# AD/Database Hybrid Good Practice **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [March 8, 2023, 3:21pm UTC](https://forum.inductiveautomation.com/t/ad-database-hybrid-good-practice/70783 "2023-03-08T15:21:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![drewdin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/drewdin/32/3363_2.png) [@drewdin](https://forum.inductiveautomation.com/u/drewdin)\ **Post date:** [March 8, 2023, 3:21pm UTC](https://forum.inductiveautomation.com/t/ad-database-hybrid-good-practice/70783/1 "2023-03-08T15:21:08Z")
I'm in the process of implementing Active Directory Database Hybrid user source, I'm stuck in paralysis by analysis right now and I need a push. Have you implemented an AD Database Hybrid model and how did you link the roles to the AD users? From what I can tell: - you can duplicate the users into a database and link that to roles - you can link AD to a database of roles but that it heavily IT involved. - you can script when a user logs in and validate against roles. I'm sure there are other methods but I'm looking to see what the best practice is. DO you have any input or suggestions on implementing a database of roles to an active directory list of users? ---
**Author:** ![chaz\_cooper](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/chaz_cooper/32/44782_2.png) [@chaz\_cooper](https://forum.inductiveautomation.com/u/chaz_cooper)\ **Post date:** [March 15, 2023, 9:52pm UTC](https://forum.inductiveautomation.com/t/ad-database-hybrid-good-practice/70783/2 "2023-03-15T21:52:18Z")
Hello Drewdin, Since IT departments are heavily involved in this AD process, it is recommended to reach out to them. Especially since they will likely have the information you will need to access your AD, Ignition gets its users and passwords from the AD, and the rest should come from the Database, I highly recommend getting your IT involved. - [Active Directory Authentication - Ignition User Manual 8.1 - Ignition Documentation](https://docs.inductiveautomation.com/display/DOC81/Active+Directory+Authentication) - [AD Database Hybrid - Ignition User Manual 8.1 - Ignition Documentation](https://docs.inductiveautomation.com/display/DOC81/AD+Database+Hybrid) ---
**Author:** ![drewdin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/drewdin/32/3363_2.png) [@drewdin](https://forum.inductiveautomation.com/u/drewdin)\ **Post date:** [March 16, 2023, 1:19am UTC](https://forum.inductiveautomation.com/t/ad-database-hybrid-good-practice/70783/3 "2023-03-16T01:19:51Z")
Thanks, I do have AD working properly, now I just need a good way to link the roles to the AD users. I take it that I need to manually link them to the AD usernames. ---
**Author:** ![egranizo](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@egranizo](https://forum.inductiveautomation.com/u/egranizo)\ **Post date:** [July 11, 2024, 9:40pm UTC](https://forum.inductiveautomation.com/t/ad-database-hybrid-good-practice/70783/4 "2024-07-11T21:40:22Z")
Hello Drewdin, I am implementing an AD-Database hybrid source currently. How did you solve this? I was thinking about duplicated the users in a databsse and used a mapping table to link them with the roles. Did you have any recommendations according to yous experience on this topic? ---
**Author:** ![drewdin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/drewdin/32/3363_2.png) [@drewdin](https://forum.inductiveautomation.com/u/drewdin)\ **Post date:** [July 16, 2024, 6:52pm UTC](https://forum.inductiveautomation.com/t/ad-database-hybrid-good-practice/70783/5 "2024-07-16T18:52:50Z")
I did it two ways, it depends on how many front ends you have. I just used the Ignition internal database for roles and permissions on a single front end. I used an external database for roles and permissions when I had multiple front ends behind a load balancer. What have you tried? ---
**Author:** ![egranizo](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@egranizo](https://forum.inductiveautomation.com/u/egranizo)\ **Post date:** [July 16, 2024, 8:46pm UTC](https://forum.inductiveautomation.com/t/ad-database-hybrid-good-practice/70783/6 "2024-07-16T20:46:11Z")
IT people told me I can use an Active Directory component to be installed in the Ignition gateway server, so I can have access to the AD database and then take the users and store them on my local database, create the mapping table and authenticated against the AD. I have more than 1 Frontend. In your solution with multiple frontends, how do you link the users to the roles and permissions tables? ---
**Author:** ![drewdin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/drewdin/32/3363_2.png) [@drewdin](https://forum.inductiveautomation.com/u/drewdin)\ **Post date:** [July 16, 2024, 9:09pm UTC](https://forum.inductiveautomation.com/t/ad-database-hybrid-good-practice/70783/7 "2024-07-16T21:09:34Z")
Its one database of users/roles/permissions, each front end looks at the same tables for consistency. That way the information is the same between them.