IP3M-941B ONVIF and User Management

jack7 · Post by **jack7** » Sun Jul 11, 2021 9:16 pm

A non-admin user ID works fine for me on 3rd party Onvif software using 2018 Amcrest firmware and http rtsp. Your problem is probably new firmware. Perhaps not relevant, but Amcrest is not on the Onvif Compliant Products list at onvif dot org.

Re: IP3M-941B ONVIF and User Management · Post by **Revo2Maxx** » Sun Jul 11, 2021 10:56 pm

@jack7 What camera are you using? I would look to see if I have the same camera and same results.. I did only try 941 and 841v3 in my test.. I have yet to change my passwords on my cameras and devices as I have loads of items that would need changing and I would be resetting them as I go on the pass change because of the Recorders they are connected to, I would just Reset the cameras and maybe batch set the passwords.. I have not tried it but looks like it can be done using the IP config tool..

Slyke · Post by **Slyke** » Sun Jul 11, 2021 11:58 pm

@Revo2Maxx Yep, it doesn't have to be the Onvier app specifically. There are 1000s of "ip camera ONVIF viewer" apps on the Play Store. That was just the app I was using, but I had tested 3 or 4 others just to make sure that it was the camera, and not the app itself. I even used Wireshark and sniffed the packet my phone was sending out, and then used Postman to test it with credentials. Sure enough, it only works with the admin account.

I found a camera API from another thread here, and will test if it can authenticate correctly using ONVIF and a non admin account. https://github.com/tchellomello/python-amcrest

I just realised that you're an admin here too. I appreciate that these cameras are open and interoperable like this. I recently returned some Blink cameras because they were garbage in terms of interoperability. It means I'll be buying more Amcrest cameras once I've figured out the kinks ^.^; already own 3!

Slyke · Post by **Slyke** » Mon Jul 12, 2021 12:26 am

Okay, I found the actual problem. Only admin account can use the GetDeviceInformation API call.
Not sure if that's a bug or feature request to have a checkbox added to the user management page to allow a user to get this information.

I got these logs from the Onvier app.

Here's what it looks like when it fails:

Code: Select all

2021-07-11T23:18:28.094-07:00	Logging queue: 5/100
Request GetDeviceInformation has been sent. Waiting for response and processing...


2021-07-11T23:18:28.118-07:00	Logging queue: 6/100
Response: <?xml version="1.0" encoding="utf-8" standalone="yes" ?><s:Envelope xmlns:sc="http://www.w3.org/2003/05/soap-encoding" xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:tt="http://www.onvif.org/ver10/schema" xmlns:tds="http://www.onvif.org/ver10/device/wsdl"><s:Header/><s:Body><tds:GetSystemDateAndTimeResponse><tds:SystemDateAndTime><tt:DateTimeType>Manual</tt:DateTimeType><tt:DaylightSavings>false</tt:DaylightSavings><tt:TimeZone><tt:TZ>GMT-06:00</tt:TZ></tt:TimeZone><tt:UTCDateTime><tt:Time><tt:Hour>5</tt:Hour><tt:Minute>18</tt:Minute><tt:Second>26</tt:Second></tt:Time><tt:Date><tt:Year>2021</tt:Year><tt:Month>7</tt:Month><tt:Day>12</tt:Day></tt:Date></tt:UTCDateTime><tt:LocalDateTime><tt:Time><tt:Hour>23</tt:Hour><tt:Minute>18</tt:Minute><tt:Second>26</tt:Second></tt:Time><tt:Date><tt:Year>2021</tt:Year><tt:Month>7</tt:Month><tt:Day>11</tt:Day></tt:Date></tt:LocalDateTime></tds:SystemDateAndTime></tds:GetSystemDateAndTimeResponse></s:Body></s:Envelope>


2021-07-11T23:18:28.121-07:00	Logging queue: 7/100
Sending command: GetDeviceInformation Authentication time:Sun Jul 11 22:18:26 PDT 2021
	http://LAN_IP/onvif/device_service


2021-07-11T23:18:28.122-07:00	Logging queue: 8/100
Entering SOAP call loop. HTTPS: false


2021-07-11T23:18:28.557-07:00	Logging queue: 0/100
Response: <?xml version="1.0" encoding="utf-8" standalone="yes" ?><s:Envelope xmlns:sc="http://www.w3.org/2003/05/soap-encoding" xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ter="http://www.onvif.org/ver10/error" xmlns:d="http://schemas.xmlsoap.org/ws/2005/04/discovery" xmlns:wsnt="http://docs.oasis-open.org/wsn/b-2" xmlns:wsrf-bf="http://docs.oasis-open.org/wsrf/bf-2"><s:Body><s:Fault><s:Code><s:Value>s:Sender</s:Value><s:Subcode><s:Value>ter:NotAuthorized</s:Value></s:Subcode></s:Code><s:Reason><s:Text xml:lang="en">Sender not Authorized. Invalid username or password! You still have 0 attempt(s).</s:Text></s:Reason></s:Fault></s:Body></s:Envelope>


2021-07-11T23:18:28.557-07:00	Logging queue: 1/100
Sender not Authorized. Invalid username or password! You still have 0 attempt(s).

