Restricting access to cameras for Network Admins

[Dunky]

We have a number of network admin users that have full organization access, and some that have Organization Read Only Access.

I have been asked to look into preventing some of these users from being able to see the MV Cameras (without moving the the cameras out into a separate network).

This is to comply with GDPR.

Can anyone advise on how I achieve this.  We use SAML (SSO via Azure).

Thanks in advance.

[alemabrahao]

Maybe yes.

Restricting Access to Cameras - Cisco Meraki Documentation

[Ryan_Miles]

Not sure it's possible if these are combined networks. If an admin has network level access or org level access that applies to all nodes in the network. So there's no way to enforce a deny for cameras only unless I'm overlooking something in my evaluation of dashboard or my testing.

I think you'd need to break the cameras out into there own networks to achieve this.

[PhilipDAth]

Going sideways - does the access auditing not resolve the core issue - of identifying you has accessed what private information?  Sure they can still get to it - but it creates an audit trail of them doing it.

https://documentation.meraki.com/MV/Processing_Video/Video_Access_Log 

ps. For one company I ended up creating a new org just for the cameras to resolve access concerns.

[Dunky]

Thanks @PhilipDAth & @Ryan_Miles 

Breaking out the cameras into a separate network, or even organization seems a bizarre approach to address what in my opinion is a fundamental issue with access rights not being granular enough.

I wouldn't have thought it unreasonable to be able to prevent some network admins from being able to access video.  If say 2 roles were passed across via SAML, the 1st being Full access to network XYZ and the 2nd being a camera/sensor role that denies access to footage on cameras in network XYZ, then the result should be the user being able to access all the network settings for the camera, but just not able to see the image itself (dashboard and vision Portal).

[Ryan_Miles]

Just tested again and perhaps it is possible. Although it would be nice if the UI was better/different.

• I created a new role in my IDP called Network_Admins;No_Video
• In the Meraki dashboard I created a SAML role for Network_Admins with full access to a network
• I created a Camera role with no camera permissions to anything

Logging in allows me access to all parts of the network except cameras. I can see the list of cameras, but clicking on them results in a View failed to load error. This is where I wish it would instead say camera access denied rather than looking like a broken webpage.

And this all only makes sense I suppose if the SAML admin is a network admin. Because if they have org level permissions they could simply edit the no video camera role giving themselves access.

Again I would recommend testing this all out and seeing if the behavior is the same for you.

[Dunky]

Hi @Ryan_Miles 

I've now tested this and it appears to have a bug (I have raised case).....

I have a SAML role that grants Org Read Only "Org-RO", and a Camera and sensor role that denies access to all cameras and all sensors for all networks called No_Video.

Azure is passing across both roles "Org-RO;No_Video" ok.

If I login with this account and go direct to a VideoWall - it works great, every single tile in the wall says "Video Access Denied".

However, If I go to the Cameras-Cameras page, it lists the cameras ok. I select any one at random, it displays the cashed B/W image and flashes up "Video Access Denied" - but it then proceeds to display a live feed !!!!

Moving between cameras using the < and > does not displaying anything in the Video tab (correct). But navigating back to the cameras page and selecting another camera does the same (displays BW image, Video Access Denied" but then proceeds to display live feed!!)

Exact same issue if I replace Org Read Only with a specific Network Read Only.

[Ryan_Miles]

Seeing same behavior

[Dunky]

Thanks for confirming Ryan, its as though nobody ever tests these things! 

[Ryan_Miles]

Pretty sure it used to work as intended. Or rather has this hack config intends. Not quite sure this type of config was ever envisioned to be used. The safer approach is probably to have cameras in their own networks. Then regular RBAC for non camera networks can work and access to camera networks would be blocked without this "allow" no access type config. Just my 2 cents.

[Dunky]

The problem with that approach Ryan is that the cameras would lose all footage when moved plus we then end up having to move sensors too that are linked to or connect to the cameras.

Bit of a mess really, just need to get the access working as it should, I feel restricting access to cameras is a fundamental requirement with GDPR and segregation of duties etc.

[PhilipDAth · Accepted solution]

It might be worthwhile looking at third-party solutions like Boundless Digital.  They allow much more granular access to the Meraki Dashboard.

https://www.boundlessdigital.com/network-management/meraki-automation/role-based-access-control/ 

[Dunky]

Thanks Philip, that looks like a great solution.

I will investigate pricing and look into a trial to confirm it will achieve what we need.