Access Manager v3 API for Unreal SDK

Access Manager allows you to enforce security controls for client access to resources within the PubNub Platform. With Access Manager v3, your servers (that use a PubNub instance configured with a secret key) can grant their clients tokens with embedded permissions that provide access to individual PubNub resources:

• For a limited period of time.
• Through resource lists or patterns (regular expressions).
• In a single API request, even if permission levels differ (read to channel1 and write to channel2).

You can add the authorizedUuid parameter to the grant request to restrict the token usage to one client with a given userId. Once specified, only this authorizedUuid will be able to use the token to make API requests for the specified resources, according to permissions given in the grant request.

You can use PubNub's functionality via Blueprints or directly in C++ code.

• In Blueprints, the whole SDK is managed by a subsystem, so start by calling the Pubnub Subsystem node.

• In a C++ project, you have to add a dependency to PubnubLibrary:

  1. In your IDE, navigate to Source/_{YourProject}_/_{YourProject}_.Build.cs and add a dependency to PubnubLibrary.

     PrivateDependencyModuleNames.AddRange(new string[] { "PubnubLibrary" });
     

  2. Compile the code and run the project.

• In C++, you can use the PubNub SDK as any other Game Instance Subsystem.

  #include "Kismet/GameplayStatics.h"
  #include "PubnubSubsystem.h"
  
  
  UGameInstance* GameInstance = UGameplayStatics::GetGameInstance(this);
  UPubnubSubsystem* PubnubSubsystem = GameInstance->GetSubsystem<UPubnubSubsystem>();
  

  PubnubSubsystem now allows you to call all PubNub SDK functions, for example:

  PubnubSubsystem->SubscribeToChannel("MyChannel");
  

Usage in Blueprints and C++

Grant token​

The GrantToken() method generates a time-limited authorization token with an embedded access control list. The token defines time to live (TTL), AuthorizedUser, and a set of permissions giving access to one or more resources:

• Channels
• ChannelGroups
• Uuids (other users' object metadata, such as their names or avatars)

Only this AuthorizedUser will be able to use the token with the defined permissions. The authorized client will send the token to PubNub with each request until the token's TTL expires. Any unauthorized request or a request made with an invalid token will return a 403 with a respective error message.

Method(s)​

1PubnubSubsystem->GrantToken(
2  int Ttl, 
3  FString AuthorizedUser, 
4  const FPubnubGrantTokenPermissions& Permissions, 
5  FOnGrantTokenResponse OnGrantTokenResponse, 
6  FString Meta = ""
7);

FPubnubGrantTokenPermissions​

FChannelGrant​

FChannelGroupGrant​

FUserGrant​

FPubnubChannelPermissions​

FPubnubChannelGroupPermissions​

FPubnubUserPermissions​

For a successful grant request, you must specify permissions for at least one User, channel, or group, either as a resource list or as a pattern (RegEx). You can specify the permissions in the following ways:

• apply the same permission to multiple objects

  1// permission1 as applied to all channels
  2Channels = {channel1, channel2, channel3}
  3Permisions = {permission1} 
  

• apply different permissions to multiple objects

  1// the indexes in the Channels array correspond to the indexes in the Permissions array
  2// so channel1 gets permission1, channel2 permission2, etc
  3Channels = {channel1, channel2, channel3}
  4Permisions = {permission1, permission2, permission3}
  

If you provide more than one permission to multiple objects, an error will be thrown.

1// this throws an error as the permissions don't match the objects
2Channels = {channe1, channel2, channel3}
3Permisions = {permission1, permission2}

Sample code​

1PubnubSubsystem->SetAuthToken(FString Token);