Enable/disable rules from a Smart Client plugin with a user without rule permissions

MIP
, ,
1

Hi, I’m developing a Smart Client plugin (XProtect 2025 R3) that adds a button to each PTZ dome. The button enables or disables that dome’s “return to home” rules.

The plugin already works using the REST API with the Smart Client session token: GET /api/rest/v1/rules?disabled to read and PATCH /api/rest/v1/rules/{id} with {"enabled": false} to change them. Nothing is installed on the server.

The problem is permissions. For it to work, the operator’s role needs Management Server (Connect + Read) and Rules (Read + Edit). Without them, the API returns 0 rules. Our operators only have permissions to view cameras and move PTZ.

Questions:

  1. Is there any way to read and enable/disable rules from a Smart Client plugin with a user that doesn’t have those permissions?
  2. Does the Configuration API (ConfigurationService / SetItem()) enforce the same permissions as the REST API?
  3. If there’s no other way, is the recommended approach for the plugin to use a service user with only those permissions (token via /idp/connect/token with password grant)? Or is there another alternative you would recommend?

Thanks.

2

  1. No, a smart client plugin always performs actions with the logged in user, so if that user doesn’t have rules permissions, they can’t see or alter rules.

  2. Yes, but you could log in to the config api with a separate user if you really wanted to. It is not recommended, however.

  3. The recommended way would probably be to have a standalone service that does this for you on request. In general, enabling/disabling rules shouldn’t be done directly from the smart client. Perhaps consider if there is some other way of achieving the desired outcome.

1 Like
3

Thanks for the answer, Rik, that makes it clear.

Two more questions to finish defining the approach:

  1. Why is it not recommended for the plugin to use a separate user? Is it mainly because the credentials would be stored on every Smart Client PC, or is there another reason?
  2. About the standalone service: can it run on any PC on the network with access to the Management Server, or is it better to have it on the server? And do you recommend any particular way for the plugin to send requests to it (for example, plain HTTP or something from the MIP SDK)?

Thanks again.