Sub-account function description

Function Description

The main function of the sub-account docking mode is to control the permissions of the developer's administrator account. By using the sub-account docking mode, you can create sub-accounts within the permissions of the developer's administrator account, and assign different permissions to different sub-accounts to achieve authorization. The purpose of management.

Why use sub-account docking mode

A core problem that sub-accounts need to solve is how to safely authorize others to access the device without exposing the developer's AccessToken. Because once the developer's AccessToken is exposed, it will bring security risks, and others can have the opportunity to operate all device resources under the developer's administrator account.

The sub-account function is a long-term effective permission control mechanism. By separating sub-accounts with different permissions, different permissions are assigned to different users, so that once the sub-account is leaked, it will not cause global information leakage.

basic concepts

The following are some basic concepts of the sub-account docking mode:

Sub-account: The sub-account created from the developer account of easy4ip Open Platform. Each sub-account has an Id.

Authorization policy (Policy): used to define the rules of permissions, such as previewing a certain device.

Resource: The resource that the user can access, such as the device with the serial number of 469631729, or the first channel of the device with the serial number of 469631729;

Sub-account authorization policy (Policy) configuration

There is a Statement in the Policy. The corresponding permissions and resources are specified in the Statement.

The following is an example of an authorization policy (Policy):

{
    "statement": [
        {
            "permission": "Ptz,Talk,Config",
            "resource": [
                "dev:469631729",
                "cam:544229080:1"
            ]
        },
        {
            "permission": "Real",
            "resource": [
                "dev:470686804"
            ]
        }
    ]
}

This Policy authorizes device resources such as 469631729, 544229080, and 470686804 under the developer's administrator account, and supports Ptz, Talk, Config, and Real permissions respectively.

Configuration Rules

Statement

The authorization semantics is described through Statement, each of which contains the description of Permission and Resource. Each time a request is made, the system will match and check one by one. If the match is successful, it is passed, and the request is authenticated. If none of the items match successfully, the request is forbidden to access.

permission

Resource

Resource refers to a specific object authorized on the easy4ip open platform. The rule of resource is {resourceType}:{resourceId};

1. resourceType: Indicates the resource type. There are only 2 resource types, dev (device) and cam (channel);

2. resourceId: indicates the resource Id, the resourceId of the dev type is the device serial number, and the resourceId of the cam type is the device serial number: channel number.

Affiliation

The cam resource belongs to the dev resource, and the permissions of the sub-account to the dev resource can be passed to the cam resource. For example, there are two resources dev:544229080 and cam:544229080:1, cam:544229080:1 belongs to dev:544229080; if the developer authorizes the Real permission of dev:544229080 resource to the sub-account, the sub-account defaults to cam :544229080:1 has Real authority.