# Filter the Active Directory by groups

**URL:** <https://forum.inductiveautomation.com/t/filter-the-active-directory-by-groups/37719>\
**Category:** Ignition\
**Created:** [August 14, 2020, 12:36pm UTC](https://forum.inductiveautomation.com/t/filter-the-active-directory-by-groups/37719 "2020-08-14T12:36:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lachguerabdallah](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lachguerabdallah/32/25558_2.png) [@lachguerabdallah](https://forum.inductiveautomation.com/u/lachguerabdallah)\
**Post date:** [August 14, 2020, 12:36pm UTC](https://forum.inductiveautomation.com/t/filter-the-active-directory-by-groups/37719/1 "2020-08-14T12:36:20Z")

</div>

Hello  
For the security of the scada, we have established the active directory.  
but now we have all the users of the active directory, how can we filter the users by groups?

Thank you

---

<div class="post-metadata">

**Author:** ![zacht](https://avatars.discourse-cdn.com/v4/letter/z/ea5d25/32.png) [@zacht](https://forum.inductiveautomation.com/u/zacht)\
**Post date:** [August 14, 2020, 2:23pm UTC](https://forum.inductiveautomation.com/t/filter-the-active-directory-by-groups/37719/2 "2020-08-14T14:23:42Z")

</div>

If you’re using the Active Directory User source (it sounds like you are), group membership is exposed as roles. Something like [system.security.getRoles](https://docs.inductiveautomation.com/display/DOC80/system.security.getRoles) or [system.security.getUserRoles](https://docs.inductiveautomation.com/display/DOC80/system.security.getUserRoles) let you interact with what rolls a user has. This includes any active directory groups of which they are a member.

I’m not sure that answers your question. If you’re more specific about what you’re trying to do, you’ll probably get a more relevant answer.

---

<div class="post-metadata">

**Author:** ![brad.barbin](https://avatars.discourse-cdn.com/v4/letter/b/e19b73/32.png) [@brad.barbin](https://forum.inductiveautomation.com/u/brad.barbin)\
**Post date:** [August 14, 2020, 2:46pm UTC](https://forum.inductiveautomation.com/t/filter-the-active-directory-by-groups/37719/3 "2020-08-14T14:46:52Z")

</div>

One approach is the AD/Database Hybrid type of User Source.

My understanding is that you use AD to say whether the username/password is valid, and then pass a valid username as a parameter to a database query that contains the security roles for that user.

So first, you’d create a database table that maps usernames to security roles, then you’d populate the User Source with the appropriate queries, leaving `?` where the username goes. Finally, you’d set the permissions on the views using the roles loaded from the database.

---

<div class="post-metadata">

**Author:** ![lachguerabdallah](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lachguerabdallah/32/25558_2.png) [@lachguerabdallah](https://forum.inductiveautomation.com/u/lachguerabdallah)\
**Post date:** [August 17, 2020, 8:01am UTC](https://forum.inductiveautomation.com/t/filter-the-active-directory-by-groups/37719/4 "2020-08-17T08:01:26Z")

</div>

thanks for your reply.  
in my company there are many groups (Administration, IT, etc.) so I want the AD to only show me the users of a specific group. I think that is configured in the gateway, see screenshot.  
but I don’t know how to configure it.

 ![Captura de pantalla 2020-08-17 a las 9.59.56](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/f/2fa8755b4c5e31651ef26b9e6b1984cdfdd710ca.png)

---

<div class="post-metadata">

**Author:** ![brad.barbin](https://avatars.discourse-cdn.com/v4/letter/b/e19b73/32.png) [@brad.barbin](https://forum.inductiveautomation.com/u/brad.barbin)\
**Post date:** [August 17, 2020, 11:25am UTC](https://forum.inductiveautomation.com/t/filter-the-active-directory-by-groups/37719/5 "2020-08-17T11:25:27Z")

</div>

Try this: [https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html](https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html)