Users and permissions
Create local user accounts, build roles from allow and deny rules scoped to sites, areas, groups, or single cameras, and review who has access.
Esta guía se publica en inglés.
Kalytera VMS uses its own local accounts. Users are managed in Configure > Users and roles in Configure > Roles & permissions.
Add a user
- Go to Configure > Users and select Add user.
- Enter a User name (3 to 128 letters, digits, dots, underscores, dashes, or @ signs), a Display name, and a Password of 12 to 256 characters.
- Save the user, then assign roles or direct access exceptions. A new account has no access until you do.
For each user you can Edit account, Set password, review Browser sessions and Revoke them, and Deactivate the account, which blocks sign-in and ends every active session. Reactivate restores it. Kalytera VMS always keeps at least one enabled system administrator, and sign-in attempts are limited to 5 per minute from each IP address.
An administrator can set a new password for another user, another administrator included, without knowing that account's password. The reset signs that user out everywhere. To change your own password, you enter your current one.
Roles
Every installation has five role templates. They are read-only: assign one as it is, or duplicate the nearest one and change the copy.
| Template | Gives |
|---|---|
| Administrator | Every permission. The first administrator holds it. |
| Operator | Live and recorded video, alarm handling, and maps, with no configuration. |
| Viewer | Live and recorded video only. |
| Technician | Device, recording, storage, Site Node, and system configuration, and diagnostics, with no user or role administration and no recorded video. |
| Auditor | The audit log and read-only configuration and health views, with no video. |
Administrator, Technician, and Auditor sessions end after 30 minutes idle or 12 hours in all. Operator and Viewer sessions have no limit, so monitoring desks are not interrupted.
Select Add role to create a role of your own:
- Give the role a Name and a Description.
- Add policy rows, each with a permission, Allow or Deny, and a scope.
- Optionally set an Idle timeout and an Absolute timeout for the role's sessions, from 15 minutes to 24 hours.
Deny always wins over allow, and changing someone's access ends the sessions it affects.
Permissions and scopes
Permissions are grouped by area, including Video, Recording, Alarms, Events & automation, Devices, Camera analytics, Maps, Operator views, Sites & relationships, Site Nodes, Users & access, Audit, Diagnostics, and System. Video alone has separate permissions for live video, playback, export, bookmarks, and retention holds.
Every permission can apply to the whole Installation. Permissions that concern resources can instead be limited to one Site, Area, Group, or a single Resource such as a camera. Sites, areas, and groups are set up in Configure > Maps & relationships, under Sites & relationships.
Who has access
The Explain access tab answers two questions. Explain one user shows why a user can or cannot do something, and Who has access lists everyone who holds a permission on a resource: select Find people with access.
Audit log
Configure > System > Audit log records protected operations: who started them, what they targeted, and whether they succeeded. Filter it by time range (the last 24 hours, 7 days, 31 days, or all retained history) and by outcome. Anyone who may read the audit log sees the display names of the people it names, without access to the user list.