.. _users: ************************************** Role and User Management ************************************** .. rubric:: In this chapter: .. contents:: :local: .. _predefined-roles: Predefined Roles ================================= FindFace Multi provides the following predefined roles: * Administrator is granted full access to the FindFace Multi functionality, integrative and administrative tools. .. important:: Whatever the role, the first administrator (Super Administrator) cannot be deprived of its rights. * Operator is granted full access to the FindFace Multi functionality. * User is granted rights to modify their profile and work with events and episodes. The other functions are available read-only. You can change the predefined roles privileges, as well as create various custom roles. .. _create-role: Create Custom Role ================================ To create a custom role, do the following: #. Navigate :guilabel:`Settings` -> :guilabel:`Roles`. #. Click :guilabel:`+ Add new role`. |create_role_en| .. |create_role_en| image:: /_static/create_role_en.png :scale: 50% .. |create_role_ru| image:: /_static/create_role_ru.png :scale: 50% #. On the :guilabel:`Information` tab, specify the role name. Save the role. |role_information_en| .. |role_information_en| image:: /_static/role_information_en.png :scale: 50% .. |role_information_ru| image:: /_static/role_information_ru.png :scale: 50% #. After saving the role, you will see the following tabs appear next to the :guilabel:`Information` tab: |role_cameragroups_en| .. |role_cameragroups_en| image:: /_static/role_cameragroups_en.png :scale: 65% .. |role_cameragroups_ru| image:: /_static/role_cameragroups_ru.png :scale: 65% * :guilabel:`Watch Lists`: role privileges for specific watch lists * :guilabel:`Camera Groups`: role privileges for specific camera groups * :guilabel:`Permissions`: role privileges for entire system functions and entities Set role privileges, subject to your needs. Note that there is a distinction between role privileges for a specific watch list/camera group and a system entity with the name ``watchlist``/``cameragroup``. For example, if you set ``Off`` for a certain camera group on the :guilabel:`Camera Groups` tab, users with this role won't be able to work with **this** very group of cameras. Unchecking all checkboxes for the ``cameragroup`` entity on the :guilabel:`Permissions` tab will prevent users from viewing and working with **all** camera groups. The full list of the FindFace Multi entities which are used in the current version is as follows: * ``all_own_sessions``: all :ref:`sessions ` of the current user on different devices .. note:: If relevant permissions for this entity are set, users will be able to view (``view``) and close (``delete``) all their sessions on different devices. Otherwise, users will be only allowed to view and close their session on the current device. Working with sessions takes place on the :guilabel:`Sessions` tab (:guilabel:`Settings`). * ``bodycluster``: :ref:`cluster of bodies ` * ``bodyevent``: body recognition :ref:`event ` * ``bodyobject``: full-length photo in a :ref:`record ` * ``camera``: :ref:`camera ` * ``cameragroup``: :ref:`camera group ` * ``carcard``: :ref:`vehicle record ` * ``carcluster``: :ref:`cluster of vehicles ` * ``carepisode``: :ref:`vehicle-related episode ` * ``carevent``: vehicle recognition :ref:`event ` * ``carobject``: vehicle photo in a record * ``counter``: :ref:`counters ` * ``deviceblacklistrecord``: :ref:`blocklist ` * ``facecluster``: :ref:`cluster of faces ` * ``faceevent``: face recognition :ref:`event ` * ``faceobject``: face photo in a :ref:`record ` * ``humancard``: :ref:`record of an individual ` * ``humanepisode``: :ref:`person-related episode ` * ``report``: :ref:`report ` * ``upload``: item (photo) in batch photo upload * ``uploadlist``: list of photos in batch upload * ``user``: :ref:`user ` * ``videoarchive``: :ref:`object identification in video files ` * ``watchlist``: :ref:`watch list ` * ``webhook``: :ref:`webhook ` You can also enable and disable rights for the following functionality: * ``batchupload_cards``: :ref:`bulk record upload ` * ``change_runtimesetting``: changing the FindFace Multi general settings * ``view_auditlog``: viewing and working with the :ref:`audit logs `. * ``configure_ntls``: configuration of the ``findface-ntls`` :ref:`license server ` * ``view_runtimesetting``: viewing the FindFace Multi :ref:`general settings ` #. Save the changes. Primary and Additional User Privileges ======================================== You assign privileges to a user by using roles: * :guilabel:`Primary role`: main user role, mandatory for assignment. You can assign only one primary role to a user. * :guilabel:`Role`: additional user role, optional for assignment. You can assign several roles to one user. The rights associated with the additional roles will be added to the primary privileges. All users belonging to a particular primary role automatically get access to camera groups (and video archives within the group) and