Access control & data security

Authentication and authorization mechanisms in your chat app let you decide who can access what resources based on identity and permissions.

Additional security measures let you send and receive messages and files through your chat app, preventing unauthorized users from accessing that data.

Custom origin

A custom origin is a subdomain configured specifically for your application, such as abc.pubnubapi.com. Using a custom origin allows PubNub to route traffic uniquely for your application.

Contact support

To request a custom origin, contact PubNub Support.

Set origin

The SetPubnubOrigin() method allows client devices to configure a custom origin

for their PubNub requests.

Method signature

Chat.ChatAccessManager.SetPubnubOrigin(string origin)

Input

* required

Parameter	Description
`origin` * Type: `string`	The custom origin to be set for PubNub requests.

Basic usage

var chat = await Chat.CreateInstance(new PubnubChatConfig(
    "PublishKey",
    "SubscribeKey",
    "UserId")
);

// get the ChatAccessManager instance
var chatAccessManager = chat.ChatAccessManager;

// Set a new custom origin
chatAccessManager.SetPubnubOrigin("abc.pubnubapi.com");

Returns

This method does not return any response value. If the operation fails, an exception will be thrown.

User authentication

In your chat app, you need to have a process of verifying the identity of all users, ensuring that they are who they claim to be.

Unity Chat SDK doesn't provide a built-in authentication mechanism, and you'll need to implement user verification in your app on your own. Typically, this could involve a login system where users provide their credentials (username and password), token-based authentication, Single Sign-On (SSO), two-factor authentication (2FA), or external authentication services like OAuth.

User authorization

A chat app will require an authorization mechanism granting or denying access to specific PubNub resources or functionalities based on the authenticated user's permissions and privileges.

This way, you don't let your chat users delete or modify each other's metadata, publish messages on private channels, or remove messages that other chat members wrote.

Unity Chat SDK provides authorization in your chat app through Access Manager - a secure, token-based permission administrator that lets you regulate clients' access to such PubNub resources as channels and users. By making a single call to Access Manager API, you can define multiple user permissions saying who can do what with your client or server app data.

Depending on whether you create a client or server app, there are three possible actors involved in the authorization cycle: PubNub (server), your own server, and a client device. For more details, read the authorization workflow.

Enable Access Manager

Access Manager is not enabled by default. To use it in your app, you must allow it on your app's keyset in the Admin Portal and then initialize the Unity Chat SDK with SecretKey. Access Manager is available in Unity SDK, not Unity Chat SDK.

Token permissions

When you use Access Manager, your client application will receive a token that governs the access levels and types of operations you can perform. The CanI() method checks if a client has permissions to perform a specific action on a given resource.

Method signature

Chat.ChatAccessManager.CanI(
    PubnubAccessPermission permission,
    PubnubAccessResourceType resourceType,
    string resourceName
)

Input

* required

Parameter	Description
`permission` * Type: `PubnubAccessPermission`	The operation type to check if the current user has permissions for.
`resourceType` * Type: `PubnubAccessResourceType`	The resource type to check if the current user has permissions for.
`resourceName` * Type: `string`	The name of the resource, for example, a channel name or a user ID.

PubnubAccessPermission

public enum PubnubAccessPermission
{
    Read, 
    Write, 
    Manage, 
    Delete, 
    Get, 
    Join, 
    Update
}

PubnubAccessResourceType

    public enum PubnubAccessResourceType
    {
        Uuids, 
        Channels
    }

Output

Parameter	Description
`Task<bool>`	An awaitable `Task` with a `bool` signifying whether or not the client has permissions to perform the requested operation on the requested resource.

Basic usage

Check if the current user can send messages to the support channel.

var chat = await Chat.CreateInstance(new PubnubChatConfig(
    "PublishKey",
    "SubscribeKey",
    "UserId")
);

// get the ChatAccessManager instance
var chatAccessManager = chat.ChatAccessManager;

// define the permissions, resource type, and resource name
PubnubAccessPermission permissionToCheck = PubnubAccessPermission.Write;
PubnubAccessResourceType resourceTypeToCheck = PubnubAccessResourceType.Channels;
string channelName = "support";

// check if the current user can send (write) messages to the 'support' channel
show all 26 lines

Token management

The ChatAccessManager object also contains methods for managing the auth token of an initialized Chat instance.