And here is what it looks like when it passes:

Code: Select all

2021-07-11T23:16:50.734-07:00	Logging queue: 0/100
Response: <?xml version="1.0" encoding="utf-8" standalone="yes" ?><s:Envelope xmlns:sc="http://www.w3.org/2003/05/soap-encoding" xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:tt="http://www.onvif.org/ver10/schema" xmlns:tds="http://www.onvif.org/ver10/device/wsdl"><s:Header/><s:Body><tds:GetSystemDateAndTimeResponse><tds:SystemDateAndTime><tt:DateTimeType>Manual</tt:DateTimeType><tt:DaylightSavings>false</tt:DaylightSavings><tt:TimeZone><tt:TZ>GMT-06:00</tt:TZ></tt:TimeZone><tt:UTCDateTime><tt:Time><tt:Hour>5</tt:Hour><tt:Minute>16</tt:Minute><tt:Second>48</tt:Second></tt:Time><tt:Date><tt:Year>2021</tt:Year><tt:Month>7</tt:Month><tt:Day>12</tt:Day></tt:Date></tt:UTCDateTime><tt:LocalDateTime><tt:Time><tt:Hour>23</tt:Hour><tt:Minute>16</tt:Minute><tt:Second>48</tt:Second></tt:Time><tt:Date><tt:Year>2021</tt:Year><tt:Month>7</tt:Month><tt:Day>11</tt:Day></tt:Date></tt:LocalDateTime></tds:SystemDateAndTime></tds:GetSystemDateAndTimeResponse></s:Body></s:Envelope>

2021-07-11T23:16:50.737-07:00	Logging queue: 0/100
Sending command: GetDeviceInformation Authentication time:Sun Jul 11 22:16:48 PDT 2021
	http://LAN_IP/onvif/device_service

2021-07-11T23:16:50.738-07:00	Logging queue: 1/100
Entering SOAP call loop. HTTPS: false

2021-07-11T23:16:51.380-07:00	Logging queue: 0/100
Response: <?xml version="1.0" encoding="utf-8" standalone="yes" ?><s:Envelope xmlns:sc="http://www.w3.org/2003/05/soap-encoding" xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:tt="http://www.onvif.org/ver10/schema" xmlns:tds="http://www.onvif.org/ver10/device/wsdl"><s:Header/><s:Body><tds:GetDeviceInformationResponse><tds:Manufacturer>Amcrest</tds:Manufacturer><tds:Model>IP2M-841B-V3</tds:Model><tds:FirmwareVersion>2.800.00AC001.0.R, Build Date 2021-03-31</tds:FirmwareVersion><tds:SerialNumber>MY SNIPPED SERIAL NUMBER</tds:SerialNumber><tds:HardwareId>1.00</tds:HardwareId></tds:GetDeviceInformationResponse></s:Body></s:Envelope>

2021-07-11T23:16:51.382-07:00	Logging queue: 1/100
GetDeviceInformation response has been received and processed

Re: IP3M-941B ONVIF and User Management · Post by **Revo2Maxx** » Mon Jul 12, 2021 12:33 am

Yes I am a Amcrest Guru as the Title goes, Just so I am clear I am not a Amcrest Employee. CCTV is one of my Hobbies and try to help as much as I can. I am human and I make mistakes along the way..

It might be that it was just something that was overlooked in an update of FW. Jack7 has a camera that he says works so might have been an oversight

Slyke · Post by **Slyke** » Mon Jul 12, 2021 12:45 am

Ah, okay. I submitted a support ticket on the website ( #413257 ) with some details and linked this thread. I'll post back here if/when they respond.

jack7 · Post by **jack7** » Mon Jul 12, 2021 10:29 am

jack7 wrote: ↑Sun Jul 11, 2021 9:16 pm A non-admin user ID works fine for me on 3rd party Onvif software using 2018 Amcrest firmware and http rtsp. Your problem is probably new firmware. Perhaps not relevant, but Amcrest is not on the Onvif Compliant Products list at onvif dot org.

I was using 2018 plugin firmware with IP2M-858. To work with Onvif 3rd party app, a non-admin ID must also be added to camera Settings/System/Manage Users/ ONVIF User. I assume you are also doing that with your new non-plugin firmware.
I don't have non-plugin Amcrest firmware. It does work with non-plugin Dahua firmware set up for ONVIF User.

Re: IP3M-941B ONVIF and User Management · Post by **Revo2Maxx** » Mon Jul 12, 2021 11:36 am

Aww a camera I don't have lol.. Yeah that is something that my Cameras new and old don't have and only line of hardware that has an option like that is my Hikvision hardware and my Dahua cameras offer the Onvif user tab within the Manage user area of the Setup.. Even logging into my 1046EW-AI camera that is the NEWEST in the family of True CCTV cameras and it don't have it either yet my Dahua line of camera from within the same line of cameras the Dahua is a month newer by FW release date does have it. I wonder if maybe as I said once before it was a security added feature because opening it might make the camera less secure or maybe even cause it to work slower maybe if there was loads of users setup there. Where only having the Admin account setup would keep the camera harder to attack? Don't know just guessing..

jack7 · Post by **jack7** » Mon Jul 12, 2021 3:00 pm

Use the API commands below to get ONVIF Authorization for a non-admin ID. I tried it with an IP4M-1026 and it worked. I used APIs in a browser.

: Screenshot_20210712-144204_Google PDF Viewer.jpg (492.53 KiB) Viewed 3496 times

Re: IP3M-941B ONVIF and User Management · Post by **Revo2Maxx** » Mon Jul 12, 2021 5:42 pm

Interesting, I tried it in my 941 and I tried it in the 841V3 and both of them gave Errors. Oddly the 941's error came back as

Error
Error ID=2, Detail=Invalid Request!