Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User roles proposal #454

Open
wants to merge 19 commits into
base: development
Choose a base branch
from
Open

User roles proposal #454

Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
d747701
First version
ocampana-videotec Aug 9, 2024
280d8eb
Forgot to save a file...
ocampana-videotec Aug 9, 2024
b18d867
fixing a copy&paste error
ocampana-videotec Aug 9, 2024
6c3df00
Fixing a copy&paste error in the xsd
ocampana-videotec Aug 12, 2024
33d7f67
Incorporating feedback from JF on not supported functions.
ocampana-videotec Aug 19, 2024
d238848
Changes after the first session at the Bangkok F2F meeting
ocampana-videotec Sep 11, 2024
d975b8c
Changes after the second session at the F2F meeting in Bangkok
ocampana-videotec Sep 12, 2024
78e5dd7
Update doc/Uplink.xml
ocampana-videotec Nov 10, 2024
a7c8752
Update doc/Security.xml
ocampana-videotec Nov 10, 2024
975a89c
Update wsdl/ver10/device/wsdl/devicemgmt.wsdl
ocampana-videotec Nov 10, 2024
0a9e9ba
Update doc/Core.xml
ocampana-videotec Nov 10, 2024
0381580
Update doc/Core.xml
ocampana-videotec Nov 10, 2024
90793af
Update doc/Core.xml
ocampana-videotec Nov 10, 2024
a898b81
Fixing the wsdl file
ocampana-videotec Nov 12, 2024
9ff0d38
Forgot to rename in onvif.xsd
ocampana-videotec Nov 13, 2024
6f82d74
Including Sujith's suggestion to pass only the role name in GetUserRoles
ocampana-videotec Dec 9, 2024
32f42aa
The same change is applied to deleting user roles
ocampana-videotec Dec 9, 2024
93918a1
turning a variable into singular
ocampana-videotec Dec 11, 2024
52157f5
Better definiin the error message
ocampana-videotec Jan 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
617 changes: 395 additions & 222 deletions doc/Core.xml
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 5 additions & 1 deletion doc/Security.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1053,7 +1053,11 @@
<para>
<itemizedlist>
<listitem>
<para><emphasis>roles</emphasis>: Access class. One of the authenticated classes of the default access policy prefixed with the string <emphasis>onvif:</emphasis>, i.e. "onvif:Administrator", "onvif:Operator" or "onvif:User" as defined also within the ONVIF Core Specification. This access level will be used to authorize access to the required function.</para>
<para><emphasis>roles</emphasis>: Access role. One or more user roles, either
pre-defined ones or prefixed with the string <emphasis>onvif:</emphasis> .i.e.
"onvif:Administrator", "onvif:Operator" or "onvif:User" as defined also within the
ONVIF Core Specification, or custom ones defined on the device. These access roles
will be used to authorize access to the required function.</para>
</listitem>
</itemizedlist>
</para>
Expand Down
12 changes: 10 additions & 2 deletions doc/Uplink.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,14 @@
</author>
<revremark>Add support for WebSocket protocol and token authorization.</revremark>
</revision>
<revision>
<revnumber>25.06</revnumber>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this not change Version and Date? or are we waiting until the changes are merged?

<date>June 2025</date>
<author>
<personname>Ottavio Campana</personname>
</author>
<revremark>Add support for user roles.</revremark>
</revision>
</revhistory>
</info>
<chapter>
Expand Down Expand Up @@ -340,8 +348,8 @@
<para>CertificateID : ID of the certificate to be used for client authentication.</para>
</listitem>
<listitem>
<para>UserLevel : Authorization level that will be assigned to the uplink
connection</para>
<para>UserLevel : List of authorization levels and roles that will be used to restrict the
commands that will be accepted through the uplink connection.</para>
</listitem>
<listitem>
<para>Status : Current connection status</para>
Expand Down
117 changes: 116 additions & 1 deletion wsdl/ver10/device/wsdl/devicemgmt.wsdl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO
-->
<wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:tds="http://www.onvif.org/ver10/device/wsdl" targetNamespace="http://www.onvif.org/ver10/device/wsdl">
<wsdl:types>
<xs:schema targetNamespace="http://www.onvif.org/ver10/device/wsdl" xmlns:tt="http://www.onvif.org/ver10/schema" xmlns:tds="http://www.onvif.org/ver10/device/wsdl" elementFormDefault="qualified" version="23.12">
<xs:schema targetNamespace="http://www.onvif.org/ver10/device/wsdl" xmlns:tt="http://www.onvif.org/ver10/schema" xmlns:tds="http://www.onvif.org/ver10/device/wsdl" elementFormDefault="qualified" version="25.06">
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See my earlier comment.