Set token

The SetAuthToken() method allows client devices to update their authentication token. This token, granted by the server, contains embedded permissions that define the client's access to PubNub resources. By setting a new token, the client ensures that its requests to PubNub are authorized according to the permissions specified in the updated token.

Method signature

Chat.ChatAccessManager.SetAuthToken(string token)

Input

* required

Parameter	Description
`token` * Type: `string`	The authentication token with embedded permissions.

Basic usage

var chat = await Chat.CreateInstance(new PubnubChatConfig(
    "PublishKey",
    "SubscribeKey",
    "UserId")
);

// get the ChatAccessManager instance
var chatAccessManager = chat.ChatAccessManager;

// Set a new authentication token
chatAccessManager.SetAuthToken("p0thisAkFl043rhDdHRsCkNyZXisRGNoYW6hanNlY3JldAFDZ3Jwsample3KgQ3NwY6BDcGF0pERjaGFuoENnctokenVzcqBDc3BjoERtZXRhoENzaWdYIGOAeTyWGJI");

Returns

This method does not return any response value. If the operation fails, an exception will be thrown.

Parse token

The ParseToken() method decodes an existing token and returns a JSON string containing the permissions embedded in that token. This method is useful for debugging purposes, allowing you to inspect the token's permissions and other metadata, such as its time-to-live (TTL) and authorized user ID.

Method signature

Chat.ChatAccessManager.ParseToken(string token)

Input

* required

Parameter	Description
`token` * Type: `string`	The authentication token to decode.

Output

Parameter	Description
`result` Type: `string`	A JSON string containing the token's permissions and metadata.

Basic usage

var chat = await Chat.CreateInstance(new PubnubChatConfig(
    "PublishKey",
    "SubscribeKey",
    "UserId")
);

// get the ChatAccessManager instance
var chatAccessManager = chat.ChatAccessManager;

// Parse an existing token
string tokenDetails = chatAccessManager.ParseToken("p0thisAkFl043rhDdHRsCkNyZXisRGNoYW6hanNlY3JldAFDZ3Jwsample3KgQ3NwY6BDcGF0pERjaGFuoENnctokenVzcqBDc3BjoERtZXRhoENzaWdYIGOAeTyWGJI");

// Output the token details
Console.WriteLine("Token Details: " + tokenDetails);

Example output

{
    "Version":2,
    "Timestamp":1619718521,
    "TTL":15,
    "AuthorizedUuid":"my_uuid",
    "Resources":{
        "Uuids":{
          "uuid-id":{
                "Read":true,
                "Write":true,
                "Manage":true,
                "Delete":true,
                "Get":true,
                "Update":true,
                "Join":true
show all 43 lines

Operations-to-permissions mapping

The type of access level you grant on a given resource type defines which operations users can perform in your app. For example, write access given to a user for the channels resource type (either specific channels or channel patterns) lets them send messages to this channel/these channels (calling the PubNub Pub/Sub API underneath and the Unreal Chat SDK's SendText() method).

Chat SDK method to required Access Manager permission mapping

For information about which Chat SDK methods require what Access Manager permissions, refer to Security and permissions.

Custom origin​

Contact support

Set origin​

Origin

Method signature​

Input​

Basic usage​

Returns​

User authentication​

User authorization​

Enable Access Manager

Token permissions​

Method signature​

Input​

Output​

Basic usage​

Token management​

Set token​

Method signature​

Input​

Basic usage​

Returns​

Parse token​

Method signature​

Input​

Output​

Basic usage​

Example output​

Operations-to-permissions mapping​

Chat SDK method to required Access Manager permission mapping

Custom origin

Set origin

Method signature

Input

Basic usage

Returns

User authentication

User authorization

Token permissions

Method signature

Input

Output

Basic usage

Token management

Set token

Method signature

Input

Basic usage

Returns

Parse token

Method signature

Input

Output

Basic usage

Example output

Operations-to-permissions mapping