# General Help with AD Internal Hybrid **URL:** \ **Category:** Ignition\ **Created:** [May 30, 2024, 2:28pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143 "2024-05-30T14:28:44Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ltoscano](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@ltoscano](https://forum.inductiveautomation.com/u/ltoscano)\ **Post date:** [May 30, 2024, 2:28pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/1 "2024-05-30T14:28:44Z")
Morning folks. Looking for a little more info on setting up the AD Internal Hybrid User Source. If I'm understanding it correctly, I should create the roles I need for my project (there are three - Admin, Chemist, Engineer) on the gateway, and the create the users on the gateway and assign them to the roles (since I wouldn't need the entire user list from the AD server - just a specific few individuals) When I create the users, I would use the LDAP username and that would be the common user name that ties the user to the authentication. Temporarily for testing, I gave each of those users a basic password and that all works fine. Next I would configure AD Internal Hybrid per the user guide. And the way it would work is when the user signs on with his LDAP username and password, Ignition will authenticate the credentials with the AD server. If it's all OK, Ignition would then look internally and see which role that user name gets assigned. Am I correct so far? If so - then I think I'm good, although I am a little concerned that once I start using the AD Server, if something isn't working will I be locked out of my gateway and unable to reverse it or turn AD off since the Ignition administrative account is now tied to AD (or maybe it's not)?? Any insight would be helpful - thanks all! ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [May 30, 2024, 2:43pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/2 "2024-05-30T14:43:45Z")
> [@ltoscano](#): > > unable to reverse it or turn AD off since the Ignition administrative account is now tied to AD (or maybe it's not)?? Yes, you would need to include an Administrator role in your user/role mapping **IF** you use that same user source for your gateway authentication. (Projects each can have their own auth, separate from the gateway.) If you want unified auth, consider keeping the default auth profile for emergencies and setting it as a "soft failover" in the hybrid user source. ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [May 30, 2024, 2:47pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/3 "2024-05-30T14:47:17Z")
It's a bit easier than that. - Use the Ignition _default_ internal user source for your **administrator** login. This is most important for access if you mess up the AD Internal Hybrid configuration for any reason. - Use the Ignition _default_ internal user source for contractors or support that aren't on your AD system. - Create the necessary roles and assign them to the miscellaneious users. The administrator account should automatically have full permissions. - Configure the hybrid with soft failover to the internal. - Add the users and set their roles in the hybrid user source. You don't need to do it in the default internal. That means that there is no need for temporary passwords. The AD password will just work! So to address your questions: > If I'm understanding it correctly, I should create the roles I need for my project (there are three - Admin, Chemist, Engineer) on the gateway, and the create the users on the gateway and assign them to the roles. Yes but all in the AD Internal Hybrid. > When I create the users, I would use the LDAP username and that would be the common user name that ties the user to the authentication. Correct. > Temporarily for testing, I gave each of those users a basic password and that all works fine. Not correct. Enter any old rubbish into the password field. AD will look for the real AD password. > Next I would configure AD Internal Hybrid per the user guide. And the way it would work is when the user signs on with his LDAP username and password, Ignition will authenticate the credentials with the AD server. Correct so far. > If it's all OK, Ignition would then look internally and see which role that user name gets assigned. Yes, but it's looking for the roles in the Hybrid - not in the default. > ... although I am a little concerned that once I start using the AD Server, if something isn't working will I be locked out of my gateway and unable to reverse it or turn AD off since the Ignition administrative account is now tied to AD (or maybe it's not)? That's why having the soft failover to the internal default administrator account is important. * * * You can consider using the [Perspective User Management](https://inductiveautomation.com/exchange/2128/overview) tool available on the Ignition Exchange. You can build it into any application or create a standalone. It will make editing users much simpler. ---
**Author:** ![ltoscano](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@ltoscano](https://forum.inductiveautomation.com/u/ltoscano)\ **Post date:** [May 30, 2024, 3:34pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/4 "2024-05-30T15:34:59Z")
Thank you both! That cleared a lot up for me. This is the last item to configure for my project - going live next week. Really appreciate the help! ---
