# Can you map authenticated user to security levels using script?

**URL:** <https://forum.inductiveautomation.com/t/can-you-map-authenticated-user-to-security-levels-using-script/114658>\
**Category:** Ignition\
**Created:** [March 25, 2026, 12:05am UTC](https://forum.inductiveautomation.com/t/can-you-map-authenticated-user-to-security-levels-using-script/114658 "2026-03-25T00:05:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eugene49](https://avatars.discourse-cdn.com/v4/letter/e/c6cbf5/32.png) [@Eugene49](https://forum.inductiveautomation.com/u/Eugene49)\
**Post date:** [March 25, 2026, 12:05am UTC](https://forum.inductiveautomation.com/t/can-you-map-authenticated-user-to-security-levels-using-script/114658/1 "2026-03-25T00:05:04Z")

</div>

We use Idp for user to login as a general user.  
On the other hand, we use external database, for user management - which user have what roles and have what privileges.

But Also nice to use Ignition built it security levels..  
I am curious if it is possible, to map the currently logged user, to security levels, using script?  
Example:  
If user is "John Doe" set "UpperManagement" Level to True.

---

<div class="post-metadata">

**Author:** ![jake.bierman](https://avatars.discourse-cdn.com/v4/letter/j/5daacb/32.png) [@jake.bierman](https://forum.inductiveautomation.com/u/jake.bierman)\
**Post date:** [April 2, 2026, 9:03am UTC](https://forum.inductiveautomation.com/t/can-you-map-authenticated-user-to-security-levels-using-script/114658/2 "2026-04-02T09:03:44Z")

</div>

Hi Eugene, we have done similar things just not getting Roles from a database but using regex, have a look at the docs on user attribute mapping, [User Attribute Mapping | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/platform/security/identity-provider-authentication-strategy/configuring-identity-providers/user-attribute-mapping)

If you change Roles from Direct to Expression, you can call a gateway scoped script ( so need the project that has your script set to the default gateway scripting project )

We use the below for the expression

```python
runScript(
    "_Kernel.Security.AD.MapRoles" , 0 , 
    {multi-attribute-source:idTokenClaims:roles},
    "arg1",
    "arg2"
)

```

and our script looks something like below, just simplified it a bit, we extracted roles using regex and return the cleaned up roles. This should hopefully give you a good staring point.

```python
import java.util.ArrayList as ArrayList

def MapRoles(roles, match_pattern, return_template, flags=0):
    """
	Transform incoming IdP roles into simplified names.
	Must return a java.util.ArrayList of strings (not a Jython list).
	"""
	logger = system.util.getLogger("Security.Auth")
	out = ArrayList()
	logger.debug("Given Roles: {}".format(str(roles)))
	if roles is None:
		logger.debug("No Given Roles")
		return out
	
	# Normalise roles to iterable
	if isinstance(roles, basestring):
		roles = [roles]
        
	for r in roles:
		# do something with the role
        
	    
		out.add("SomeNewRole") # or any custom retrieved roles, can add as many as you want
			
	logger.info("Mapped Roles: {}".format(str(out)))
	return out

```