# Easiest way to map AD roles to the default security levels

**URL:** <https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327>\
**Category:** General Discussion\
**Created:** [October 9, 2025, 7:40pm UTC](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327 "2025-10-09T19:40:36Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![colethorton](https://avatars.discourse-cdn.com/v4/letter/c/59ef9b/32.png) [@colethorton](https://forum.inductiveautomation.com/u/colethorton)\
**Post date:** [October 9, 2025, 10:01pm UTC](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327/2 "2025-10-09T22:01:19Z")

</div>

Don’t know if its the easiest but here is how I did it. go write a script in the project designated as gateway script project. Like so, and in my case, in a script library called ADroles

```python
from java.util import ArrayList

def mapRoles(roles):
    result = ArrayList()
    if ("IgnitionAdministrators" in roles) or ("BMS-Admin" in roles):
        result.add("Administrator")
    if "BMS-Engineer" in roles:
        result.add("Engineer")
    if "BMS-Operator" in roles:
        result.add("Operator")
    if "BMS-View-only" in roles:
        result.add("View-Only")           
    return result

```

then under Config \> Security \> Identity Providers \> {YOUR IDP} - User Attribute Mapping

add runScript("ADroles.mapRoles",0,{attribute-source:idTokenClaims:roles})

---

_[View the full topic](https://forum.inductiveautomation.com/t/easiest-way-to-map-ad-roles-to-the-default-security-levels/111327)._