# Active Directory not filtering by with User List Filter? **URL:** \ **Category:** Ignition\ **Tags:** ignition79\ **Created:** [March 22, 2023, 5:24pm UTC](https://forum.inductiveautomation.com/t/active-directory-not-filtering-by-with-user-list-filter/71448 "2023-03-22T17:24:14Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [March 22, 2023, 5:24pm UTC](https://forum.inductiveautomation.com/t/active-directory-not-filtering-by-with-user-list-filter/71448/1 "2023-03-22T17:24:15Z")
I am working with Ignition 7.9. Setting up an active directory-internal hybrid User source. Right now it seems like anyone from the Active Directory is able to login but really we just want certain members of the AD to be able to login. The User Listing Base is the default blank. The User List Filter was modified to include certain OU units. the User Search Filter is the default `(&(objectClass=user)(sAMAAccountName={0}))` People from other groups not listed in the User List filter OU are able to login though. Is this expected behavior or is the user source configuration incorrect? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 22, 2023, 5:29pm UTC](https://forum.inductiveautomation.com/t/active-directory-not-filtering-by-with-user-list-filter/71448/2 "2023-03-22T17:29:58Z")
Pretty sure that is expected behavior. The user list functionality is optional. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [March 22, 2023, 5:33pm UTC](https://forum.inductiveautomation.com/t/active-directory-not-filtering-by-with-user-list-filter/71448/3 "2023-03-22T17:33:37Z")
Ok so there is no way to say "only users in this OU" can login, its all or nothing and I will have to rely on the roles I set to determine permissions correct? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 22, 2023, 5:34pm UTC](https://forum.inductiveautomation.com/t/active-directory-not-filtering-by-with-user-list-filter/71448/4 "2023-03-22T17:34:47Z")
Yes. For authentication, we're just asking AD "are these credentials correct"? Then it's up to the user source to decide _authorization_ beyond that. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [March 22, 2023, 5:36pm UTC](https://forum.inductiveautomation.com/t/active-directory-not-filtering-by-with-user-list-filter/71448/5 "2023-03-22T17:36:49Z")
> Then it's up to the user source to decide _authorization_ beyond that. Wait so after the User Source confirms that the person exists in the AD with the correct user/password, there is the ability to say reject the authorization for not being in the right OU? Or no? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 22, 2023, 5:58pm UTC](https://forum.inductiveautomation.com/t/active-directory-not-filtering-by-with-user-list-filter/71448/6 "2023-03-22T17:58:32Z")
You can require some role in the project, so that anyone without it can't even log in? ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [March 22, 2023, 6:01pm UTC](https://forum.inductiveautomation.com/t/active-directory-not-filtering-by-with-user-list-filter/71448/7 "2023-03-22T18:01:10Z")
Oh ok that was my plan in case it could not be done inside gateway user source configuration. So that is how I have to do it - that's fine with me, I just wanted to check as I am by no means an Active Directory guy, I don't know much about LDAP queries.