# Badge-based Authentication Support **URL:** \ **Category:** Ignition Early Access\ **Created:** [September 10, 2019, 4:28pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144 "2019-09-10T16:28:02Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 10, 2019, 4:28pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/1 "2019-09-10T16:28:02Z")
Hi all - Last night’s early access build includes support for badge-based authentication in the Ignition IdP. You will now notice a couple new options in the Ignition IdP’s settings: ![41%20AM](https://us1.discourse-cdn.com/inductiveautomation/original/2X/5/5018a9294c9ed4829e356b0f6cfef9fad18befd1.png) You can choose which authentication methods are enabled and which enabled method is presented as the default option to the user during authentication. Right now we have two authentication methods: (1) Username and Password and (2) Badge. If more than one method is enabled, the user will have the option to switch to one of the other methods during authentication. For the badge authentication method, you can choose whether or not to require a password in addition to scanning their badge. To enroll a badge to a user’s account, go to the `User, Roles` section in the Gateway Config Web Interface, and click `Manage Users` for the user source containing the user whose badge you’d like to enroll, and click `Edit` to edit the user’s account. ![17%20AM](https://us1.discourse-cdn.com/inductiveautomation/original/2X/1/1e47a815717a7e04238cb8181dd65010d2a9277b.png) You will notice a new `Badge` text area. Either manually enter the user’s badge ID or focus in the text area and scan the badge to receive the badge ID automatically. Remove any new line characters trailing the badge ID before saving. Badges may be enrolled for users in any user source profile type except for pure Active Directory. For those of you who use a AD / DB Hybrid or a DB in Manual Mode, you will notice new `Badge Authentication Query` configuration. This must be set to a query which is able to return the appropriate user based on the incoming badge ID. ![55%20AM](https://us1.discourse-cdn.com/inductiveautomation/original/2X/7/754c40a20850d197ab17d3c532673bf31b136553.png) During authentication, the user will be prompted to scan their badge. The authentication web app listens for badge scans in the form of keyboard input. The signal for the end of input is the new line character, so be sure to configure your badge readers accordingly. The input buffer is automatically cleared after 1 second from the first input character allowing the user to try again if there was some problem during the scan. ![30%20AM](https://us1.discourse-cdn.com/inductiveautomation/original/2X/4/4f6192288b06f6e0868ad505fe9a8bf8ca73603a.jpeg) Security Considerations Since a badge is just a string under the hood, it is not a very secure mode of authentication by itself. Consider additional layers of defense such as: 1. Make sure SSL / TLS is set up and the force secure redirect option is enabled on the Gateway in order to mitigate MITM threats 2. Requiring the user to enter their password in addition to the badge scan 3. Restricting assigned security levels based on whitelisting the machines from which users may perform badge scanning using security zones. For example: `Corporate` security level may only get assigned if they used authentication method `Username and Password` whereas `Operator` security level may be assigned if coming from Security Zone `Plant Floor` using any authentication method. 4. Traditional physical security measures Note: the capability in #3 above is still under development. We’ll provide more detail for how to access the authentication methods used in a security level rule once it is merged in. ---
**Author:** ![awalker](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/awalker/32/6874_2.png) [@awalker](https://forum.inductiveautomation.com/u/awalker)\ **Post date:** [September 10, 2019, 4:39pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/2 "2019-09-10T16:39:59Z")
---
**Author:** ![apgilber](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@apgilber](https://forum.inductiveautomation.com/u/apgilber)\ **Post date:** [September 12, 2019, 3:08pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/3 "2019-09-12T15:08:58Z")
Is it possible to use the system.user functions to add badge info to an existing or when creating a new user? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 12, 2019, 3:29pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/4 "2019-09-12T15:29:39Z")
Hi @apgilber - Yes, I had success with the following: Edit exiting user: ```auto user = system.user.getUser('SomeUserSource', 'SomeUser') user.set('Badge', '12345') system.user.editUser('SomeUserSource', user) ``` New user: ```auto user = system.user.getNewUser('SomeUserSource', 'SomeUser') user.set('Badge', '12345') system.user.addUser('SomeUserSource', user) ``` ---
**Author:** ![apgilber](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@apgilber](https://forum.inductiveautomation.com/u/apgilber)\ **Post date:** [September 12, 2019, 3:31pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/5 "2019-09-12T15:31:50Z")
Awesome. Also just FYI when creating a new user in the manage users page and then scanning a badge and clicking Add User does not save the badge input. You have to go back in after it the user is created and add the badge again. At least with scanning. I didn’t try manually typing it in. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 12, 2019, 3:59pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/6 "2019-09-12T15:59:24Z")
Hi @apgilber - Thanks for reporting this issue - I have replicated the problem myself, found the root cause, and filed a bug report (ticket ID 14976). ---
**Author:** ![pat.stave1](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@pat.stave1](https://forum.inductiveautomation.com/u/pat.stave1)\ **Post date:** [September 13, 2019, 12:01pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/7 "2019-09-13T12:01:24Z")
Is it possible to use the badge based authorization with Vision? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 13, 2019, 3:07pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/8 "2019-09-13T15:07:08Z")
