Genetec ACS Integration Configuration Guide

Note: Software-based ACS Integrations are a licensed feature from Alcatraz and are not required for a functioning Alcatraz system. Contact Alcatraz Sales for more information.

1. Requirements

Alcatraz Platform Software	v3.4.0 or newer (On-prem or Cloud)
Genetec Synergis / WebSDK	v5.11, 5.12, 5.13, and 5.14
Genetec License	GSC-1SDK-ALCATRAZ-ROCK It needs one license per Genetec Directory we integrate. The Alcatraz Platform keeps one Web SDK connection open per Directory, and each connection uses one license. Federated child systems each need their own license
Network Ports	TCP 4590 - Outbound from Alcatraz Admin Portal (or Proxy Service) to Genetec WebSDK server. TCP 3033 - outbound - Alcatraz Proxy Service → Alcatraz Cloud Cloud-hosted deployments connect the ACS Integration Proxy to your region's Alcatraz cloud endpoint over TCP 3033 (US / EU each have their own endpoint). Confirm the exact endpoint for your instance in the [Alcatraz Proxy Service install guide].

2. Configure Genetec

The following procedure describes how to create a User in Security Center that the Alcatraz Platform will use for syncing with the Genetec system via the WebSDK.

2.1. Create the Web-based SDK role

In the Genetec Config Tool, go to System → Roles.
Click Add an entity and select Web-based SDK.
Name it (e.g., Web-based SDK), select the partition, click Next.
Review and click Create.
The role's default port (4590) and URI (WebSdk) are displayed - note them; you'll enter these in the Host URL in Section 3.2.

NOTE: Use the protocol the WebSDK is configured for - HTTPS when SSL is enabled on the Web-based SDK role (recommended, and required for cloud/Proxy deployments). If SSL is disabled, the URL uses http:// on the same port.

2.2. Create the SDK user

Go to User Management and create a dedicated Security Center user (e.g., alcatraz-sdk) for the integration and assign it the Web-based SDK role. A dedicated, least-privilege account is recommended over reusing an administrator account.

Required privileges

In the Config Tool, open the user's Privileges and set the following to Allow:

Privilege category	Privileges to allow
Application privileges	Log on using the SDK
Physical entities	View access control unit properties · View door properties
Access Control Management	View access rule properties · View credential properties · View cardholder properties · View cardholder group properties · View visitor properties
System Management	View system general settings · Modify custom events (only if Send Security Events* is enabled)*

These are the minimum privileges the integration needs. Every privilege above is read-only (View) except Modify custom events, which is used only to raise Alcatraz events in the Security Center. Any privilege not listed can be left at its default. An account with broader privileges will also work but is not required.

❗Important: partition access.

The SDK user must have access to the partition(s) that contain the doors, readers, cardholders, and credentials you want to sync. If a required entity is in a partition the user cannot access, synchronization fails even when all privileges above are granted. Grant access only to the partitions Alcatraz needs - assigning all partitions makes the integration load unnecessary entities and can slow synchronization.

3. Configure the ACS Integration in the Alcatraz Admin Portal

3.1. Before You Start

WARNING: When initially enabled, the ACS Integration will delete profiles that do not have at least one badge that is also present in the ACS.

It is recommended that a VM Snapshot is generated and the system is backed up before attempting to configure an ACS Integration.

Facility Code Mapping

IMPORTANT - The facility codes for cards to be synced should be configured BEFORE enabling the ACS Integration. Failure to do so could result in the deletion of profiles.

Pre-enable checklist

Take a full system backup.
Assign facility codes to card formats for the badges that the Alcatraz Platform should sync with Genetec.
Plan reader-to-Rock mapping
Confirm network ports are open (see Requirements).
Confirm the Genetec SDK user has only the permissions it needs - not full partition access.

