# External identify provdier (idP) - Initiate authentication and roles

**URL:** <https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918>\
**Category:** Ignition\
**Created:** [January 4, 2021, 11:39am UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918 "2021-01-04T11:39:56Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [January 4, 2021, 11:39am UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/1 "2021-01-04T11:39:56Z")

</div>

Hi All,

We have set up an external idP (Auth0) for our Perspective sessions.

The login process is now:

1. Initiate authentication from the common login project by clicking “Login”
2. Enter credentials as Auth0 login page  
 → The system them automatically forwards the user to user’s defined project.

Then I have 3 questions.

- Is it possible to change the design of the Ignition login page?
- Is it possible to skip pressing login at step 1, and have the authentication started with no user input?  
I understand its not possible to initiate authentication directly.
- How does Roles work with external idP? I set required Client role to “admin” but could still login from Auth0, even if these users does not have any admin rights.

 ![forum](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/2/329feaf6ad274d82c1047dd5f3705fc4d8664392.jpeg)

Thanks, and I would like to wish you all a happy new year.

---

<div class="post-metadata">

**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\
**Post date:** [January 4, 2021, 1:06pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/2 "2021-01-04T13:06:29Z")

</div>

> [@SBL\_MC](#):
>
> Is it possible to skip pressing login at step 1, and have the authentication started with no user input?

Check out this thread... [[FEATURE-1402] Perspective "autologin" IdP](http://forum.inductiveautomation.com/t/perspective-autologin-idp/40221)

> [@SBL\_MC](#):
>
> How does Roles work with external idP? I set required Client role to “admin” but could still login from Auth0, even if these users does not have any admin rights.

Client Roles only apply to User Sources. Also, AFAIK, the "Required Roles Setting" only applies to Vision Clients... its really in the wrong section of the Project Properties, but has been in that spot for ~10 years...

For Perspective, you want Perspective \> Permissions in the project properties. That will control login to Perspective.

---

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [January 4, 2021, 1:14pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/3 "2021-01-04T13:14:30Z")

</div>

Hi Ryan,

Thanks for the input. Under “Perspective / Permissions”, “Roles” and “match all” has been selected.

I can still login from auth0.

---

<div class="post-metadata">

**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\
**Post date:** [January 4, 2021, 1:16pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/4 "2021-01-04T13:16:52Z")

</div>

Did you select some roles? If Public is selected, anyone can Login…

[Security in Perspective - Ignition User Manual 8.1 - Ignition Documentation (inductiveautomation.com)](https://docs.inductiveautomation.com/display/DOC81/Security+in+Perspective)

---

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [January 4, 2021, 1:33pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/5 "2021-01-04T13:33:35Z")

</div>

If we set Security levels none is allowed in, even when the auth0 user has role “admin” assigned.

---

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [January 4, 2021, 1:35pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/6 "2021-01-04T13:35:02Z")

</div>

![Skjermbilde](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/a/2adef0204e2a342034ec4f0362ff4d07fbf3521c.jpeg)

---

<div class="post-metadata">

**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\
**Post date:** [January 4, 2021, 1:36pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/7 "2021-01-04T13:36:23Z")

</div>

Did you test your IdP from the GW to make sure its retuning as expected?

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/9/c973a77873eee9f11f38e0a56c2cea0b2b6c7d7e.png)

---

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [January 4, 2021, 1:51pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/8 "2021-01-04T13:51:42Z")

</div>

We are on to something here.

The test login idP Response data from Auth0 is not including roles. Will look into it. 🙂

---

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [January 4, 2021, 3:41pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/9 "2021-01-04T15:41:29Z")

</div>

Looking at the Raw JSON that Auth0 sends and the Ignition idP test data there is a big difference. Name and user name is mapped to attribut “sub”, that is nowhere to be found in the Auth0 output.

Is Ignition doing its own filtering and altering the input?

---

<div class="post-metadata">

**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\
**Post date:** [January 4, 2021, 4:10pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/10 "2021-01-04T16:10:54Z")

</div>

Sounds like you need to play with your User Attribute Mapping to get the fields aligned to your IdP…

[https://docs.inductiveautomation.com/display/DOC81/User+Attribute+Mapping](https://docs.inductiveautomation.com/display/DOC81/User+Attribute+Mapping)

---

<div class="post-metadata">

**Author:** ![eric3](https://avatars.discourse-cdn.com/v4/letter/e/51bf81/32.png) [@eric3](https://forum.inductiveautomation.com/u/eric3)\
**Post date:** [January 4, 2021, 5:13pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/11 "2021-01-04T17:13:34Z")

</div>

Custom namespace-prefixed attribute is now being passed successfully into the Test IdP area:

```auto
{
  "tokenEndpointResponse": { /* snipped */ },
  "idTokenClaims": {
    "https://custom.url.here/roles": [
      "Demo"
    ],
    "sub": "etc",
    // snipped
  }
}

```

However inside the user attribute mapping, a direct mapping for “[https://custom.url.here/roles](https://custom.url.here/roles)” doesn’t seem to map anything. The rest of the attributes (given\_name, family\_name, email, etc) are mapping correctly.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [January 4, 2021, 6:52pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/12 "2021-01-04T18:52:51Z")