<xs:import namespace="http://www.onvif.org/ver10/schema" schemaLocation="../../../ver10/schema/onvif.xsd"/>
<!--===============================-->
<xs:element name="GetServices">
Expand Down Expand Up @@ -272,6 +272,11 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO
<xs:documentation>Supported hashing algorithms as part of HTTP and RTSP Digest authentication.Example: MD5,SHA-256</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="MaxUserRoles" type="xs:int">
<xs:annotation>
<xs:documentation>Whenever set to an integer greater than zero, it signals that the device supports editable user levels. It indicates the maximum number of editable user levels.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:anyAttribute processContents="lax"/>
</xs:complexType>
<!--===============================-->
Expand Down Expand Up @@ -906,6 +911,53 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO
</xs:complexType>
</xs:element>
<!--===============================-->
<xs:element name="GetUserRoles">
<xs:complexType>
<xs:sequence>
<xs:element name="UserRole" type="tt:UserRole" minOccurs="0" maxOccurs="1">
ocampana-videotec marked this conversation as resolved.
Show resolved Hide resolved
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="GetUserRolesResponse">
<xs:complexType>
<xs:sequence>
<xs:element name="UserRoles" type="tt:UserRole" minOccurs="0" maxOccurs="unbounded">
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<!--===============================-->
<xs:element name="SetUserRole">
<xs:complexType>
<xs:sequence>
<xs:element name="UserRole" type="tt:UserRole" minOccurs="1" maxOccurs="1">
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="SetUserRoleResponse">
<xs:complexType>
<xs:sequence>
</xs:sequence>
</xs:complexType>
</xs:element>
<!--===============================-->
<xs:element name="DeleteUserRole">
<xs:complexType>
<xs:sequence>
<xs:element name="UserRole" type="tt:UserRole" minOccurs="1" maxOccurs="1">
ocampana-videotec marked this conversation as resolved.
Show resolved Hide resolved
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="DeleteUserRoleResponse">
<xs:complexType>
<xs:sequence>
</xs:sequence>
</xs:complexType>
</xs:element>
<!--===============================-->
<xs:element name="GetWsdlUrl">
<xs:complexType>
<xs:sequence>
Expand Down Expand Up @@ -2501,6 +2553,24 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO
<wsdl:message name="SetUserResponse">
<wsdl:part name="parameters" element="tds:SetUserResponse"/>
</wsdl:message>
<wsdl:message name="GetUserRolesRequest">
<wsdl:part name="parameters" element="tds:GetUserRoles"/>
</wsdl:message>
<wsdl:message name="GetUserRolesResponse">
<wsdl:part name="parameters" element="tds:GetUserRolesResponse"/>
</wsdl:message>
<wsdl:message name="SetUserRoleRequest">
<wsdl:part name="parameters" element="tds:SetUserRole"/>
</wsdl:message>
<wsdl:message name="SetUserRoleResponse">
<wsdl:part name="parameters" element="tds:SetUserRoleResponse"/>
</wsdl:message>
<wsdl:message name="DeleteUserRoleRequest">
<wsdl:part name="parameters" element="tds:DeleteUserRole"/>
</wsdl:message>
<wsdl:message name="DeleteUserRoleResponse">
<wsdl:part name="parameters" element="tds:DeleteUserRoleResponse"/>
</wsdl:message>
<wsdl:message name="GetWsdlUrlRequest">
<wsdl:part name="parameters" element="tds:GetWsdlUrl"/>
</wsdl:message>
Expand Down Expand Up @@ -3096,6 +3166,24 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO
<wsdl:input message="tds:GetEndpointReferenceRequest"/>
<wsdl:output message="tds:GetEndpointReferenceResponse"/>
</wsdl:operation>
<wsdl:operation name="GetUserRoles">
<wsdl:documentation>This operation returns the editable user levels configured in the device. Whenever an editable
user level is passed in the request, information only about that level is returned.</wsdl:documentation>
<wsdl:input message="tds:GetUserRolesRequest"/>
<wsdl:output message="tds:GetUserRolesResponse"/>
</wsdl:operation>
<wsdl:operation name="SetUserRole">
<wsdl:documentation>This operation configures an editable user level in the device. If the level
passed in UserRole already exists in the device, its configuration is overwritten. Otherwise,
a new editable user level is created.</wsdl:documentation>
<wsdl:input message="tds:SetUserRoleRequest"/>
<wsdl:output message="tds:SetUserRoleResponse"/>
</wsdl:operation>
<wsdl:operation name="DeleteUserRole">
<wsdl:documentation>This operation deletes an editable user level in the device.</wsdl:documentation>
<wsdl:input message="tds:DeleteUserRoleRequest"/>
<wsdl:output message="tds:DeleteUserRoleResponse"/>
</wsdl:operation>
<wsdl:operation name="GetRemoteUser">
<wsdl:documentation>This operation returns the configured remote user (if any). A device supporting remote user
handling shall support this operation. The user is only valid for the WS-UserToken profile or
Expand Down Expand Up @@ -3876,6 +3964,33 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO
<soap:body use="literal"/>
</wsdl:output>
</wsdl:operation>
<wsdl:operation name="GetUserRoles">
<soap:operation soapAction="http://www.onvif.org/ver10/device/wsdl/GetUserRoles"/>
<wsdl:input>
<soap:body use="literal"/>
</wsdl:input>
<wsdl:output>
<soap:body use="literal"/>
</wsdl:output>
</wsdl:operation>
<wsdl:operation name="SetUserRole">
<soap:operation soapAction="http://www.onvif.org/ver10/device/wsdl/SetUserRole"/>
<wsdl:input>
<soap:body use="literal"/>
</wsdl:input>
<wsdl:output>
<soap:body use="literal"/>
</wsdl:output>
</wsdl:operation>
<wsdl:operation name="DeleteUserRole">
<soap:operation soapAction="http://www.onvif.org/ver10/device/wsdl/DeleteUserRole"/>
<wsdl:input>
<soap:body use="literal"/>
</wsdl:input>
<wsdl:output>
<soap:body use="literal"/>
</wsdl:output>
</wsdl:operation>
<wsdl:operation name="GetWsdlUrl">
<soap:operation soapAction="http://www.onvif.org/ver10/device/wsdl/GetWsdlUrl"/>
<wsdl:input>
Expand Down
21 changes: 21 additions & 0 deletions wsdl/ver10/schema/onvif.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3828,6 +3828,22 @@ decoding .A decoder shall decode every data it receives (according to its capabi
</xs:restriction>
</xs:simpleType>
<!--===============================-->
<xs:complexType name="UserRole">
<xs:sequence>
<xs:element name="Name" type="xs:string">
<xs:annotation>
<xs:documentation>Name of the editable user level.</xs:documentation>
Copy link
Contributor