Planned Genetec maintenance: Disable the ACS Integration in the Alcatraz Admin Portal before performing maintenance, upgrades, or restarts on the Genetec server, and re-enable it once Genetec is fully back online, then run a Full Sync. If the integration remains enabled while Genetec is only partially available, the sync may treat the missing data as deleted and remove valid profiles or access..

3.2. Main Settings

In the Alcatraz Admin Portal, go to Account → ACS Integration → Enable ACS Integration, then select Genetec from the ACS Integration list.

ACS Integration	Genetec
Host URL	Genetec WebSDK URL with protocol, host, and port. Format: https://<ip-or-fqdn>:4590/WebSdk
Username	The Genetec SDK user created above.
Password	Password for the Genetec SDK user
Schedule Full Sync	Time of day to start a full synchronization with the ACS.
Auto delete disabled profiles after	Grace period after which Alcatraz profiles tied to disabled ACS personnel records are automatically deleted.
Send Security Events	Sends Alcatraz security events to Genetec (Security Desk / Monitoring). Requires the Modify custom events privilege on the SDK user - see Create the SDK user.
Use Proxy	Enables the Certificate in PEM format download, for use with the Alcatraz Proxy Service (cloud-hosted deployments).
Certificate in PEM format	Available only when Use Proxy is checked. Click Download to save the PEM certificate, then use it when installing the Alcatraz Proxy Service > see Section 4
Advanced Logging	Produces more detailed ACS Integration logs, listing exactly which credentials were skipped and why, in addition to the aggregate count.

Note:

Protocol / SSL: Use the protocol the WebSDK is configured for - HTTPS when SSL is enabled on the Web-based SDK role (recommended, and required for cloud/Proxy deployments). If SSL is disabled, use http:// on the same port.
Test Connection: Click Test Connection to verify communication with Genetec, then Save. When using the Alcatraz Proxy Service, Test Connection always reports unsuccessful - this is expected.

4. Installing Alcatraz Proxy Service (Cloud Deployments)

Alcatraz Proxy Service opens a connection between the Alcatraz Platform and Genetec when the two are running in separate networks. Install it on a server that can reach the Genetec server directly over the network - usually on your own network, often on the Genetec server itself. Your Alcatraz Platform runs on-premises, but it cannot reach the Genetec server over the network (the two are in separate networks)

The Proxy connects locally to the Genetec WebSDK (TCP 4590) and opens a single outbound-only TLS connection to your region's Alcatraz cloud endpoint (US or EU) on TCP 3033, authenticated with your PEM certificate. No inbound firewall ports are required.

Alcatraz Proxy Service is required in the following cases:

You are an Alcatraz Enterprise Cloud user.
You are running Alcatraz Admin Portal on-premises but its network and the network where Genetec is running do not have direct visibility to each other.

In the ACS Integration settings, check Use Proxy.
Click Download under Certificate in PEM format and save the file.
Install the Proxy Service on a Windows Server with visibility to the Genetec WebSDK - follow Installing Alcatraz Proxy Service for OS requirements and installer steps.
During installation, enter your region's (US/EU) Alcatraz cloud endpoint on port 3033 (endpoints are listed in the install guide).

5. Map Genetec Card Readers to Rocks

In the Admin Portal, go to Device Management → Readers.
Click Add Reader and map each Rock to its reader.
Reader assignments can also be set from each Rock's device configuration page.

Note: After mapping a reader to a newly added Rock, run a Full Sync so existing profiles receive access on the new device. Until a sync completes, enrolled users may not be able to authenticate at the new Rock.

6. Verifying the Integration

(Proxy deployments only) Confirm the service is running: open Services (services.msc) and check that Alcatraz Proxy Service shows Running.
In the Alcatraz Admin Portal, open Account. The status at the top of the page should show ACS Online.
Run a Full Sync and confirm entries appear in the ACS Integration logs. The ACS Integration section includes the integration logs, a button to start a full sync, and an option to export the logs as a CSV file.

Proxy logs are stored under the Data Directory (default C:\ProgramData\Alcatraz AI\Proxy).

