This article outlines the different camera permission levels within Dashboard, how to create camera roles or camera only privileges and apply it to a user, as well as describes options available to these users.
Configuring Role-based Camera Permissions for SAML/SSO
Initial Dashboard SAML/SSO configuration
You will need to first configure your Organization to enable SAML 2.0 and configure your SAML Identity Provider (IdP) settings. You must have your own Identity Provider configured to use this feature. OneLogin offers a free trial for a developer environment to test with, as do other providers.
Follow this guide to get started:
Camera Role Restrictions
Please note the following:
SAML user roles can consist of:
a single Organization or Network Administrator Role defined in Dashboard
one or many Camera Roles defined in Dashboard
SAML role attribute should be sent as a semi-colon separated list with no spaces
SAML roles will match a Network/Organization Admin role first if there are conflicting roles defined between Network/Organization Admin roles and Camera roles
For best practice, an Organization/Network role should be passed first and camera role(s) afterward
For additional information on resolving possible SAML/SSO authentication issues, please refer to the article on SAML Login History Events.
Creating a Camera role in Dashboard
Navigate to Camera roles via the sidebar menus Organization > Configure > Camera roles. Select `Add Role` to get started.
Step 1: Role naming and Network access permissions
Enter the SAML Role to be mapped to these permissions exactly as it is configured in the Identity Provider.
Select Network permissions (either all or by tags)
Selecting `All networks` provides users with this role access to all Networks contained within the current Organization.
Selecting `Networks by tag` provides users with this role access to Networks with the specified tag(s) that are contained within the current Organization.
See this page for information on Managing Tags for your Networks
Step 2: Viewing permissions and camera permissions
- Configure camera viewing permissions
- This value is set for all permitted cameras and cannot be configured to be a different value for a subset of resources.
- Select camera permissions (either all or by tags)
- Selecting `All cameras` provides users with this role access to all cameras contained within the previously selected Networks in Step 1.
- Selecting `Cameras by tag` provides users with this role access to cameras with the specified tag(s) that are contained within the previously selected Networks in Step 1.
- See this page for information on Managing Tags for your Devices
Step 3: Confirmation
A simple confirmation page will summarize the proposed changes. Review and hit `Create role` when ready, or navigate back using the `Back` button to make any changes.
After committing the changes, there will be a small wait while saving before a confirmation dialog will appear.
You will return to the Roles overview page. Confirm your role is in the list with the correct parameters configured.
If the above steps are followed to completion and an identity provider is configured for the Organization, you are done! Users can now log in as a Camera role by using the Meraki application within your identity provider.
Configuring Local Camera-only Admins
Creating and Assigning a Camera-only privilege
The following instructions outline how to create a Camera-only privilege role, and assign it to a specific Network Administrator:
For camera only networks, navigate to Cameras > Configure > General. For combined networks, navigate Network-wide > Configure > Administration.
Navigate to the Network Administration > Camera-only privileges section.
- Select a Network Admin from the dropdown or create new user.
- Select the view setting as well as which cameras to apply the rule to:
- Click Save changes to save the role.
Camera-only Privilege Functionality
When a Network Admin with Camera-only privileges logs into Dashboard, their view is restricted in terms of both devices and functionality. It simplifies the menu for users to quickly and easily access the cameras. Also, camera-only admins are unable to make changes to cameras as they are given read-only rights. These changes include image settings such as focus, zoom, and aperture as well as viewing network tab of the camera.
One common use case for the camera-only admin feature is to allow a receptionist to view live footage only of the building atrium. This is due to the receptionist only needing to view who is currently in the atrium before allowing them access to the building. In this scenario, camera-only admin settings for the receptionists email would be view live footage and cameras tagged "Atrium".
Restricting and Enabling Meraki Support Access to Cameras
By default Cisco Meraki support technicians cannot view video or hear audio. You may choose to allow temporary access to receive help with focusing, zooming, or other video or audio quality issues. Temporary access is automatically revoked when time expires, or can be manually revoked at any time.
Temporary permission to view camera footage can be granted to Cisco Meraki support agents be navigating to Help > Get Help in the dashboard.
First ensure you have selected a network with cameras. Next, navigate to Help > Get Help. On this page, select MV smart cameras.
From here, on the bottom of the page, if your organization contains cameras, there is an option to enable video access for Meraki support. This can only be enabled by full organization admins.
If you cannot see this section, ensure you have selected a network with cameras.
If video access has already been granted, you can always revoke it on the same page by selecting Revoke Access.
Note: Only organization admins can grant support access to the video feed.
Tracking Meraki Support Access
The granting, revoking and expiring of Meraki Support access is logged on the organization change log.