**Author:** ![ukamani](https://avatars.discourse-cdn.com/v4/letter/u/d9b06d/32.png) [@ukamani](https://forum.inductiveautomation.com/u/ukamani)\ **Post date:** [June 5, 2024, 2:50pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/5 "2024-06-05T14:50:12Z")
Hi guys, I'm the Admin for my company's Ignition system, and I'm trying to implement the same. But it doesn't seem to work for gateway login. Here's the basic structure of my Identity Providers: | Identity Provider | Associated User Profile Name | User Profile Type | Is Failover Set up? | Failover User Profile | Failover Mode | Is failover working for gateway login? | | --- | --- | --- | --- | --- | --- | --- | | default | default | Internal | Yes | USBP-AD | Soft | Yes | | system\_default | USBP-AD | AD/Internal Hybrid | Yes | default | Soft | No | There are distinct admins under each user profile: - user "ukamani" under user profile "USBP AD", my primary userID - user "su\_ukamani" under user profile "default", this is my backup userID for cases when there's issues connecting to the Microsoft AD. Issue comes when I set "System Identity Provider" property under "General Gateway Security Settings": - If I set "System Identity Provider" to point to "default" idP (which uses "default" user profile), I can log into the gateway using both "ukamani" and "su\_ukamani". Meaning, the failover works here. Here are the logs for this: - If I set "System Identity Provider" to point to "system\_default" idP (which uses "USBP-AD" user profile), I can log into the gateway using "ukamani" but login fails with "su\_ukamani". It never performs the failover to "default" user profile. Here are the logs for this: Any help would be appreciated! ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 5, 2024, 3:10pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/6 "2024-06-05T15:10:53Z")
Circular configuration. Don't have the default provider do any fail over. It should be the last resort in a chain of soft failovers. ---
**Author:** ![ukamani](https://avatars.discourse-cdn.com/v4/letter/u/d9b06d/32.png) [@ukamani](https://forum.inductiveautomation.com/u/ukamani)\ **Post date:** [June 5, 2024, 3:18pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/7 "2024-06-05T15:18:22Z")
That's exactly my aim. But it isn't work in my case. My "USBP-AD" isn't failing over to my "default", so I'm having to resort to going the other way round. And this issue is only happening for gateway page login, it works both ways on Vision Clients. Apologies, Correction: This issue is happening for both gateway page login and Vision Clients. On projects that point to "default" user source, are able to failover to "USBP-AD", but on projects that point to "USBP-AD" user source, are not able to failover to "default". ---
**Author:** ![ltoscano](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@ltoscano](https://forum.inductiveautomation.com/u/ltoscano)\ **Post date:** [June 10, 2024, 5:17pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/8 "2024-06-10T17:17:46Z")
Hi Guys, So setup all went well and I believe I'm connected correctly to the end user's Ad system, but we're not authenticating. (When working on my dev system, I didn't even get the option to add users because I had no DC to connect to, but once on the customer's system after entering the DC and userinfo, I did get the option to add users) I'm pretty sure we're good with the domain controller host (I can ping it) but the end user says its not the _Primary_ DC and we shouldn't need the PDC to do what we're doing (the PDC which sits behind a firewall and would require some configuration if we really need this to be the PDC). I don't know enough to question that. I did some other forum searching and saw some articles about needing a certificate maybe? But my thought was if that was a required step would it not just be part of the user docs for setting up AD and maybe that was an older version or something else. I did try both port 389 with SSL not checked and port 636 with SSL checked to no difference. I don't see a lot of troubleshooting options as there's nothing in the logs about authentication. Any thoughts? ---
**Author:** ![bschroeder](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bschroeder/32/13260_2.png) [@bschroeder](https://forum.inductiveautomation.com/u/bschroeder)\ **Post date:** [June 10, 2024, 5:29pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/9 "2024-06-10T17:29:47Z")
Can you see any users if you click manage users? ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/3/832e0255db60956ba94481591237944c8b0890d5.png) ---
**Author:** ![ltoscano](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@ltoscano](https://forum.inductiveautomation.com/u/ltoscano)\ **Post date:** [June 10, 2024, 5:33pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/10 "2024-06-10T17:33:37Z")
Hi there - yes, but that's because I added them manually - we only have half a dozen folks who need the Ignition system so we are managing the users/roles on the gateway. But I suppose as a test I could let it query AD for all the users to see if it generate the user list. Would all the users disappear once I switch it back or would I need to individually delete them all? ---
