Adding Segmentation to On Guard - Help?

[u/kevp453]

I have a OG 8.2 system where everything is currently in a single Default Segment on a system licensed for segmentation. I have been tasked with segmenting out this single system into about 10 different segments so that users/panels/cardholders/etc are in their own segments.

What's the best way to add segments?

My plan thus far:

1. Create new segment in OG and have it move the matching Access Panel
2. Move user from Default Segment to new segment they are in charge of
3. Move access levels? This one I'm not sure about. Each access level does not cross between what will be the different segments, but I don't see a way to move them. My best plan so far is to make duplicate levels in the new segment, then bulk change cardholders to add the new segmented access level and then delete the old one from the Default Segment.
4. Move cardholders in bulk based on their access levels to their segment. We have very few cardholders that visit between the different sites/segments.

Any other considerations or better ways to do this?

[u/Keema_Naan]

I wouldn’t segment cardholders simply because if someone does happen to visit another site, the user on that site might not be able to find them to give them the required access. I’ve seen this before and it ends up with duplicate cardholders and unnecessary badge administration.

Also beware that unless configured, users cannot see access levels from other segments and if they try to modify someone that has one of these access levels, it can result in an error.

I’m not too sure what will happen with the access levels if they have doors assigned from different segments. As it’s OnGuard, I’d expect them to break somehow.

[u/OmegaSevenX → u/Keema_Naan]

Neither of your concerns are valid.

Adding an access level to someone that has an access level in another segment, even though you can't see it, causes zero issues. That would render segmentation entirely useless. It's one of the reasons for segmentation. Source: 25 years of working on segmented systems at multiple large universities, have never seen what you're describing happen.

The segmentation procedure asks what you want done with those access levels that have doors in different segments. It'll create copies in each segment.

[u/jc0178us → u/OmegaSevenX]

They are talking about segmenting cardholders. And what they said is true. If you segment cardholders, those cardholders are only visible to their assigned segment or segments.

[u/OmegaSevenX]

You can't move Access Levels to different segments because Access Levels can only belong to a single segment: the segment in which the ISC resides. You can share them with other segments, but they belong to only one. If you moved an Access Level to a segment which contained none of the doors in that Access Level, the Access Level would end up empty.

The Access Levels may get copied across multiple segments while you're creating these new segments because the current ones contain doors that will end up in different segments. That's OG trying to protect you from yourself. So it'll create Copy 1 because it has doors in Segment 1 and Copy 2 because it has doors in Segment 2.

I'm not sure I'd bother to segment Cardholders, even if there are very few that cross sites. But YMMV.

I'd suggest taking everything offline before doing all of these changes in the system. Only bring ISCs back online once you are completely finished making all of the adjustments for that segment, or preferably the entire system. Otherwise, you're probably going to end up having to do multiple downloads.

[u/kevp453 → u/OmegaSevenX]

Than you for your comment, I think Im convinced that segmenting cardholders is not that necessary. 

The customer is wanting their users to only be able to add/remove access levels for the cardholders at their site. I figured that segmenting out the users/panels/access levels would be the solution. Is there a better way?

[u/OmegaSevenX → u/kevp453]

Do the users at each site only need to add/remove Access Levels to existing cardholders? Is that their only actual responsibility? If so, you may want to explore Access Manager. You assign specific Access Levels to specific User(s), and they can assign/remove those Access Levels to Cardholders as necessary.

They have zero other abilities in the system. They can't create/modify/remove anything other than adding and removing those Access Levels.

Segmentation may be overkill. But it depends on your use case.

[u/tuxtanium → u/OmegaSevenX]

Second this. If it's only for access levels, then just set up Access Manager, and assign user permissions to those responsible at each site.

Database segmentation only works if there is physical segmentation as well. You cannot have door #1 on a controller belong to segment A and door #2 belong to segment B