- MusicTracks.Read
- MusicTracks.Play
- MusicHistory.Create
- MusicHistory.Read
- PhotosApp.Login
- Photos.Read
- Photos.Update
- PhotoFaces.Read
- PhotoAlbums.Create
- PhotoAlbums.Read
- PhotoAlbums.Update
- PhotoAlbums.Delete
- CinemaApp.Login
- TVChannels.Read
- CinemaHistory.Read
- CinemaCollections.Read
- CinemaPlaylists.Read
- Movies.Read
- TVEpisodes.Read