2.3.0 adds an IoT viewer role: read access to every IoT screen, for people who watch and never change anything. Auditors, a shift lead who only needs to look, someone outside the team who checks in on progress.
You add it as a group: Settings > Access Control > Groups > From template… > IoT viewer, then give the person the User role and that group. Members are User by default and User already reads devices, alarms and dashboards, so the group mainly adds the read permissions whose minimum role is Admin, such as device settings and certificates. It gives no credentials, keys, eSIM, router panel sessions or settings pages.
Before you hand it to anyone outside your company: a viewer sees every device in the organisation. Access policies can’t be written for one device or one site. If two groups of people must never see each other’s devices, put those devices in separate organisations, which are kept apart in the database.
Also fixed in 2.3.0: when your session has ended, the sign-in page now says so instead of showing an empty form.
Docs: Groups and permissions, Permissions reference, Access policies.
Good timing, we have an auditor from our insurer coming in two weeks. Half of what they want is the camera on the boiler house. Does the viewer get live view?
Yes. Watching live and viewing cameras are User permissions already, and the template includes cameras, live view, snapshots and recordings. Templates only offer permissions of modules your organisation has, so with cameras on you’ll see them in the group.
Tried it with a colleague’s test account, User + IoT viewer. They could still acknowledge an alarm and run a rule from a board. Is that expected? I read “never change anything” a bit more literally.
Expected, and thanks for testing before the auditor did. Groups only add permissions on top of the role. The group itself grants nothing that writes, but the User role holds some rights that act, by default. The ones you ran into: acknowledging alarms, running rules and switching their mode, and sending basic (read-only) commands.
Two ways to close it:
- If no User in your organisation should do those things, untick
iot_alarm.acknowledge,iot_rules.run,iot_rules.modeandiot_rpc.send.basicfor User in Access Rights. - If it’s only the viewers, write a Deny access policy with those actions and the condition
subject.roles containsthe viewer group’s key. Deny always wins. Run it in shadow mode first and check it in the access tester with an owner’s role so you don’t lock yourself out.
Went with the policy, viewers only. Shadow mode is on for now, I’ll look at the decision log on Friday and then turn shadow mode off.
We built a hand-made read-only group in September. Any reason to swap it for the template?
No need. A template group is an ordinary group once it’s added. If you want to compare, add the template and look at both columns side by side in Access Rights, then delete whichever you don’t keep. Deleting a group removes it from every member, so move people first.
- You must be logged in to reply to this topic.
Join the conversation
Sign in to ask and answer, like helpful posts and mark the reply that solved your problem. Every contribution earns points and levels.