watch lists (and records in the watch list) created by a user with the same primary role, subject to the privileges defined by their additional role(s). .. seealso:: :ref:`create-user` .. _create-user: Create User Account Manually =============================== To create a user account manually, do the following: #. Navigate :guilabel:`Settings` -> :guilabel:`Users`. #. Click :guilabel:`+ Add new user`. |create_user_en| .. |create_user_en| image:: /_static/create_user_en.png :scale: 60% .. |create_user_ru| image:: /_static/create_user_ru.png :scale: 60% #. On the :guilabel:`Information` tab, specify user data such as name, login, and password. If necessary, add a comment. #. From the :guilabel:`Roles` drop-down menu, select one or several user roles. Set one of them as the :guilabel:`Primary role`. #. On the :guilabel:`Photos` tab, attach the user's photo. #. Save the user account. |user_en| .. |user_en| image:: /_static/user_en.png :scale: 65% .. |user_ru| image:: /_static/user_ru.png :scale: 65% .. _integrate-active-directory: Integrate with Active Directory for Auto User Creation ============================================================= If there are many users in FindFace Multi, it can be inconvenient to create their accounts one by one. One of the ways to facilitate the user creation is to harness the FindFace Multi integration with Active Directory. To do so, follow the step-by-step instructions below, minding the sequence. Generate Keytab File --------------------------- Log-in into the Active Directory server and do the following: #. Create a new user account in the Active Directory domain to use as a service account. Do the following: #. Open Active Directory. Click :guilabel:`Start`, point to :guilabel:`Administrative Tools`, and then click :guilabel:`Active Directory Users and Computers`. #. Click the domain name and then expand the contents. Right-click :guilabel:`Users`, point to :guilabel:`New`, and then click :guilabel:`User`. You will see a user creation form. #. Fill-in the fields in the form at your discretion. On the second tab, check the :guilabel:`Password never expires` checkbox. #. Click :guilabel:`Next`. Review the information that you provided, and if everything is correct, click :guilabel:`Finish`. #. Right-click the just created user account, and then navigate :guilabel:`Properties` -> :guilabel:`Member Of` -> :guilabel:`Add`. #. In the :guilabel:`Select Groups` dialog box, add the :guilabel:`Domain Administrators` and :guilabel:`Domain Users` groups to the list, and then click :guilabel:`OK`. #. Click :guilabel:`OK` to finish. #. Register a Service Principal Name (SPN) for the service account that you created. To do so, open PowerShell as administrator and execute the following command, specifying your actual ``SERVICE USER NAME`` and domain. In the example below, the domain name is ``testntl.local``. .. code:: setspn -A HTTP/.testntl.local@TESTNTL.LOCAL #. In the same PowerShell window, generate a Keytab file by executing the command below with your actual ``SERVICE USER NAME``, domain, and desirable ``KEYTAB FILE NAME``. .. code:: ktpass.exe -princ HTTP/.testntl.local@TESTNTL.LOCAL -mapuser -crypto ALL -ptype KRB5_NT_PRINCIPAL -pass * -out c:\.keytab To check the result, navigate to the root directory of the ``C`` drive. You will see a keytab file with the relevant name. #. Move the keytab file that you created to the FindFace Multi server. Configure Volumes for Kerberos and Keytab File ------------------------------------------------------ To successfully establish a link between FindFace Multi and Active Directory, you need to enable the Kerberos support in the ``findface-multi-findface-multi-ui-1`` container on the FindFace Multi principal server. Do the following: #. Mount the ``/opt/findface-multi/configs/kerberos/krb5.conf`` file and the ``/opt/findface-multi/configs/keytab`` directory into the ``findface-multi-findface-multi-ui-1`` container. To do so, open the ``/opt/findface-multi/docker-compose.yaml`` configuration file and list them in the volumes of the ``findface-multi-ui`` section. .. code:: sudo vi /opt/findface-multi/docker-compose.yaml findface-multi-ui: ... volumes: ['./configs/findface-multi-ui/nginx-site.conf:/etc/nginx/conf.d/default.conf:ro', './data/findface-multi-legacy/uploads:/var/lib/findface-security/uploads', './configs/kerberos/krb5.conf:/etc/krb5.conf:ro', './data/findface-multi-ui/keytab/:/keytab/'] #. Create directories for the mounted volumes: ``/opt/findface-multi/configs/kerberos/`` and ``/opt/findface-multi/data/findface-multi-ui/keytab/``. Copy the Kerberos configuration file from the ``findface-multi-findface-multi-ui-1`` container to the ``/opt/findface-multi/configs/kerberos/`` directory. .. code:: sudo mkdir -p /opt/findface-multi/data/findface-multi-ui/keytab/ sudo mkdir /opt/findface-multi/configs/kerberos/ sudo docker cp findface-multi-findface-multi-ui-1:/etc/krb5.conf /opt/findface-multi/configs/kerberos/ #. Open the ``/opt/findface-multi/configs/kerberos/krb5.conf`` configuration file. Specify the Active Directory realm in the ``libdefaults`` section. It must be equal to the Active Directory domain name, but spelled in upper case (``TESTNTL.LOCAL`` in the example below). Specify the Active Directory domain in the ``realms`` section as well by analogy with the example below. .. code:: sudo vi /opt/findface-multi/configs/kerberos/krb5.conf [libdefaults] default_realm = TESTNTL.LOCAL ... [realms] TESTNTL.LOCAL = { kdc = testntl.local default_domain = testntl.local } #. Copy the keytab file to the ``/opt/findface-multi/data/findface-multi-ui/keytab/`` directory. #. Append the following string to the ``/etc/hosts`` file: `` ``. .. code:: vi /etc/hosts ... 