How to authorise a user during an AppStream session

To authorize a user during an AppStream session, you can leverage the AppStream session context feature. The session context allows you to pass user-specific information to the AppStream instance during the session start-up process.

Here's a step-by-step approach you can consider:

1. Retrieve user's license information:

   • When your API is called to create a streaming URL, retrieve the user's license information from your backend.
   • You can store this information in a secure way, such as encrypting it and attaching it to the session context.

2. Pass the user's license information in the session context:

   • When creating the streaming URL using the aws appstream create-streaming-url command, include the user's license information in the --session-context parameter.
   • The session context can be a JSON-encoded string that contains the user's license details.

   Example:

   aws appstream create-streaming-url --stack-name my-stack --fleet-name my-fleet --user-id 10 --application-id my-app-xyz --session-context '{"licenses": ["trial", "regular"]}'
   

3. Retrieve the user's license information in the start script:

   • In the start script of your AppStream image, you can access the session context information using the $APPSTREAM_SESSION_CONTEXT environment variable.
   • Parse the session context JSON and retrieve the user's license information.

   Example start script:

   #!/bin/bash
   
   # Retrieve the session context
   SESSION_CONTEXT=$APPSTREAM_SESSION_CONTEXT
   
   # Parse the session context and extract the user's licenses
   licenses=$(echo $SESSION_CONTEXT | jq -r '.licenses[]')
   
   # Validate the user's licenses and perform any necessary actions
   for license in $licenses; do
     case $license in
       "trial")
         # Grant access to trial applications
         ;;
       "regular")
         # Grant access to regular applications
         ;;
       # Add more license types as needed
     esac
   done
   
   # Start the application
   /path/to/application

By using the session context, you can securely pass the user's license information to the AppStream instance during the session start-up process. This allows you to validate the user's licenses and grant or deny access to the appropriate applications within the start script, before the application is launched.

Remember to ensure that the user's license information is stored securely in your backend and that the session context is protected from tampering by the end-user.