</div>

Check out this thread: [Ignition 8.0.2, May 7th Identity Provider - User Mapping Attributes - Roles property does not get mapped to IdP Response value](http://forum.inductiveautomation.com/t/ignition-8-0-2-may-7th-identity-provider-user-mapping-attributes-roles-property-does-not-get-mapped-to-idp-response-value/24852)

---

<div class="post-metadata">

**Author:** ![eric3](https://avatars.discourse-cdn.com/v4/letter/e/51bf81/32.png) [@eric3](https://forum.inductiveautomation.com/u/eric3)\
**Post date:** [January 4, 2021, 7:04pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/13 "2021-01-04T19:04:17Z")

</div>

Confirmed - direct mapping `http://custom.url.here/roles` does not work, but `["https://custom.url.here/roles"]` does work. The JsonPath library used under the hood needs this syntax when matching against something that looks like a URL. This effectively tells the mapper to “just match the text” and not try to find a subpath.

Thanks.

---

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [January 5, 2021, 11:24am UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/14 "2021-01-05T11:24:56Z")

</div>

#3 answered. Anyone have any ideas for #1 and #2?

> [@SBL\_MC](#):
>
> - Is it possible to change the design of the Ignition login page?
> - Is it possible to skip pressing login at step 1, and have the authentication started with no user input?  
> I understand its not possible to initiate authentication directly.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [January 5, 2021, 4:36pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/15 "2021-01-05T16:36:42Z")

</div>

> [@SBL\_MC](#):
>
> - Is it possible to change the design of the Ignition login page?

No, [though this idea has been submitted and looks pretty popular](https://ideas.inductiveautomation.com/ignition-features-and-ideas/p/custom-login-page-with-client-logo). If that idea captures what you are asking, consider upvoting the idea.

> [@SBL\_MC](#):
>
> - Is it possible to skip pressing login at step 1, and have the authentication started with no user input?

Not at this time. We are currently exploring how best to enable this capability.

---

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [January 7, 2021, 9:44am UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/16 "2021-01-07T09:44:10Z")

</div>

I see I already have given my vote. 🙂

eric3 sent me this by email, I would like to share it:  
“Regarding the authentication… The ALB (Amazon load balancer) does a great job at authentication and making the session available to the application. I considered this when we were discussing this early on, however I ruled it out because you don’t have any control over the Ignition server. You would need to get Ignition to “trust” the ALB session information, and Ignition doesn’t have any kind of option for that. You need more granular control over who has access to what (RBAC == Role Based Access Control) and Ignition has no support for externally-enforced RBAC.”

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [January 7, 2021, 4:10pm UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/17 "2021-01-07T16:10:12Z")

</div>

> [@SBL\_MC](#):
>
> eric3 sent me this by email, I would like to share it:  
> “Regarding the authentication… The ALB (Amazon load balancer) does a great job at authentication and making the session available to the application. I considered this when we were discussing this early on, however I ruled it out because you don’t have any control over the Ignition server. You would need to get Ignition to “trust” the ALB session information, and Ignition doesn’t have any kind of option for that. You need more granular control over who has access to what (RBAC == Role Based Access Control) and Ignition has no support for externally-enforced RBAC.”

This seems unrelated to your original questions, but it seems like the email you shared expresses a goal of getting Ignition to establish an authenticated session based on trust in a load balancer in front of it (perhaps through some magic headers or something of the sort). While I do not believe this is possible, Ignition can trust an external IdP. Can the ALB act as a SAML or OIDC IdP for Ignition? Or might there be an IdP service / software out there which can trust ALB session information? If either of these two options are possible, you could indirectly accomplish your goal (or eric3's goal, if I understand it correctly).

---

<div class="post-metadata">

**Author:** ![mcarritt1](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mcarritt1/32/4262_2.png) [@mcarritt1](https://forum.inductiveautomation.com/u/mcarritt1)\
**Post date:** [April 5, 2021, 9:51am UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/18 "2021-04-05T09:51:12Z")

</div>

Hi, did you (or anyone) figure out how to get roles from auth0?

---

<div class="post-metadata">

**Author:** ![SBL\_MC](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/sbl_mc/32/56813_2.png) [@SBL\_MC](https://forum.inductiveautomation.com/u/SBL_MC)\
**Post date:** [April 6, 2021, 7:31am UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/19 "2021-04-06T07:31:00Z")

</div>

![roles](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/9/791f5517be3c3ba9b71dc66b0074fc1722c07ab1.jpeg)

---

<div class="post-metadata">

**Author:** ![mcarritt1](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mcarritt1/32/4262_2.png) [@mcarritt1](https://forum.inductiveautomation.com/u/mcarritt1)\
**Post date:** [April 6, 2021, 8:52am UTC](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918/20 "2021-04-06T08:52:57Z")

</div>

Thank you! really appreciate it.

[Next page](https://forum.inductiveautomation.com/t/external-identify-provdier-idp-initiate-authentication-and-roles/41918.md?page=2)