# Easiest way to map AD roles to the default security levels

**URL:** <https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327>\
**Category:** General Discussion\
**Created:** [October 9, 2025, 7:40pm UTC](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327 "2025-10-09T19:40:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![colethorton](https://avatars.discourse-cdn.com/v4/letter/c/59ef9b/32.png) [@colethorton](https://forum.inductiveautomation.com/u/colethorton)\
**Post date:** [October 9, 2025, 7:40pm UTC](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327/1 "2025-10-09T19:40:36Z")

</div>

Using an AD user source and Ignition type IDP what is the most straightforward way to map AD roles like “site01-SCADA-engineer“ into the default engineer security level

---

<div class="post-metadata">

**Author:** ![colethorton](https://avatars.discourse-cdn.com/v4/letter/c/59ef9b/32.png) [@colethorton](https://forum.inductiveautomation.com/u/colethorton)\
**Post date:** [October 9, 2025, 10:01pm UTC](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327/2 "2025-10-09T22:01:19Z")

</div>

Don’t know if its the easiest but here is how I did it. go write a script in the project designated as gateway script project. Like so, and in my case, in a script library called ADroles

```python
from java.util import ArrayList

def mapRoles(roles):
    result = ArrayList()
    if ("IgnitionAdministrators" in roles) or ("BMS-Admin" in roles):
        result.add("Administrator")
    if "BMS-Engineer" in roles:
        result.add("Engineer")
    if "BMS-Operator" in roles:
        result.add("Operator")
    if "BMS-View-only" in roles:
        result.add("View-Only")           
    return result

```

then under Config \> Security \> Identity Providers \> {YOUR IDP} - User Attribute Mapping

add runScript("ADroles.mapRoles",0,{attribute-source:idTokenClaims:roles})

---

<div class="post-metadata">

**Author:** ![douglaslawrie0](https://avatars.discourse-cdn.com/v4/letter/d/da6949/32.png) [@douglaslawrie0](https://forum.inductiveautomation.com/u/douglaslawrie0)\
**Post date:** [January 5, 2026, 8:19am UTC](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327/3 "2026-01-05T08:19:52Z")

</div>

This works for me as well, thanks. Using runScript seems a bit hacky though. Would be nice to see better built-in support for this given how common it must be.  
I raised a feature/idea to improve this: [Active Directory Role Mapping | Voters | Inductive Automation](https://ideas.inductiveautomation.com/ignition-features-and-ideas/p/active-directory-role-mapping)