# Assign SAML response roles to Security User Roles

**URL:** <https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534>\
**Category:** Ignition\
**Tags:** ignition83\
**Created:** [March 17, 2026, 9:18pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534 "2026-03-17T21:18:34Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [March 18, 2026, 8:18pm UTC](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534/9 "2026-03-18T20:18:35Z")

</div>

You cannot configure how Role-based Security Levels are granted through User Grants or Security Level Rules.

Role-based Security Levels are granted based on the roles mapped onto the User.

Instead, you’ll need to properly set up the User Attribute Mapping for the Roles attribute.

Here’s a post for how someone else solved this using the runScript expression function inside an expression user attribute mapping: [Easiest way to map AD roles to the default security levels - #2 by colethorton](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327/2)

You might upvote this idea linked from the above post: [Active Directory Role Mapping | Voters | Inductive Automation](https://ideas.inductiveautomation.com/ignition-features-and-ideas/p/active-directory-role-mapping)

If your role map is simple enough, you might get away with using the case expression function instead of runScript: [case | Ignition User Manual](https://docs.inductiveautomation.com/docs/8.3/appendix/expression-functions/logic/case)

---

_[View the full topic](https://forum.inductiveautomation.com/t/assign-saml-response-roles-to-security-user-roles/114534)._