Hi @pat.stave1 - There is no first-class support for badge based authentication in Vision at this time. Once we make Vision IdP-aware, you will get badge authentication capabilities as a part of the Ignition IdP. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 20, 2019, 11:24pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/9 "2019-09-20T23:24:39Z")
> [@jspecht](#): > > Note: the capability in #3 above is still under development. We’ll provide more detail for how to access the authentication methods used in a security level rule once it is merged in. Circling back to the above - the next Early Access build will add a new attribute to the Ignition IdP's response called `amr` (in order to align with [the `amr` ID token claim in the OpenID Connect 1.0 spec](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) since the Ignition IdP uses OIDC 1.0 under the hood). If the user passed a username and password challenge, amr is set to: `["uname", "pwd"]` If the user passed a badge challenge, amr is set to: `["badge"]` If the user passed a badge and password challenge, amr is set to: `["badge", "pwd"]` In a security level rule, you can now do something like this: `containsAll({idp-attributes:amr}, 'uname', 'pwd')` ---
**Author:** ![awalker](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/awalker/32/6874_2.png) [@awalker](https://forum.inductiveautomation.com/u/awalker)\ **Post date:** [September 23, 2019, 4:02pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/10 "2019-09-23T16:02:13Z")
This issue (14976) is fixed in the latest 8.0.5 nightly build. ---
**Author:** ![awalker](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/awalker/32/6874_2.png) [@awalker](https://forum.inductiveautomation.com/u/awalker)\ **Post date:** [September 26, 2019, 8:59pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/11 "2019-09-26T20:59:23Z")
---
**Author:** ![andrea.morando](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrea.morando/32/8039_2.png) [@andrea.morando](https://forum.inductiveautomation.com/u/andrea.morando)\ **Post date:** [September 27, 2019, 7:17am UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/12 "2019-09-27T07:17:49Z")
Dear Joel, just a feedback regarding the badge authentication from the pilot project. I tried with the build of September 25th: the login with badge works fine, the login with badge + password is ok, the login with badge + security code fails. Have you news about the latest fixes? Best regards, Andrea ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 27, 2019, 4:55pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/13 "2019-09-27T16:55:44Z")
Hi @andrea.morando - There are only three possible authentication method combinations possible right now: 1. Username and Password 2. Badge 3. Badge and Password You mention that 2 and 3 are working, but I am not sure what you mean by “badge + security code”. Could you give more detail? ---
**Author:** ![andrea.morando](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrea.morando/32/8039_2.png) [@andrea.morando](https://forum.inductiveautomation.com/u/andrea.morando)\ **Post date:** [September 27, 2019, 5:39pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/14 "2019-09-27T17:39:29Z")
Hi Joel, I mean the combination of Badge and Security PIN. I understood the PIN could be the right one for our needs. Am I wrong? Thanks. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 27, 2019, 5:43pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/15 "2019-09-27T17:43:56Z")
Hi @andrea.morando - We do not have support for a distinct PIN code. You could set the user’s password as their PIN as a workaround. ---
**Author:** ![andrea.morando](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrea.morando/32/8039_2.png) [@andrea.morando](https://forum.inductiveautomation.com/u/andrea.morando)\ **Post date:** [September 30, 2019, 1:10pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/16 "2019-09-30T13:10:21Z")
Ok Joel, it is clear. What do you intend the Security Pin for? Thank you. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 30, 2019, 1:14pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/17 "2019-09-30T13:14:51Z")
Security Pin is optionally required by the Voice Notification Module to acknowledge alarms. ---
**Author:** ![andrea.morando](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrea.morando/32/8039_2.png) [@andrea.morando](https://forum.inductiveautomation.com/u/andrea.morando)\ **Post date:** [October 3, 2019, 2:39pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/18 "2019-10-03T14:39:01Z")
Thank you so much, Kevin. ---
**Author:** ![jmoniz](https://avatars.discourse-cdn.com/v4/letter/j/5daacb/32.png) [@jmoniz](https://forum.inductiveautomation.com/u/jmoniz)\ **Post date:** [October 18, 2019, 1:33pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/19 "2019-10-18T13:33:33Z")
Just tested on the 8.0.5 Release! Works great. Tested with RFIDeas PC prox plus and HID Prox : RDR-608X Compatible Card ---
**Author:** ![David.R.Shay](https://avatars.discourse-cdn.com/v4/letter/d/5f9b8f/32.png) [@David.R.Shay](https://forum.inductiveautomation.com/u/David.R.Shay)\ **Post date:** [November 5, 2019, 5:02pm UTC](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144/20 "2019-11-05T17:02:08Z")
For users that are required to use a badge + PIN to login to the Windows environment first, can SSO be used to access a Vision client? Our current login process requires that we login to our laptops using our badge + PIN, and then we need to login to our vision client with a different userID + password. If SSO could leverage our existing badge + PIN login to negate that second login, that would be great. [Next page](https://forum.inductiveautomation.com/t/badge-based-authentication-support/28144.md?page=2)