Understanding the Kaltura Application Framework (KAF)

About

Authentication and authorization

To use a KAF module, an authentication process must occur to identify the user and their permissions. KAF supports two main methods:

KS-based SSO (Single Sign-On): Uses a Kaltura Session (KS) token to identify the user.

LTI Authentication: Typically used for LMS integrations.

Generating a KS (Kaltura Session) for SSO

To authenticate users, KAF uses a security token called a KS (Kaltura Session). You can generate a KS using Kaltura API Client libraries with a method called generateSession (or a similarly named function, depending on the programming language). This method includes user information, session details, and specific privileges needed for the session.

The following is an example for generating a session in PHP using the client library:

$client->generateSessionV2(

   $adminSecret,

   $userId,

   $sessionType,

   $partnerId,

   $expiration,     

   $privileges

);

The following explains the parameters expected by the generateSession method:

Admin Secret - The admin secret of the Kaltura account, found in the KMC under Settings > Integration settings.

User ID - The unique ID of the user that is being presented with the KAF module.

Session Type - Type of Kaltura Session. For KAF integration, it must be USER session.

Partner Id - The Kaltura account ID, found in the KMC under Settings > Integration settings.

Expiration - Duration of the KS in seconds. For KAF integration, the Expiration values should be up to 60 seconds.

Privileges - Comma-separated list of privileges. Some privileges are of type key-value pair, in which case they are represented as key:value. For the maximum security, the required privilege is actionslimit:-1 to prevent API calls.

Here’s an example of generating a KS for loading a KAF module:

// prepare privileges

$privileges= array();

$privileges[] = "actionslimit:-1";

$privileges[] = "firstName:John";

$privileges[] = "lastName:Doe";

$privileges[] = "role:viewerRole";

 

// transform array privileges to string

$privilegesStr = implode(",", $privileges);

 

// prepare additional parameters

$adminSecret = "-the-string-you-copied-from-kmc-";

$userId = "john.doe";

$partnerId = 12345;

 

// generate the KS using all the above parameters

$ks = $client->generateSessionV2(

   $adminSecret,

   $userId,

   KalturaSessionType::USER,

   $partnerId,

   20,

   $privilegesStr

);

 

// build iFrame URL with KS

$iframeUrl = 'https://url.to.kaf.com/hosted/index/my-media/ks/' . $ks;

 

// render iFrame to page

echo '<iframe src="' . $iframeUrl . '"></iframe>';

Privileges for KAF modules

The required privileges for each KAF module depend on the specific widget you're using. To view and understand the required or optional privileges, visit KAF Integration Demo. You can select from the available KAF widgets (endpoints) and see a detailed list of required and optional privileges for each widget. After entering the relevant information, you can also simulate how the KAF widget behaves based on the privileges you've set.

Roles and permissions for KS-based SSO

KAF uses two types of roles:

Applicative Role: Determines what the user can do within KAF (for example, uploading content).

Contextual Role: Defines what a user can do in specific contexts (for example, managing a gallery).

When loading a KAF module, the KS must specify the user’s applicative role. Depending on the module, the KS may also need to specify the user's contextual role.

In the example below:

• The applicative role of the user is adminRole. The adminRole user can upload and publish content in different contexts (galleries).
• The contextual role of the user is manager of that gallery, and is given some capabilities that are only allowed for this role.

Contextual role values are the available constants of KalturaCategoryUserPermissionLevel

$privileges= array();

$privileges[] = "actionslimit:-1";

$privileges[] = "firstName:John";

$privileges[] = "lastName:Doe";

$privileges[] = "role:adminRole";

$privileges[] = "userContextualRole:0";

 

...

 

// build iFrame URL with KS

$iframeUrl = 'https://url.to.kaf.com/hosted/index/course-gallery/ks/' . $ks;

 

...

KAF modules

Gallery module

The Gallery module is used to create, display and contribute to a dedicated media gallery that can be associated with a group in your application. For example, a media gallery for a specific forum, a course, a community, or other context.

The Gallery module includes the following functionality:

• Display media that is published in the gallery.
• View and engage with the published media, for example, play the media, search in-video, comment, like, add to playlist,.
• Upload new content and publish to the gallery (according to user’s role)
• Moderate content in gallery (optional)

My-Media module

The My-Media module displays the personal media library of a authenticated user. Features include:

• Displaying media that the user owns (contributed by the logged user).
• Viewing and editing media
• Searching metadata and transcription/closed caption files
• Uploading and publishing new content (according to user’s role)
• Bulk publishing to a specific gallery or playlist