@venki5685 venki5685 Aug 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently ONVIF have Administrator, Operator, User, Anonymous, Extended User levels defined and the access permissions for these user levels also pre-defined. So Name parameter in EditableUserLevel should not conflict with any of the existing ONVIF Pre-Defined user levels so that the behavior of the ONVIf pre-defined user levels should not be changed. I also do not know the current usage of Extended User level pre-defined.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my vision, they do not conflic, because to use the EditableUserLevels the Userlevel must always be set to extended. But I understand that this may lead to tricky names. So, let's gather the opinion of other members.

</xs:annotation>
</xs:element>
<xs:element name="Functions" type="tt:StringList">
Copy link
Contributor

@tomasz-zajac tomasz-zajac Aug 14, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we consider more compact data representation? For example grouping methods by namespace:

  • namespace 1
    • function 1
    • function 2
    • function 3
  • namespace 2
    • function 1
    • function 2

<xs:annotation>
ocampana-videotec marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the predefined userroles like onvif:Administrator etc., the functions parameter can be empty ? or do we have fill this for pre-defined userroles also ? can we clarify this somewhere.

<xs:documentation>Names of the permitted function for the editable user level. The names must be prepended by the namespace and colon.</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
<xs:anyAttribute processContents="lax"/>
</xs:complexType>
<!--===============================-->
<xs:complexType name="User">
<xs:sequence>
<xs:element name="Username" type="xs:string">
Expand All @@ -3852,6 +3868,11 @@ decoding .A decoder shall decode every data it receives (according to its capabi
<!--===============================-->
<xs:complexType name="UserExtension">
<xs:sequence>
<xs:element name="Roles" type="tt:StringList" minOccurs="1" maxOccurs="1">
<xs:annotation>
<xs:documentation>The names of the roles assigned to the user.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/> <!-- first Vendor then ONVIF -->
</xs:sequence>
</xs:complexType>
Expand Down
4 changes: 2 additions & 2 deletions wsdl/ver10/uplink/wsdl/uplink.wsdl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,8 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO
<xs:element name="CertificateID" type="xs:string" minOccurs="0">
<xs:annotation><xs:documentation>ID of the certificate to be used for client authentication.</xs:documentation></xs:annotation>
</xs:element>
<xs:element name="UserLevel" type="xs:string">
<xs:annotation><xs:documentation>Authorization level that will be assigned to the uplink connection.</xs:documentation></xs:annotation>
<xs:element name="UserLevel" type="tt:StringList">
<xs:annotation><xs:documentation>List of authorization levels and roles that will be used to retrict the commands that will be accepted through the uplink connection.</xs:documentation></xs:annotation>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<xs:annotation><xs:documentation>List of authorization levels and roles that will be used to retrict the commands that will be accepted through the uplink connection.</xs:documentation></xs:annotation>
<xs:annotation><xs:documentation>List of authorization levels and roles that will be used to restrict the commands that will be accepted through the uplink connection.</xs:documentation></xs:annotation>

</xs:element>
<xs:element name="Status" type="xs:string" minOccurs="0">
<xs:annotation><xs:documentation>Current connection status (see tup:ConnectionStatus for possible values).</xs:documentation></xs:annotation>
Expand Down