About
Understanding permissions in Kaltura’s Video Portal and KAF helps ensure users have the right level of access. There are two types of user roles:
- Applicative Roles - Define what a user is entitled (or not) to do in the context of the application.
- Contextual Roles - Define what a user is entitled (or not) to do in the context of galleries and channels.
By understanding these roles, you can better manage access and collaboration across all types of media in your Kaltura environment.
Applicative roles
User roles menu in the Configuration Management consoleanonymousRole
This is a global role in Kaltura's Video Portal. Users with this role can browse the site anonymously but must log in to access certain pages or perform specific actions.
viewerRole
This is a global role. After logging in, the user can browse open galleries but cannot upload new content. Additionally, they do not have access to a My Media page.
privateOnlyRole
This is a global role. After logging in, the user can browse open galleries and use authorized contribution tools. These may include uploading content, recording from a webcam, recording a screen, adding a YouTube link, and creating a live stream entry. The user can also publish to a gallery or channel based on their entitlements.
adminRole
This is a global role. After logging in, the user can browse open galleries and use authorized contribution tools, including uploading content, recording from a webcam, recording a screen, adding a YouTube link, and creating a live stream entry. They can publish to all open galleries and restricted/private galleries or channels based on their entitlements. Content published by users with this role is subject to moderation.
unmoderatedAdminRole
This is a global role. After logging in, the user can browse open galleries and use authorized contribution tools, including uploading content, recording from a webcam, recording a screen, adding a YouTube link, and creating a live stream entry. They can publish to all open galleries and restricted/private galleries or channels based on their entitlements. Content published by users with this role bypasses moderation when moderation is enabled for the account.
unconfirmedViewerRole
This role is similar to the Viewer role but with additional restrictions. Users can view content but cannot interact with it or make any changes to content or settings on the site. For more details about the restrictions of this role, see our article Unconfirmed Viewer Role in Video Portal and KAF.
Contextual roles
Member
In the Video Portal, a member can access the channels or galleries they are associated with and view content within them. However, they cannot add new content. Members are also able to join a Kaltura Room.
Contributor
In the Kaltura Video Portal, a contributor can access the channels or galleries they're associated with, view content, and add new content. Any content they add is subject to moderation based on their applicative role. Contributors can also join a Kaltura Room.
Moderator
In the Kaltura Video Portal, a moderator can access the channels or galleries they're associated with, view content, and add new content. Any content they add is subject to moderation based on their applicative role. If moderation is enabled for a channel or gallery, moderators can manage the moderation queue by approving or rejecting contributed content. Moderators can also start a Kaltura Room.
Manager
In the Kaltura Video Portal, a manager can access the channels or galleries they are associated with, view content, and add new content. Content added by a manager is subject to moderation based on their applicative role.
If moderation is enabled for a channel or gallery, managers can access the moderation queue and approve or reject contributed content.
Managers also have administrative control over the channel / gallery, including the ability to:
- edit settings, including metadata, moderation, and commenting options.
- manage users by adding, editing, or removing members and assigning roles.
- change the appearance and delete the channel / gallery.
- view, print, and save channel analytics.
- organize content into playlists.
- start a Kaltura Room.
Example of a channel's user settings showing contextual roles
Example of a channel's user settings showing contextual roles Gallery and channel privacy types
Galleries
- Open gallery - Anyone can view content (including anonymous users) but only admin role users and members can contribute content.
- Restricted gallery - All logged in users can view content but only members can contribute content.
- Private gallery - Only members can view and contribute content.
Sub-galleries under a private gallery will be visible only to members of those sub-galleries
Example of a gallery's edit page with privacy settings
Example of a gallery's edit page with privacy settingsChannels
- Open - All logged-in users can view and contribute content (contribution is not allowed for viewer-role users).
- Restricted - All logged-in users can view content and only members can contribute content.
- Private - Only members can view and contribute content.
- Shared repository - Only members can view and contribute content. Content can be published to other channels, according to publishing entitlements.
- Public, Restricted - Anyone can view content (including anonymous not logged-in users). Only members can contribute content according to their publishing entitlements.
- Public, Open - Anyone can view content (including anonymous not logged-in users) and all logged-in users can contribute content.
- Media Gallery (KAF only) - Permission to view is set on the hosting application. Other capabilities have contextual roles.
Example of a channel's edit page with privacy settingsImportant information regarding collaboration
Please note that if collaboration is enabled, a user with any role (not guests) who is co-publisher or co-editor can publish or edit content, even though that user does not have My Media. See Change Media Owner and Add Collaborator for instructions on changing media owners and adding collaborators. See MediaCollaboration module for information on enabling and configuring this type of functionality.
This is also true for the use of Browse Search and Embed (BSE). However, publishing via BSE requires a different setting in the Browseandembed module to allow use of the BSE:
