Restricting Access to Cameras
This article outlines the different camera permission levels within Dashboard, how to create camera roles or camera-only privileges and apply them to a user, and describes options available to these users.
Configuring Role-based Camera Permissions for SAML/SSO
Initial Dashboard SAML/SSO configuration
First, you will need to configure your Organization to enable SAML 2.0 and configure your SAML Identity Provider (IdP) settings. You must have your Identity Provider configured to use this feature. OneLogin offers a free trial for a development environment to test with, as do other providers.
Follow this guide to get started:
Camera Role Restrictions
Please note the following:
-
SAML user roles can consist of:
-
a single Organization or Network Administrator Role defined in Dashboard
-
one or many Camera Roles defined in Dashboard
-
SAML role attribute should be sent as a semi-colon separated list with no spaces
-
-
SAML roles will match a Network/Organization Admin role first if there are conflicting roles defined between Network/Organization Admin roles and Camera roles
-
For best practice, an Organization/Network role should be passed first and camera role(s) afterward
For additional information on resolving possible SAML/SSO authentication issues, please refer to the article on SAML Login History Events.
Creating a Camera role in Dashboard
Navigate to Camera roles via the sidebar menus Organization > Configure > Camera roles. Select `Add Role` to get started.
Step 1: Role naming and Network access permissions
-
Enter the SAML Role to be mapped to these permissions precisely as configured in the Identity Provider.
-
Select Network permissions (either all or by tags)
-
Selecting `All networks` provides users with this role access to all Networks contained within the current Organization.
-
Selecting `Networks by tag` provides users with this role access to Networks with the specified tag(s) contained within the current Organization.
-
See this page for information on Managing Tags for your Networks
-
-
Step 2: Viewing permissions and camera permissions
- Configure camera viewing permissions
- This value is set for all permitted cameras and cannot be configured to be a different value for a subset of resources.
- Select camera permissions (either all or by tags)
- Selecting `All cameras` provides users with this role access to all cameras contained within the previously selected Networks in Step 1.
- Selecting `Cameras by tag` provides users with this role access to cameras with the specified tag(s) contained within the previously selected Networks in Step 1.
- See this page for information on Managing Tags for your Devices
Step 3: Confirmation
A simple confirmation page will summarize the proposed changes. Review and hit `Create role` when ready, or navigate back using the `Back` button to make changes.
After committing the changes, there will be a slight wait while saving before a confirmation dialog will appear.
You will return to the Roles overview page. Confirm your role is in the list with the correct parameters configured.
If the above steps are followed to completion and an identity provider is configured for the Organization, you are done! Users can now log in as a Camera role using the Meraki application within your identity provider.
Configuring Local Camera-only Admins
Creating and Assigning a Camera-only privilege
The following instructions outline how to create a Camera-only privilege role and assign it to a specific Network Administrator:
-
For camera-only networks, navigate to Cameras > Configure > General. For combined networks, navigate Network-wide > Configure > Administration.
-
Navigate to the Network Administration > Camera-only privileges section.
- Select a Network Admin from the dropdown or create a new user.
- Select the view setting as well as which cameras to apply the rule to:
- Click Save changes to save the role.
Camera-only Privilege Functionality
When a Network Admin with Camera-only privileges logs into Dashboard, their view is restricted in terms of both devices and functionality. It simplifies the menu for users to quickly and easily access the cameras. Also, camera-only admins cannot make changes to cameras as they are given read-only rights. These changes include image settings such as focus, zoom, aperture, and viewing network tab of the camera. This also includes the ability to create and edit video walls, which is limited to network and org admins today.
One everyday use case for the camera-only admin feature is to allow a receptionist to view live footage only of the building atrium. This is because the receptionist only needs to view who is currently in the atrium before allowing them access to the building. In this scenario, camera-only admin settings for the receptionist's email would be view live footage and cameras tagged "Atrium."
Restricting and Enabling Meraki Support Access to Cameras
This will allow Cisco Meraki Support to view your Dashboard as well as Vision Portal
Cisco Meraki support technicians cannot view video or hear the audio by default. You may choose to allow temporary access to receive help with focusing, zooming, or other video or audio quality issues. Temporary access is automatically revoked when the time expires or can be manually revoked at any time.
Temporary permission to view camera footage can be granted to Cisco Meraki support agents by navigating to Help > Get Help in the dashboard.
Help Page
First, ensure you have selected a network with cameras. Next, navigate to Help > Get Help. On this page, select MV smart cameras.
From here, at the bottom of the page, if your organization contains cameras, there is an option to enable video access for Meraki support. Full organization admins can only enable this.
If you cannot see this section, ensure you have selected a network with cameras.
If video access has already been granted, you can always revoke it on the same page by selecting Revoke Access.
Note: Only organization admins can grant support access to the video feed.
Tracking Meraki Support Access
Meraki Support access's granting, revoking, and expiring is logged on the organization changelog.
