Diseño e implementación del hardware

Available functionality depends on the system you are using. See Product comparison chart (on page 22) for more information.

On the Overall Security tab, you set up overall rights for roles. For every component available in your system, decide whether to Allow or Deny users with the role the rights to access and use different areas on the relevant component.

www.milestonesys.com 194 Management Client elements

You can associate a user with more than one role. If you select Deny on a security setting for one role and Allow for another, the Deny right permission overrules the Allow right permission.

The Overall Security tab is available in both XProtect Corporate and XProtect Expert, but the tab gives you the possibility to change more functionality in XProtect Corporate than in XProtect Expert. This is because you can set up differentiated administrator rights in XProtect Corporate, while such rights are not available in XProtect Expert. However, you can set overall rights for a role that uses XProtect Smart Client in both XProtect products.

In the following, the descriptions show what happens on each individual right for the different system components if you select Allow for the relevant role. If you use XProtect Expert, you can see which settings are not available to you under each system component.

For every system component or functionality, the full system administrator can use the Allow or Deny check boxes to set up security permissions for the role. Any security permissions you set up here is set up for the whole system component or functionality. So if, for example, you select the Deny check box on Cameras, all cameras added to the system are unavailable for the role. In contrast, if you select the Allow check box instead, the role can see all added cameras to the system. The result of selecting Allow or Deny on your cameras is that the camera settings on the Device tab then inherit your selections on the Overall Security tab so that either all cameras are available or unavailable to the particular role. If you want to set individual security permissions for individual cameras or similar device channels, you can then only set these individual permissions on the tab of the relevant system component or functionality if you have turned off any overall settings for the system component or functionality on the Overall Security tab.

The descriptions below also apply to the rights that you can configure through the MIP SDKs.

If you switch your license from XProtect Corporate to XProtect Expert, you can only do this if you have not set any security rights for the role for functionality that is not available in XProtect Expert.

Therefore, to complete such a switch, make sure that you remove all security rights that are available to XProtect Corporate only.

www.milestonesys.com 195 Management Client elements

Management Server

Security right Description XProtect

Expert Full control Enables the right to manage all security entries on this part

of the system.

Read

Enables read access to general data on the Management Server which the individual object security does not handle:  Logging in with the Management Client

 List of current tasks  Server Logs

It also enables access to the following features:  Remote Connect Services

 Smart Client Profiles  Management Client Profiles  Matrix

 Time Profiles

 Registered Servers and Service Registration API  Enterprise Servers

www.milestonesys.com 196 Management Client elements

Security right Description XProtect

Expert

Edit

Enables write access to general data on the server which the individual object security does not handle:

 Options

 License Management

It also enables users to create, delete and edit the following features:

 Remote Connect Services  Device groups

 Smart Client Profiles  Management Client Profiles  Matrix

 Time Profiles  Registered Servers  Enterprise Servers

Enables the right to configure local IP ranges when configuring the networkon the recording server.

Not available

System Monitor Enables the right to view the data of the System Monitor.

Status API

Enables the right to perform queries on the Status API located on the recording server. This means that the role with this right enabled, has access to read the status of the items located on the recording server.

Not available

Manage Federated site hierarchy

Enables the right to add and detach the current site to other sites in a federated site hierarchy.

If you set this permission to allowed on the child site only, the user can still detach the site from the parent site. Backup Configuration

Enables the right to create backups of the system configuration using the system's backup/restore functionality.

Manage security

Enables the right to manage permissions for the Management Server. It also enables users to manage roles, to add or remove members of roles and to create and delete basic users.

www.milestonesys.com 197 Management Client elements

Security right Description XProtect

Expert

Authorize users

Enables the right to authorize users when they are asked for a second login in XProtect Smart Client or Management Client. You define if a role requires login authorization on the Info tab.

Not available