Role-Based Access Control (RBAC)
With the Bintu API v1.23.0.0 we introduced a role-based access control system in Q3/2024.
With the Bintu API v1.23.0.0 release introducing user roles, all users will retain their current permissions, now equivalent to the nanoAdmin role. Therefore, no immediate action is required from organizations.
Role-Based Access Control (RBAC) introduces a structured permission system to nanoStream Cloud, ensuring that access to resources and administrative functions is assigned based on clearly defined user roles. With this system, organizations gain better security, clearer permission structures, and simplified user administration. RBAC helps prevent unauthorized changes, reduces operational risks, and streamlines team workflows, especially in environments with multiple users, distributed teams, or complex streaming setups.
Concept and Benefits
-
Enhanced Security:
- Ensuring Appropriate Permissions: RBAC ensures that users and API access tokens are granted only the permissions needed for their tasks, minimizing potential security risks. This improves your account security and protects your organization's operations.
-
Easy to Administer:
- Simplified User Management: RBAC allows administrators to assign roles to users rather than managing individual permissions. By assigning predefined roles based on job functions, tasks, or responsibilities, administrators can easily grant access to resources by simply choosing the appropriate role for a user.
- Centralized Permission Management: By managing permissions at the role level, rather than at the individual user level, RBAC reduces the number of decisions and changes an administrator must make. This centralized approach minimizes errors and inconsistencies in access controls.
-
Improved Visibility/Overview of User Permissions:
- Clear Permission Structures: RBAC provides a clear structure of roles and their associated permissions. This makes it easier for administrators to understand who has access to what resources and why, facilitating audits and compliance checks.
- Simplified Reporting and Auditing: Since roles aggregate multiple permissions, generating reports on user access becomes more straightforward. This visibility is crucial for maintaining security, identifying potential issues, and demonstrating compliance with regulations.
Getting started
Implementing Role-Based Access Control (RBAC) in your organization is a straightforward process that enhances security and simplifies user management. The following guide will walk you through the initial steps to configure user roles and manage permissions effectively.
1. Understanding Role Assignments
Before assigning roles, familiarize yourself with:
- Begin by reviewing the predefined roles in nanoStream Cloud to understand the basic access levels and permissions available. For an in-depth look at the permissions associated with each role, check out the High-level Permission Overview.
- Learn how to manage roles within the dashboard by following the dedicated Features & Function User Management page.
2. Evaluate and Assign Roles
Assess the responsibilities of each user within your organization and assign the appropriate role:
- Determine the level of access each user needs based on their job functions.
- Use the nanoStream Dashboard or the Bintu API to assign roles to users.
3. Monitor and Enforce Access Control
It’s important to monitor user access and enforce RBAC policies consistently:
- Consider replacing static API keys with user-bound and expiring API tokens for enhanced security.
- Regularly review the permissions and roles assigned to users to ensure they align with current responsibilities and security requirements.
User Roles in nanoStream Cloud
To learn more about user management using the dashboard, click here.
Three predefined roles are available to manage user permissions within an organization: nanoAdmin, nanoUser and nanoReadOnly. Each role grants specific access rights tailored to different needs.
| User Role | Responsibility | Access Level | Permissions |
|---|---|---|---|
| nanoAdmin | The Administrator | Highest | Has full control over all functions within the organization, including managing user roles and issuing new tokens to disable existing ones. Is the only role with access to user management and the API Key. |
| nanoUser | The Operator | High | Can perform all tasks related to stream management and operations, expect for changes that could disrupt operations, such as deleting or stopping streams or changing critical settings. |
| nanoReadOnly | The Observer | Low | Has read-only access to basic information such as stream configuration, stream states, metrics and alerts. |
For a detailed overview of each role's permissions, refer to the High-level Permission Overview.
API Endpoints
Bintu API Endpoints
| Operation | Route | Description | Access Level | Dedicated docs |
|---|---|---|---|---|
| PUT | /user/permission | Update the user role of a user in your organization | nanoAdmin | More info |
| PUT | /user/tokenkey | Renew a user tokenkey to invalidate previously created API tokens | nanoAdmin | More info |
| GET | /permission | Get the available endpoint valids for a given permission (by name) | nanoAdmin | More info |
| GET | /permission/list | List available roles and the associated permissions for your organization | nanoAdmin, nanoUser | More info |
| GET | /user | Displays the permission of users and an internal identifier (enhanced existing endpoint) | nanoAdmin, nanoUser | More info |
Token API Endpoints
| Operation | Route | Description | Access Level | Dedicated docs |
|---|---|---|---|---|
| POST | /bintu/token | Create an API token for the Bintu services | nanoAdmin | More info |
High-level Permission Overview
API Access
| Capability | nanoAdmin | nanoUser | nanoReadOnly |
|---|---|---|---|
| Get API Key | ✓ | — | — |
| Get Player Key | ✓ | ✓ | ✓ |
| Get User API Token | ✓ | ✓ | ✓ |
Webhook Management
| Capability | nanoAdmin | nanoUser | nanoReadOnly |
|---|---|---|---|
| Set Custom Webhook | ✓ | — | — |
User Management
| Capability | nanoAdmin | nanoUser | nanoReadOnly |
|---|---|---|---|
| Get Users | ✓ | ✓ | — |
| Create User | ✓ | — | — |
| Invite User | ✓ | — | — |
| Edit User | ✓ | — | — |
| Reset User API Tokens | ✓ | — | — |
| Delete User | ✓ | — | — |
Stream Management
| Capability | nanoAdmin | nanoUser | nanoReadOnly |
|---|---|---|---|
| Get Streams | ✓ | ✓ | ✓ |
| Create Stream | ✓ | ✓ | — |
| Stop stream | ✓ | — | — |
| Lock stream | ✓ | — | — |
| Unlock stream | ✓ | — | — |
| Delete stream | ✓ | — | — |
Tag Management
| Capability | nanoAdmin | nanoUser | nanoReadOnly |
|---|---|---|---|
| Get Tags | ✓ | ✓ | ✓ |
| Create Tag | ✓ | ✓ | — |
| Edit Tag | ✓ | ✓ | — |
| Delete Tag | ✓ | — | — |
Playback & Monitoring
| Capability | nanoAdmin | nanoUser | nanoReadOnly |
|---|---|---|---|
| Create Playback Token | ✓ | ✓ | — |
| Get Metrics and Alerts | ✓ | ✓ | ✓ |