# Designer and Gateway Protection **URL:** \ **Category:** Ignition\ **Created:** [November 7, 2022, 11:21am UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178 "2022-11-07T11:21:12Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Dharani\_T](https://avatars.discourse-cdn.com/v4/letter/d/bc8723/32.png) [@Dharani\_T](https://forum.inductiveautomation.com/u/Dharani_T)\ **Post date:** [November 7, 2022, 11:21am UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/1 "2022-11-07T11:21:12Z")
Hi, I would like to protect the project with below constraints (whereas I have two usersources : default, AD) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/f/0f3dd4e4821cb51c04d7755bc0dffc642a0fd31f.png) I have given the below setting, still not worked as expected, ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/5/357ba866012e987df22989a410cf2f8ba4e80c1d.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 7, 2022, 1:04pm UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/2 "2022-11-07T13:04:06Z")
> [@Dharani\_T](#): > > still not worked as expected, This is incomprehensibly vague. Please elaborate what you mean by "not worked". Errors? Total login rejection? Users work that shouldn't? Users don't work that should? ---
**Author:** ![Dharani\_T](https://avatars.discourse-cdn.com/v4/letter/d/bc8723/32.png) [@Dharani\_T](https://forum.inductiveautomation.com/u/Dharani_T)\ **Post date:** [November 7, 2022, 2:54pm UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/3 "2022-11-07T14:54:15Z")
Sorry for not providing an elaborated requirement. If the user has "Developer" but not an administrator, still designer login or gateway login is not working. But in the required constraints, if user has any of the mentioned roles, the allotted activity should happen. ---
**Author:** ![Dharani\_T](https://avatars.discourse-cdn.com/v4/letter/d/bc8723/32.png) [@Dharani\_T](https://forum.inductiveautomation.com/u/Dharani_T)\ **Post date:** [November 8, 2022, 7:25am UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/4 "2022-11-08T07:25:41Z")
Anybody have ideas on this? ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [November 8, 2022, 8:24am UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/5 "2022-11-08T08:24:02Z")
I think you need to - Set up your AD user source with "Soft Failover" to the "Default" user source. - In your AD user source create the _Administrator_ role with spelling and capitalisation exactly the same as the role in the default user source. - Use AD for all logins, if possible. **If** you have users such as contractors who do not have AD logins then create an account for them in the _Default_ user source and give them the required roles. Again the roles should match those in the AD user source. The _Administrator_ account can be used to log in using the _Default_ user source if the AD user source fails for some reason. ---
**Author:** ![Dharani\_T](https://avatars.discourse-cdn.com/v4/letter/d/bc8723/32.png) [@Dharani\_T](https://forum.inductiveautomation.com/u/Dharani_T)\ **Post date:** [November 8, 2022, 8:44am UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/6 "2022-11-08T08:44:15Z")
I have done all the mentioned configurations. But I need to restrict gateway and designer login (Only Users with Admin or Developer role should login) ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [November 8, 2022, 11:28am UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/7 "2022-11-08T11:28:47Z")
What are your settings in Config/Security/General of the gateway? Example: Mine is set up so that only Administrators can get the can get to the gateway settings, but anyone can get to the home page. _It does not prevent_ people from logging in to the gateway, it just keeps unauthorized people from getting to places they shouldn't. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/7/175bbcf65bf210e1255d9388e8c0cfb551005d82.png) Using my 'No-rights' user ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/f/6fbbebcf03ddac98cd65bbf63fdf36dd36d3c8ef.png) The same 'No-rights' user can't use the designer at all. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/2/d200887c5093ca19413a76f801ff9373fa7bfb67.png) ---
**Author:** ![Dharani\_T](https://avatars.discourse-cdn.com/v4/letter/d/bc8723/32.png) [@Dharani\_T](https://forum.inductiveautomation.com/u/Dharani_T)\ **Post date:** [November 9, 2022, 5:23am UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/8 "2022-11-09T05:23:22Z")
What if i try to give config setting permission only to 'Developer' not admin, when i try to enter developer (only as 'Developer' not as 'Authenticated\Roles\Developer' ) in the setting, eventhough i have developer role, now it is showing as unauthorized login . So i am restoring my backup. Any ideas on this ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [November 9, 2022, 6:47am UTC](https://forum.inductiveautomation.com/t/designer-and-gateway-protection/66178/9 "2022-11-09T06:47:57Z")
The gateway login is through the Identity Provider, not the user source. Hence, the Authenticated/Roles path.