# Getting a list of current user's roles

**URL:** <https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618>\
**Category:** Ignition\
**Tags:** perspective, ignition81\
**Created:** [November 7, 2023, 7:58pm UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618 "2023-11-07T19:58:55Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![hw79](https://avatars.discourse-cdn.com/v4/letter/h/838e76/32.png) [@hw79](https://forum.inductiveautomation.com/u/hw79)\
**Post date:** [November 7, 2023, 7:58pm UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/1 "2023-11-07T19:58:55Z")

</div>

I'm trying to enable/disable items in my views based on the user's roles but I can't seem to find a list of the session user's roles.

I was thinking I could add them to a label to reference while I'm working on the view.

system.security.getRoles gives me the list of all roles and not the ones the user has.

edit: I wanted to add that the roles are obviously there in the designer because I can see them in the tag browser under [system]Client/User/RoleString but when I try to add them as an expression I get a Bad\_NotFound error.

---

<div class="post-metadata">

**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\
**Post date:** [November 7, 2023, 8:11pm UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/2 "2023-11-07T20:11:38Z")

</div>

What platform are you on, Vision or Perspective?

In perspective, `session.props.auth.user.roles` should give the list of roles for the current logged in user.

in Vision, `system.security.getRoles()` returns the roles of the currently logged in user. If you are seeing all the roles when calling this, check what roles are assigned to whatever user you are logging in as for testing. If you are testing in the designer, it will return all roles of the user you logged into the designer with.

There is also the 'RolesDataSet' tag that you could try. Note that the `RolesString` and `RolesDataset` are only available in **vision** , for perspective use the prop I mentioned above

---

<div class="post-metadata">

**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\
**Post date:** [November 7, 2023, 8:11pm UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/3 "2023-11-07T20:11:39Z")

</div>

Use an expression binding. There are two user functions, hasRole and isAuthorized.

[https://docs.inductiveautomation.com/display/DOC81/Users](https://docs.inductiveautomation.com/display/DOC81/Users)

---

<div class="post-metadata">

**Author:** ![hw79](https://avatars.discourse-cdn.com/v4/letter/h/838e76/32.png) [@hw79](https://forum.inductiveautomation.com/u/hw79)\
**Post date:** [November 7, 2023, 8:14pm UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/4 "2023-11-07T20:14:24Z")

</div>

Yes, I should have mentioned. I'm using perspective.

That was it! My issue was trying to use the tags. session.props.auth.user.roles did the trick, thank you!

---

<div class="post-metadata">

**Author:** ![hw79](https://avatars.discourse-cdn.com/v4/letter/h/838e76/32.png) [@hw79](https://forum.inductiveautomation.com/u/hw79)\
**Post date:** [November 7, 2023, 8:22pm UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/5 "2023-11-07T20:22:45Z")

</div>

Thank you @Transistor, helpful as always!

---

<div class="post-metadata">

**Author:** ![dbuescher](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@dbuescher](https://forum.inductiveautomation.com/u/dbuescher)\
**Post date:** [December 17, 2025, 12:04am UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/6 "2025-12-17T00:04:33Z")

</div>

I tried session.props.auth.user.roles and get this error: “NameError: global name 'session' is not defined”. Any advice on this?

---

<div class="post-metadata">

**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\
**Post date:** [December 17, 2025, 1:23am UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/7 "2025-12-17T01:23:12Z")

</div>

The session property I mentioned is accessible inside of an expression binding, and doesn't require a script.

> [@dbuescher](#):
>
> error: “NameError: global name 'session' is not defined”

If you want to access the session properties in a project library function you'll need to pass the session to the function as an argument.

If this is just a script on a property or component, adding `self.` in front of `session` should be enough for it access the session properties, eg `self.session.props.auth.user.roles`

> **[Session Properties | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/ignition-modules/perspective/perspective-sessions/session-properties)**
>
> Session properties are available for use throughout Perspective Sessions. Sessions of a given project will have the same list of properties, however, the actual values are unique and independent for each running Session.

---

<div class="post-metadata">

**Author:** ![Nol](https://avatars.discourse-cdn.com/v4/letter/n/8e8cbc/32.png) [@Nol](https://forum.inductiveautomation.com/u/Nol)\
**Post date:** [December 17, 2025, 2:04pm UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/8 "2025-12-17T14:04:51Z")

</div>

For an expression binding you can just do something like this:

```python
isAuthorized(true, 'Authenticated/Roles/Operator') || isAuthorized(true, 'Authenticated/Roles/Administrator')

```

---

<div class="post-metadata">

**Author:** ![dbuescher](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@dbuescher](https://forum.inductiveautomation.com/u/dbuescher)\
**Post date:** [December 17, 2025, 5:29pm UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/9 "2025-12-17T17:29:07Z")

</div>

Adding self. worked for me. thanks for that tip!

---

<div class="post-metadata">

**Author:** ![Chris\_Murphy](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@Chris\_Murphy](https://forum.inductiveautomation.com/u/Chris_Murphy)\
**Post date:** [December 18, 2025, 2:26am UTC](https://forum.inductiveautomation.com/t/getting-a-list-of-current-users-roles/81618/10 "2025-12-18T02:26:23Z")

</div>

I’ll just add here that in my experience, doing authentication checks in the views is a pain. We always put security on the tags (its all UDTs so updates are easy). You can then just bind the enable of any component like a button or numeric input to the tag .CanWrite property. simples.

This disconnects the views from your deployments specific authentication requirements and allows much more re-use of views like equipment faceplates across multiple deployments.