VirtualHere supports user authorization whereby specific users can be granted/denied access to specific devices. This is useful for example to protect remote access to security dongles by certain users, or limit the number of shared devices per user.
Make sure the VirtualHere Server is not running, then add the clientAuthorization setting to the server configuration file. This setting specifies the bash script to run to perform authorization and passes it specific parameters replaced at runtime with actual values for the current user and the device they are attempting to use. The CLIENT_ID is passed in by the VirtualHere client to the server. It is automatically set to the same username used to login to the current operating system session under Windows / OSX / Linux.
$VENDOR_ID$ - The USB Device vendor id, in hex e.g "05ac"
$PRODUCT_ID$ - The USB Device product id in hex hex e.g "12a4"
$CLIENT_ID$ - The format is <full name><space><open bracket><username><close bracket> .eg "John Smith (jsmith)"
$PRODUCT_SERIAL$ - This is the USB Device serial number e.g "2c89237021"
$NUM_BINDINGS$ - the number of devices this user is currently using.
clientAuthorization=/home/root/auth.sh "$VENDOR_ID$" "$PRODUCT_ID$" "$CLIENT_ID$" "$CLIENT_IP$" "$PRODUCT_SERIAL$" "$PASSWORD$" "$DEVPATH$" "$NICKNAME$" "$NUM_BINDINGS$"
Create a new file called auth.sh in the directory specified in the line above (e.g /home/root) and add the following example code (This code will deny access to everyone except the username "michael" with a password "mypassword"). Change it to suit your needs.
logger "Authorizing -> '$1' '$2' '$3' '$4' '$5' '$6' '$7' '$8' '$9'"
Now when you start the server it will call this script every time a client attempts to Use a device. You can use the other parameters passed in to perform more specific authorization, for example using the device product ID or client IP or password based on the type of device and so forth.
Here is a example script that performs the same function as the Linux script above. Change the username from michael to your username. Try using a device first, let it fail and look in the log.txt file for all the details you can compare on.
clientAuthorization=C:/Users/michael/auth.bat "$VENDOR_ID$" "$PRODUCT_ID$" "$CLIENT_ID$" "$CLIENT_IP$" "$PRODUCT_SERIAL$" "$PASSWORD$" "$DEVPATH$" "$NICKNAME$" "$NUM_BINDINGS$"
The ClientDeauthorization setting is identical to the ClientAuthorization script but is called when a user disconnects from a device. The parameters sent to the script are identical to the ClientAuthorization script except the script is not required to return a value of 1 or 0. Using both the ClientAuthorization and ClientDeauthorization script makes it easy to track user-device usage e.g for logging and accounting purposes.
When a client runs in adminstrator mode (using the -a argument when starting the client) the administrator can kick another user off a device by right clicking on the in-use device and selecting "Disconnect from User". If you would like to restrict which administrators can kick which users of which devices you can use the OnDeviceKick setting in the server config.ini file to specify a script to run to determine the action to be taken. This script is similar to the scripts above but should return 1 if the user can be kicked from the device and 0 otherwise.
onDeviceKick=/home/root/onDeviceKick.sh "$VENDOR_ID$" "$PRODUCT_ID$" "$KICKER_ID$" "$CLIENT_ID$" "$CLIENT_IP$" "$PRODUCT_SERIAL$" "$DEVPATH$" "$NICKNAME$"
Create a new file called onDeviceKick.sh in the directory specified in the line above (e.g /home/root) and add the following example code (This code will deny administrator kicking abilities to everyone except the username "michael"). Change it to suit your needs.
logger "OnDeviceKick -> '$1' '$2' '$3' '$4' '$5' '$6' '$7' '$8'"
Now when you start the server it will call this script every time an administrator attempts to Disconnect from User a device. You can use the other parameters passed in to perform more specific qualification, for example using the device product ID or client IP and so forth.