Agora Security Token Generation (Golang)

Question

Looking at Token generation of Agora (https://docs.agora.io/en/Interactive%20Broadcast/token_server_nodejs?platform=Node.js).

We are required to provide role of the user when generating a token. In the Go API there are 4 role definition: attendee, publisher, subscriber, and admin.

How do the tokens differ if they are generated using any one of the 4 roles? How does attendee differ from a subscriber, how does publisher differ from an admin?

Thanks

Answer 1

The Role you are referring to is an arbitrary struct created to establish an example hierarchy of possible user roles that could be used to set privileges.

If you look at the Agora Token Builder (Golang example), on Line 42 it uses the Role to assign a set of privileges.

    if (role == RoleAttendee) || (role == RolePublisher) || (role == RoleAdmin) {
        token.AddPrivilege(accesstoken.KPublishVideoStream, privilegeExpiredTs)
        token.AddPrivilege(accesstoken.KPublishAudioStream, privilegeExpiredTs)
        token.AddPrivilege(accesstoken.KPublishDataStream, privilegeExpiredTs)
    }

In the code, each role gets the same privileges (which is generally useless in a production environment) so you need to update the code to have whatever user roles you'd like in order to set the appropriate privileges for that token.

The privileges set here are meant to let the Agora backend know what actions the user can perform in the channel, ranging from the fundamental joinCahnnel to publishStream to publishVideoCdn.

Available privileges:

type Privileges uint16

const (
    KJoinChannel        = 1
    KPublishAudioStream = 2
    KPublishVideoStream = 3
    KPublishDataStream  = 4

    KPublishAudiocdn           = 5
    KPublishVideoCdn           = 6
    KRequestPublishAudioStream = 7
    KRequestPublishVideoStream = 8
    KRequestPublishDataStream  = 9
    KInvitePublishAudioStream  = 10
    KInvitePublishVideoStream  = 11
    KInvitePublishDataStream   = 12

    KAdministrateChannel = 101
    KLoginRtm            = 1000
)

NOTE: token priveleges are not enforced by default, so you will have to file a Jira ticket (https://agora-ticket.agora.io) to make the request to enable it on your account.