ACS Integration Logs

7. Troubleshooting

Connection

Symptom	Likely cause	What to check / fix
Test Connection fails (no Proxy)	Wrong protocol or URL; Web-based SDK role stopped; port blocked	Verify the URL matches the WebSDK SSL setting (https://<host>:4590/WebSdk); confirm the Web-based SDK role is running in Config Tool; confirm TCP 4590 is reachable from the Alcatraz Platform. Tip: browse to https://<host>:4590/WebSdk from the Platform server - a credential prompt means the WebSDK is reachable (a certificate warning is normal with a self-signed certificate).
Test Connection fails (Use Proxy enabled)	Expected behavior	Verify via the ACS Integration status and sync logs instead.
Authentication error on connect	Wrong SDK user credentials; missing "Log on using the SDK" privilege; no SDK license available	Verify credentials and privileges. Each active Web SDK connection consumes one GSC-1SDK-ALCATRAZ-ROCK license per Directory.
Connection fails at the TLS level after the Genetec server is migrated, rebuilt, or renamed	Stale self-signed certificate on the Web-based SDK role, still bound to the previous server identity	Regenerate the certificate on the Web-based SDK role in Config Tool, restart the role, and re-test the connection.

Synchronization

Symptom	Likely cause	What to check / fix
Full sync fails repeatedly	A facility code used by synced badges is not configured in the Alcatraz Platform	Configure every facility code in use for the card formats being synced, then run a Full Sync. A single missing facility code will cause the sync to keep failing.
Full sync fails or is incomplete	Missing View privileges on the SDK user	Apply the Required Privileges table exactly; enable Advanced Logging to see which credentials were skipped and why.
Sync runs but some cardholders, credentials, or readers are missing	SDK user lacks access to the partition containing those entities	Grant the SDK user access to the required partitions, then run a Full Sync.
A cardholder's badge never syncs	The badge's card format is not configured in the Platform	Only credentials matching the card formats configured in the Platform are synced - PINs and license plates are never synced. Add the card format and facility code, then run a Full Sync.
Profiles or access unexpectedly removed after Genetec maintenance or a network interruption	A synchronization ran while the Genetec server was only partially available, and incomplete data was reconciled as deletions	Disable the ACS Integration before planned Genetec maintenance and re-enable it afterward. If deletions have already occurred, contact Alcatraz Support before running further syncs.
Enrolled users cannot authenticate at a newly added Rock	Profiles have not yet propagated to the new device	After mapping the new Rock's reader, run a Full Sync.

Readers

Symptom	Likely cause	What to check / fix
A reader cannot be found in Add Reader search	On Platform versions up to 3.6.5, the search matches only from the beginning of the reader name	Type the start of the reader's exact name as shown in Genetec, or upgrade to Platform 3.6.6 or newer, where the search matches keywords anywhere in the name.
Mapped readers disappeared from the Platform after a full sync	The reader was renamed in Genetec (affects older Platform versions)	Re-add and re-map the reader. Avoid renaming readers that are already mapped to Rocks, or plan to re-map them afterward.

Events

Symptom	Likely cause	What to check / fix
Alcatraz events not visible in Security Desk / Monitoring	Send Security Events disabled; SDK user missing the custom-events privileges	Enable Send Security Events and grant View system general settings and Modify custom events.

Upgrades and Proxy

Symptom	Likely cause	What to check / fix
Integration goes offline after a Security Center upgrade	SDK package version no longer matches Security Center	Reinstall the matching SDK package; confirm the Genetec Update Service (GUS) is running
Proxy installed but integration stays offline	Wrong regional endpoint; outbound TCP 3033 blocked; SSL/TLS inspection; outdated PEM certificate	Verify the endpoint for your region; check firewall rules and SSL-inspection exemptions; re-download the certificate, replace the file, and restart the Proxy Service.
Profiles were deleted when the integration was first enabled	Facility codes not configured before enabling; badges not present in Genetec	Follow the pre-enable checklist; restore from backup if needed.