Users and permissions
Create local user accounts, build roles from allow and deny rules scoped to sites, areas, groups, or single cameras, and review who has access.
Kalytera VMS uses its own local accounts. Users are managed in Configure > Users and roles in Configure > Roles & permissions.
Add a user
- Go to Configure > Users and select Add user.
- Enter a User name (3 to 128 letters, digits, dots, underscores, dashes, or @ signs), a Display name, and a Password of 12 to 256 characters.
- Save the user, then select Edit access to assign roles and any Direct exceptions, and select Save access. A new account has no access until you do.
For each user you can Edit account, Set password, review Sessions, which lists browser and phone sessions, with Revoke and Revoke all, and Deactivate the account, which blocks sign-in and ends every active session. Reactivate restores it. Kalytera VMS always keeps at least one enabled system administrator, and sign-in attempts are limited to 5 per minute from each source address and 5 per minute for each user name.
An administrator can set a new password for another user, another administrator included, without knowing that account's password. The reset signs that user out everywhere. To change your own password, you enter your current one.
Roles
Every installation has five role templates. They are read-only: assign one as it is, or select Duplicate on the nearest one and change the copy.
| Template | Gives |
|---|---|
| Administrator | Every permission. The first administrator holds it. |
| Operator | Live and recorded video, alarm handling, and maps, with no configuration. |
| Viewer | Live and recorded video only. |
| Technician | Device, recording, storage, Site Node, and system configuration, and diagnostics, with no user or role administration and no recorded video. |
| Auditor | The audit log and read-only configuration and health views, with no video. |
Administrator, Technician, and Auditor sessions end after 30 minutes idle or 12 hours in all. Operator and Viewer sessions have no limit, so monitoring desks are not interrupted.
Select Add role to create a role of your own:
- Give the role a Name and a Description.
- In the permission matrix, set each permission to Not set, Allow, or Deny for the entire installation.
- Use Add a scoped exception to allow or deny a permission for one site, area, group, or resource instead.
- Optionally set an Idle timeout and an Absolute timeout for the role's sessions: No timeout, 15 minutes, 30 minutes, 1 hour, 8 hours, or 24 hours.
- Select Save changes. A summary shows what the change affects.
A user's own session limits, set in Edit access, win over the role's; Inherit from role uses the shortest limit of the user's roles. Deny always wins over allow, and changing someone's access ends the sessions it affects.
Permissions and scopes
Permissions are grouped into Video, Operator views, Recording, Alarms, Events & notifications, Intrusion panels, Cameras & devices, Maps & sites, Site Nodes, System, and Users & access. Video has separate permissions for live video, playback, export, bookmarks, and retention holds.
In the matrix, every permission applies to the entire installation, and 22 of them also accept a scoped exception for one Site, Area, Group, or a single Resource such as a camera. Sites, areas, and groups are set up in Configure > Maps & relationships, under Sites & relationships.
Who has access
The Explain access tab answers two questions. Who has access lists everyone who holds a permission on a resource: choose it in Find permission and pick the Resource. Explain one user shows why a user can or cannot do something.
Audit
Configure > System > Audit records protected operations: who started them, what they targeted, and whether they succeeded. Filter it by time range (the last 24 hours, 7 days, 31 days, or all retained history) and by outcome. Anyone who may read the audit log sees the display names of the people it names, without access to the user list.