Short answer: Single sign-on lets staff open the video system with the account they already use for email, and lets IT remove that access by disabling one account. SAML, LDAP and Entra ID are three ways to connect a VMS to a directory. Pick the one your directory already speaks, map groups to roles, and keep one local owner account for emergencies.
Why a VMS needs directory sign-in at all
A camera system with its own user list is a user list nobody maintains. Installers create accounts during setup, staff share them, and leavers keep them. Six months later, the receptionist who left in March can still watch the loading bay from home.
Connecting the VMS to your directory fixes this at the source. Accounts are created, renamed and disabled in one place, with the same password policy and multi-factor rules as everything else.
What each protocol does
LDAP. The oldest of the three. The VMS connects to your directory server (Active Directory or OpenLDAP, typically) over the local network, checks the user’s password against it and reads which groups they belong to. Works with no internet, which suits air-gapped sites. The weakness is that the user types their password into the VMS, which then forwards it; there is no multi-factor step unless the directory enforces one separately.
SAML 2.0. A web standard. The VMS sends the user to your identity provider (Okta, Entra ID, Google Workspace, ADFS, Keycloak and others) to sign in; the provider sends back a signed assertion saying who they are and which groups they are in. The VMS never sees the password, and multi-factor is handled by the provider. Needs the client to reach the identity provider, so it suits sites with internet or an internal provider.
Microsoft Entra ID. Microsoft’s cloud directory, formerly Azure AD. It speaks SAML and OpenID Connect, so a VMS that supports either can use it. Mentioned separately because most organisations on Microsoft 365 already have it and the groups already exist.
| LDAP | SAML 2.0 | Entra ID | |
|---|---|---|---|
| Where the directory is | On your network | Any identity provider | Microsoft cloud |
| Password seen by VMS | Yes | No | No |
| Multi-factor | Via the directory, if at all | Handled by the provider | Handled by Microsoft |
| Works air-gapped | Yes | Only with an internal provider | No |
Mapping groups to roles
Sign-in says who someone is. Roles say what they may do. The useful middle is a mapping from directory groups to VMS roles, so that membership of Security-Operators makes someone an operator and leaving the group removes it on next sign-in.
A sensible set of roles for a video system:
- Owner: everything, including users, directory settings and deleting cameras.
- Admin: cameras, layouts, retention, but not users.
- Operator: live view, playback, search and export.
- Viewer: live view and playback only. No export, no changes.
Map one group per role per site. Avoid mapping a broad group such as All-Staff to anything above viewer.
Why the viewer role matters
Most people who need the cameras need only to look: a facilities manager checking a door, a line supervisor, a receptionist. Giving them the operator role because it is the default hands them export, which is how footage ends up in a WhatsApp group.
A viewer role that cannot export and cannot change anything lets you be generous with live access while keeping the audit log short. Pair it with an audit log that records every export, so the few people who can export know it is written down.
Offboarding leavers
With directory sign-in, offboarding is the directory’s job. Disable the account and the next VMS sign-in fails. Two details to check with the vendor:
- Session length. A disabled account with a session that lasts 30 days is still watching cameras for 30 days. Ask how long sessions last and whether an admin can end them.
- Group changes. Moving someone out of a group should take effect on the next sign-in, not the next full sync.
Once a quarter, list the VMS’s users and compare them with the directory. Any local accounts that are not the break-glass account should go.
The break-glass local owner account
Directory sign-in has a failure mode: the directory is down, the identity provider has an outage, the certificate expired, or someone changed a group name. In that moment you still need to get into the VMS.
Keep one local owner account that does not depend on the directory. Give it a long random password stored in the password manager or a sealed envelope, not on a Post-it in the control room. Make sure its use is logged, and review the log for it. If it was used, something went wrong that is worth a ticket.
Where Supervision fits
Supervision supports directory sign-in through SAML 2.0, LDAP and Microsoft Entra ID, with directory groups mapped to roles from owner to viewer. Every export, user change and camera change is written to the audit log, and a local owner account remains available for the day the directory is not. LDAP binding over the local network works on air-gapped sites. The setup is described on the enterprise page and the access model on the security page.
Supervision is self-hosted video management software for any camera brand. If this is the kind of problem you're solving, tell us about your cameras and we'll talk it through, or email hello@bipolarfactory.com.