Azure SAML & Role Based Access to Cameras

[EvaF]

I have had a basic SSO/SAML setup for our Org admins to login to our Meraki Dashboard for several years (textbook integration). 

Now our camera use is growing and I need to have a much more scaled and granular control of who at which site has what access to cameras.  Such as Manager at A-Site can View and Export footage and View Live at B-Site. 

So essentially passing multiple roles with the much talked about semicolon separator.  The documentation is not comprehensive at all and literally the first words Meraki Support put in the ticket I opened was "We are unable to assist you...." bla bla.  Great impression on a fairly technical issue.

I have set up Camera and Sensor only roles such as sitea_viewlive and siteb_viewexport and created Azure groups with these role names assigned (making sure they are IDENTICAL per all documentation notes).... but I for the life of me cannot get it to pass more than one role.   Me and Grok3 have been at it for several days off and on.  I am a domain admin on the Azure side but this is a more complex task than the typical SAML setup and if I could just find an example anywhere I could probably get unstuck.  

Is there anyone out there that can even say this actually works?  Any kind soul have a link to a crib note that you might share?

Thanks!

EF

[RWelch]

Are you trying to achieve this using the older admin page or the Early Access > Organization Wide Users Page?

Managing Dashboard Administrators and Permissions (Modernized View) 

[EvaF]

The older page - I do see the "Org wide users page" as an option to enable.... would that help or hurt? HA

Not sure how that makes the Azure side send that semicolon separated list of groups (with app roles defined)...but I'm a good listener if you're a good talker.

Seeing posts from reddit saying this is just a feature that flat doesn't work but I really think it is knowing how to SEND the right data in the SAML token.

[RWelch]

The new page shows more granular permission sets - unfortunately I've not (ever) tied the cameras or roles to SSO/SAML but thought it was worth mentioning as it has more granular usability.

 

 

[Ryan_Miles]

All this new RBAC stuff is for local admins, not SAML.

[RWelch]

Ah, good to know.  Thank you!

[RWelch]

This was the announcement for more granular access control for your consideration.  I'm not 100% sure if it'll help your scenario but it does reference: 

• 1:1 SAML admin alignment for external authentication of users and SSO.

Introducing RBAC (Role-Based Access Control) Foundations for enhanced admin management

Availability

RBAC Foundations will be available in Early Access in an updated version of the dashboard Administrators page globally beginning December 17, 2024.

Stay tuned as we continually innovate and add more functionality to enhance role and admin management.

P.S. share your feedback with @Katia and the team! Let us know what’s useful and any features you’d like to see below or from the “Give your feedback” button in the bottom right of any dashboard page. 

[EvaF]

That is a much needed enhancement just within the Meraki Dashboard world.  I will have to read more thoroughly but I did not see the magic bullet I so badly need. 🙏

[EvaF]

A visual aid might help.  Within the Meraki Enterprise Application in Azure, the Single Sign-On with SAML has a section about your SAML claim and its attributes. 

In documentation, Meraki says they CAN receive more than 1 role but that SAML token must present as a semicolon separated list.   

For an enterprise level deployment I might have cameras in BuildingA, BuildingB and so on.  So building Entra ID (Azure AD) groups usually by building (or site), I have a group SG-CAM-BldgA-ViewLive (with an associated App role cam_bldga_viewlive) ... and so on.  

So if a user appears in multiple groups and that user goes through the single sign on - I want it to send that multiple group membership (also called multiple roles) back in the SAML token so that upon authentication that user is given the access to each role received in the token.

There are 3 or 4 articles that have pieces of the SAML puzzle and this one says it supports multiple roles being passed: Configuring SAML Single Sign-on for Dashboard - Cisco Meraki Documentation

But as detailed a configuration example as is provided in this Azure specific EA setup: Configuring SAML SSO with Microsoft Entra ID - Cisco Meraki Documentation  they stop without saying "and here is how you could pass more than one role" which is absolutely maddening when you have multiple sites and buildings to give only that access that is needed in the performance of ones job function.

[EvaF]

Understood - thank you for the call out.

[Mloraditch]

Have you used a SAML Tracer extension to see if Entra is actually sending the list? I've never done this type of setup, but everything I'm seeing says the role attribute should be the list of all roles the user is assigned to.

[Ryan_Miles]

Is the role in dashboard and your IdP exactly the same? Meaning for example sitea_viewlive;siteb_viewexport.

I've done this in several IdPs and they all work the same. As long as the role in the IdP is the semicolon separated list of exact names from dashboard it should be working.

If you look at the SAML login history in dashboard, find a recent login, then view the XML and look for the roles section near the end do you see the multiple roles? If yes on one line with semicolons or separate lines? If it's on separate lines it's not configured correctly and won't pass multiple roles and will only honor the first role matched.

[PhilipDAth]

This is starting to get a bit complex to explain via a post ...

There are multiple approaches.   This is a simpler approach.

Go to entra.microsoft.com, App Registrations.

Search for your application.

In your Meraki Dashboard application, click on App Roles.

Create as many new roles as required.

Now go back to entra.microsoft.com, Applications/Enterprie Applications.

Search for and go into your Meraki Dashboard application.

Go to users/groups.

Now either add a new user, or select an existing user and edit their assignment.  Assign them one of the new roles that you created.