192.168.0.5 testntl.local Configure NGINX on FindFace Multi Server to Support Active Directory ------------------------------------------------------------------------ #. Open the ``/opt/findface-multi/configs/findface-multi-ui/nginx-site.conf`` configuration file. Find the ``location /users/me/ad`` section and uncomment it. Fill in the section by analogy with the example below, placing your actual variables in the strings with comments (``#``). The variables to specify are the following: * ``auth_gss_realm``: realm name in Kerberos * ``auth_gss_keytab``: location of the keytab file. * ``auth_gss_service_name``: full service user name in Active Directory, including the name of the domain it belongs to .. code:: sudo vi /opt/findface-multi/configs/findface-multi-ui/nginx-site.conf location /users/me/ad { proxy_pass http://127.0.0.1/auth/ad_login/; # e.g http://127.0.0.1/auth/ad_login/; proxy_method POST; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Authorization $http_authorization; proxy_pass_header Authorization; proxy_no_cache 1; proxy_cache_bypass 1; auth_gss on; auth_gss_realm TESTNTL.LOCAL; # e.g. TESTNTL.LOCAL; auth_gss_keytab /keytab/user.keytab; # e.g. /var/lib/web.keytab auth_gss_service_name HTTP/user.testntl.local; # e.g. HTTP/web.testntl.local; auth_gss_allow_basic_fallback on; } Finalize FindFace Multi Configuration -------------------------------------------- To finalize the FindFace Multi integration with Active Directory, perform the following configuration steps on the FindFace Multi side: #. Open the ``/opt/findface-multi/configs/findface-multi-legacy/findface-multi-legacy.py`` configuration file. .. code:: sudo vi /opt/findface-multi/configs/findface-multi-legacy/findface-multi-legacy.py #. In the ``SERVICES`` section, set ``"active_directory": True``. .. code:: SERVICES = { ... "active_directory": True, ... } } #. Fill in the ``ACTIVE_DIRECTORY_CONFIG`` section as follows: * ``AUTH_LDAP_SERVER_URI``: ``ldap: `` * ``AUTH_LDAP_BIND_DN``: the name of the service user that you created in Active Directory * ``AUTH_LDAP_BIND_PASSWORD``: the service user password * ``SEARCH_GROUPS``: Active Directory organization units which FindFace Multi will search for user accounts .. code:: # Specify server credentials ACTIVE_DIRECTORY_CONFIG = { 'AUTH_LDAP_SERVER_URI': 'ldap://192.168.0.5', # Domain Administrator user 'AUTH_LDAP_BIND_DN': '', # Domain Administrator user password 'AUTH_LDAP_BIND_PASSWORD': 'SERVICE USER NAME PASSWORD', # Specify organization units where users search will be executed. # Follow pattern (e.g. OU=DEV,DC=domain,DC=com) 'SEARCH_GROUPS': 'OU=DEV,DC=testntl,DC=local', } #. Open the ``/opt/findface-multi/configs/findface-multi-identity-provider/findface-multi-identity-provider.py`` configuration file and repeat the previous steps. #. Rebuild all FindFace Multi containers. .. code:: cd /opt/findface-multi sudo docker-compose down sudo docker-compose up -d Manage FindFace Multi Users via Active Directory --------------------------------------------------------- If the FindFace Multi integration with Active Directory is enabled, you will be able to set one of the Active Directory groups for a role you are creating or editing. |ad_role_en| .. |ad_role_en| image:: /_static/ad_role_en.png :scale: 45% .. |ad_role_ru| image:: /_static/ad_role_ru.png :scale: 45% Once a user from the selected Active Directory group logs-in into FindFace Multi for the first time, they will be automatically added to the FindFace Multi user list. |ad_userlist_en| .. |ad_userlist_en| image:: /_static/ad_userlist_en.png :scale: 45% .. |ad_userlist_ru| image:: /_static/ad_userlist_ru.png :scale: 45% To log-in with Active Directory, a user must click the :guilabel:`Log in with Active Directory` button in the authentication window, specify their Active Directory credentials, and click :guilabel:`Sign in`. |ad_login_en| .. |ad_login_en| image:: /_static/ad_login_en.png :scale: 35% .. |ad_login_ru| image:: /_static/ad_login_ru.png :scale: 35% Deactivate or Delete Users ========================================= In order to deactivate a user, unset :guilabel:`Active` on the user list (:menuselection:`Settings -> Users`). If you are going to deactivate multiple users, select them on the user list and then click :guilabel:`Deactivate selected`. To delete users from FindFace Multi, select them on the user list and then click :guilabel:`Delete selected`.