# Gateway Config Permissions

**URL:** <https://forum.inductiveautomation.com/t/gateway-config-permissions/61074>\
**Category:** Ignition\
**Created:** [June 22, 2022, 7:02pm UTC](https://forum.inductiveautomation.com/t/gateway-config-permissions/61074 "2022-06-22T19:02:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcgheeiv](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@mcgheeiv](https://forum.inductiveautomation.com/u/mcgheeiv)\
**Post date:** [June 22, 2022, 7:02pm UTC](https://forum.inductiveautomation.com/t/gateway-config-permissions/61074/1 "2022-06-22T19:02:02Z")

</div>

Version 8.1.15

We are not able to use multiple roles to provide access to the Gateway Configuration page.

We have two user sources:

1. Contractor  
Role - Administrator
2. Customer  
Role - IGN\_Administrator

The Customer user source has soft failover to the Contractor user source.

On the General Gateway Security Settings we have:

Designer Authentication Strategy: Classic

System User Source: Customer

Gateway Config Permissions: Authenticated/Roles/Administrator,Authenticated/Roles/IGN\_Administrator

- User must belong to at least one of these

Users in the Contractor user source with the Administrator role can log into the gateway configuration page.

Users in the Customer user source with the IGN\_Administrator role can NOT log into the gateway configuration page.

I have checked spelling a bunch of times,

Any pointers would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![obober](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/obober/32/67865_2.png) [@obober](https://forum.inductiveautomation.com/u/obober)\
**Post date:** [June 23, 2022, 5:53pm UTC](https://forum.inductiveautomation.com/t/gateway-config-permissions/61074/2 "2022-06-23T17:53:34Z")

</div>

This is probably an issue because of the fact that your default IdP is using the Contractor user source. What happens when you switch the user source for the IdP to the Customer user source?

---

<div class="post-metadata">

**Author:** ![mcgheeiv](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@mcgheeiv](https://forum.inductiveautomation.com/u/mcgheeiv)\
**Post date:** [June 24, 2022, 11:09am UTC](https://forum.inductiveautomation.com/t/gateway-config-permissions/61074/3 "2022-06-24T11:09:45Z")

</div>

We do not use the “default” IdP.

There is a Customer IdP that uses the Customer user source

In the gateway security settings the System Identity Provider is set to Customer.

What I find really odd is that the Administrator role is ONLY defined in the Contractor user source and the Contractor user source is never explicitly called out anyway.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [June 27, 2022, 3:02pm UTC](https://forum.inductiveautomation.com/t/gateway-config-permissions/61074/4 "2022-06-27T15:02:26Z")

</div>

> [@mcgheeiv](#):
>
> Users in the Customer user source with the IGN\_Administrator role can NOT log into the gateway configuration page.

Could you post what screen or error message you are seeing which leads you to this conclusion? This may help diagnose the issue.

Have you tried a [Test Login](https://docs.inductiveautomation.com/display/DOC81/Test+Login+and+Logout) against the Customer IdP to confirm whether your user who should have IGN\_Administrator role actually has the role show up in the security level tree in the test login results page?

---

<div class="post-metadata">

**Author:** ![mcgheeiv](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@mcgheeiv](https://forum.inductiveautomation.com/u/mcgheeiv)\
**Post date:** [June 29, 2022, 11:22am UTC](https://forum.inductiveautomation.com/t/gateway-config-permissions/61074/5 "2022-06-29T11:22:32Z")

</div>

Login works now. We did not change anything, I suspect this was a bcac issue.
