# AD/Internal Role Storage **URL:** \ **Category:** Ignition\ **Created:** [June 19, 2019, 7:45pm UTC](https://forum.inductiveautomation.com/t/ad-internal-role-storage/25959 "2019-06-19T19:45:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jjacques](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@jjacques](https://forum.inductiveautomation.com/u/jjacques)\ **Post date:** [June 19, 2019, 7:45pm UTC](https://forum.inductiveautomation.com/t/ad-internal-role-storage/25959/1 "2019-06-19T19:45:01Z")
I had a question come up today about what would happen in the following scenario: We are using the AD/Internal Hybrid setup - A user is given roles to access different parts of the system - The user is no longer employed with the company and has their LDAP account deactivated - In 6 months, he is hired back on in a different role, and has his LDAP account re-activated - What permissions would he have in the Ignition system at this point? Would it be the same access he had before? Or would it start from scratch? Thanks to anyone who can help with this, I haven’t been able to come up with an answer for this. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [June 19, 2019, 7:56pm UTC](https://forum.inductiveautomation.com/t/ad-internal-role-storage/25959/2 "2019-06-19T19:56:41Z")
If you’re using AD/Internal, then unless you specifically go in and delete the configured user/roles, once the user comes back they will have the exact same roles as they previously did. The AD/Hybrid user source types use active directory for _authentication_ but not _authorization_ - see this page from more information on the (crucial) difference between the two: [https://stackoverflow.com/questions/6556522/authentication-versus-authorization](https://stackoverflow.com/questions/6556522/authentication-versus-authorization). You must use a full active directory user source if you want to use active directory as the only ‘source of truth’ about user access. ---
**Author:** ![jjacques](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@jjacques](https://forum.inductiveautomation.com/u/jjacques)\ **Post date:** [June 19, 2019, 7:57pm UTC](https://forum.inductiveautomation.com/t/ad-internal-role-storage/25959/3 "2019-06-19T19:57:34Z")
That is what I thought, Thanks for the confirmation! ---
**Author:** ![jjacques](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@jjacques](https://forum.inductiveautomation.com/u/jjacques)\ **Post date:** [June 19, 2019, 7:58pm UTC](https://forum.inductiveautomation.com/t/ad-internal-role-storage/25959/4 "2019-06-19T19:58:18Z")
Would there be any way to go through and periodically remove roles from users that no longer exist in the the AD source? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [June 19, 2019, 8:12pm UTC](https://forum.inductiveautomation.com/t/ad-internal-role-storage/25959/5 "2019-06-19T20:12:09Z")
Not trivially - we don’t really expose that list of users directly through scripting, and if you’re not a full AD user source we’re also not pulling back any other information about them (ie, whether they’re enabled). This might fall into something that will indirectly be improved by our planned expansion of identity provider support into Vision and the gateway itself in the future, but that’s a ways off at present. ---
**Author:** ![jjacques](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@jjacques](https://forum.inductiveautomation.com/u/jjacques)\ **Post date:** [June 19, 2019, 8:14pm UTC](https://forum.inductiveautomation.com/t/ad-internal-role-storage/25959/6 "2019-06-19T20:14:35Z")
OK. Thanks for your help on this - it is very much appreciated