# Gateway Web Access - System User Source **URL:** \ **Category:** General Discussion\ **Tags:** ignition81\ **Created:** [April 3, 2024, 7:37am UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275 "2024-04-03T07:37:58Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Luis\_Garijo](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@Luis\_Garijo](https://forum.inductiveautomation.com/u/Luis_Garijo)\ **Post date:** [April 3, 2024, 7:37am UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/1 "2024-04-03T07:37:58Z")
From the Gateway page in Config \>\> Security \>\> General, in the System User Source section you can choose the source of access control for the Designer, in my case I have a group that is based on the AD + internal management of roles, of the type "AD/Internal Hybrid". This works fine for access to the Designer, but those same users cannot access the Gateway web. Only those in the "default" user group. Is there any way that this other group of "AD/Internal Hybrid" users can access the Gateway web? Thanks in advance ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 3, 2024, 10:58am UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/2 "2024-04-03T10:58:11Z")
It's a separate setting for the system user source. Highly recommended that an AD user source for this have soft failover to the original default user source. ---
**Author:** ![Luis\_Garijo](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@Luis\_Garijo](https://forum.inductiveautomation.com/u/Luis_Garijo)\ **Post date:** [April 3, 2024, 11:12am UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/3 "2024-04-03T11:12:25Z")
Thanks for the answer, so I can't manage web access to the Gateway with a System User Source group? I don't fully understand your recommendation. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 3, 2024, 11:14am UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/4 "2024-04-03T11:14:53Z")
There is user source setting for the "system" user source, the gateway itself. Separate for the user source setting for the designer. But works the same way. Yes, you can make a "gateway-admins" group in your AD to manage the gateway. ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [April 3, 2024, 11:41am UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/5 "2024-04-03T11:41:28Z")
> [@Luis\_Garijo](#): > > I don't fully understand your recommendation. See if [How to create internal account and reset password in AD/Internal Hybrid resources - #2 by Transistor](https://forum.inductiveautomation.com/t/how-to-create-internal-account-and-reset-password-in-ad-internal-hybrid-resources/74543/2) helps. ---
**Author:** ![Luis\_Garijo](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@Luis\_Garijo](https://forum.inductiveautomation.com/u/Luis_Garijo)\ **Post date:** [April 8, 2024, 10:50am UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/6 "2024-04-08T10:50:18Z")
Thanks for the reply, but I have not been able to get the AD/Internal Hybrid user group working to allow them to log into the gateway. This is the configuration: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/d/bd1b05939bb908110612565fb619299553a52fdc.png) And this one is the default group: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/4/b4f4d95c9002353f319bcb2d25f0e5896d542bfe.png) And this is the general configuration ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/b/4bb1ebd9ce26e9c4cf1e380cd46be555ed8683ce.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 8, 2024, 12:30pm UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/7 "2024-04-08T12:30:38Z")
You'll probably need an MS domain expert looking over your shoulder. I don't see anything wrong, other than your soft failover probably not working. (I don't see the default group's `Administrators` in the permissions list for the gateway sections.) Consider opening a support ticket. ---
**Author:** ![Luis\_Garijo](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@Luis\_Garijo](https://forum.inductiveautomation.com/u/Luis_Garijo)\ **Post date:** [April 8, 2024, 1:12pm UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/8 "2024-04-08T13:12:09Z")
The curious thing is that the domain user validation for the "OT domain" group does work to log in to the Designer. I monitor the traffic from the Ignition server to the AD and there are only name/password resolution requests against the AD when I log in to the designer but not when I try to log in from the Gateway with a domain user. I'm a bit confused. Thanks anyway for your help! ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [April 8, 2024, 1:39pm UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/9 "2024-04-08T13:39:50Z")
What do you have for the System Identity Provider? It's the top entry in _Security -\> General_. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/e/ee28d140d5984f78dd5243d3622bbe48158402c8.png) ---
**Author:** ![Luis\_Garijo](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@Luis\_Garijo](https://forum.inductiveautomation.com/u/Luis_Garijo)\ **Post date:** [April 8, 2024, 3:05pm UTC](https://forum.inductiveautomation.com/t/gateway-web-access-system-user-source/88275/10 "2024-04-08T15:05:25Z")
I finally figured it out. I had to modify the "User Source" of the "Provider Configuration" within the "Identity Providers" options of the: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/1/f1acfeb029ef6ecf1261220111c264e209506474.png) In the general security options I had to change the "Designer Authenticaition Strategy" from "Classic" to "Identity Provider". ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/f/7fd2f38b3c28ded89aa2e7255ad7b0c3f1efc997.png) Now the OT Domain users can access both the Gateway (depending on the Role they can see Home, Status or Config" and also access the "Designer". What is not clear to me is what would happen if the authentication against the AD fails? Supposedly I have configured the User Source "OT domain" to validate against the "default" (in which I have an admin user) in case of failure. I have set the failure mode to "Soft", but maybe it should be set to "Hard". ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/8/c839f5f89efaa877cec1a2a0e7bee0cce69e68a7.png) Thank you very much for your help!