**Author:** ![bschroeder](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bschroeder/32/13260_2.png) [@bschroeder](https://forum.inductiveautomation.com/u/bschroeder)\ **Post date:** [June 10, 2024, 5:36pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/11 "2024-06-10T17:36:38Z")
I think they will all disappear... TBH I've not done that. Typically we just set it to import the users. Do you have this checked? ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/8/88ea20ed5465968f7a11887c499e1b48181bbf17.png) And do you have the User Listing Base, User List Filter, and User Search Filter configured? When you say you aren't authenticating, how do you know? Errors or just not getting a security group? ---
**Author:** ![ltoscano](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@ltoscano](https://forum.inductiveautomation.com/u/ltoscano)\ **Post date:** [June 10, 2024, 5:39pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/12 "2024-06-10T17:39:51Z")
I don't have that checked because I added the users manually. The filters are all set at their default settings. ---
**Author:** ![bschroeder](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bschroeder/32/13260_2.png) [@bschroeder](https://forum.inductiveautomation.com/u/bschroeder)\ **Post date:** [June 10, 2024, 5:43pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/13 "2024-06-10T17:43:18Z")
Do you have the listing base set correctly? That is how AD/LDAP knows to properly start looking for accounts. Also, see this for how to test querying AD servers: [https://support.kemptechnologies.com/hc/en-us/articles/204990569--How-to-troubleshoot-LDAP-Authentication-issues-using-ldp-exe](https://support.kemptechnologies.com/hc/en-us/articles/204990569--How-to-troubleshoot-LDAP-Authentication-issues-using-ldp-exe) You can use that to test your parameters configured in Ignition to make sure that you have things setup correctly. ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [June 10, 2024, 5:48pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/14 "2024-06-10T17:48:31Z")
I've lost track of what the problem is at the moment but I found Microsoft's AD Explorer very useful for understanding the structure and checking connections, etc. It's free and I was able to install it on a pretty well locked down company laptop. ---
**Author:** ![ltoscano](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@ltoscano](https://forum.inductiveautomation.com/u/ltoscano)\ **Post date:** [June 10, 2024, 5:48pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/15 "2024-06-10T17:48:43Z")
Thanks that may be useful to troubleshoot with. To answer your previous question, when trying to log in, it right away goes to "Login Failed - Please Try Again" Listing base is blank, which according to the field means it will search everything ---
**Author:** ![bschroeder](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bschroeder/32/13260_2.png) [@bschroeder](https://forum.inductiveautomation.com/u/bschroeder)\ **Post date:** [June 10, 2024, 6:07pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/16 "2024-06-10T18:07:05Z")
Yeah, then there is probably a configuration wrong in connecting to the LDAP server. I assume that this is Window Server? If so what version? And do you know for 100% that there aren't any firewalls between you and the LPAD server you have configured? ---
**Author:** ![ltoscano](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@ltoscano](https://forum.inductiveautomation.com/u/ltoscano)\ **Post date:** [June 10, 2024, 6:25pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/17 "2024-06-10T18:25:18Z")
SO I went ahead and checked the box to get all the users and that works - I now see all the AD users when I click on "manage users". So connectivity is definitely there. And I can see my user id in that list. But I cannot log into the gateway or perspective using my credentials. So the authentication part of the equation still is in question. ---
**Author:** ![bschroeder](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bschroeder/32/13260_2.png) [@bschroeder](https://forum.inductiveautomation.com/u/bschroeder)\ **Post date:** [June 10, 2024, 6:27pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/18 "2024-06-10T18:27:56Z")
So... now you need to get the IDP working properly. That is a separate but related item from the User Source. Check the Identity Providers on the gateway. Did you create an Identity Provider that references your new User Source Profile? ---
**Author:** ![ltoscano](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@ltoscano](https://forum.inductiveautomation.com/u/ltoscano)\ **Post date:** [June 10, 2024, 6:51pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/19 "2024-06-10T18:51:22Z")
Oh snap! Facepalm.... No I only have the default IDP which points to the default User Source. I didn't even think about that. Do I point the default IDP to the AD/Hybrid user source or do I create a new IDP that points to the AD/Hybrid and leave the default to point to the default in case of failover of the User Source from AD to Default? ---
**Author:** ![bschroeder](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bschroeder/32/13260_2.png) [@bschroeder](https://forum.inductiveautomation.com/u/bschroeder)\ **Post date:** [June 10, 2024, 6:53pm UTC](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/20 "2024-06-10T18:53:01Z")
I would create a new one based on your working user source. And then configure and test as needed. Make sure once you have that configured and working, that you assign that the project etc.. [Next page](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143.md?page=2)