# How are LDAP (AD) roles even used?

**URL:** <https://forum.inductiveautomation.com/t/how-are-ldap-ad-roles-even-used/101532>\
**Category:** Ignition\
**Tags:** security\
**Created:** [January 29, 2025, 3:20am UTC](https://forum.inductiveautomation.com/t/how-are-ldap-ad-roles-even-used/101532 "2025-01-29T03:20:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brandon\_Peterson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/brandon_peterson/32/32960_2.png) [@Brandon\_Peterson](https://forum.inductiveautomation.com/u/Brandon_Peterson)\
**Post date:** [January 29, 2025, 3:20am UTC](https://forum.inductiveautomation.com/t/how-are-ldap-ad-roles-even-used/101532/1 "2025-01-29T03:20:12Z")

</div>

For [Active Directory user sources](https://www.docs.inductiveautomation.com/docs/8.1/platform/security/classic-authentication-strategy/active-directory-authentication), there's a place to define what roles exist using an LDAP query:

 ![Screenshot of Role Search Base and Role Search Filter in the gateway user source settings](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/b/5b3b4db27e171b2162601b13b2f8221c441ce28e.png)

... and there's a place to define which user gets what role:

 ![Screenshot of User Role Attribute and Role Name Attribute in the gateway user source settings](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/9/996dda985bb3a8e29b941fd45a7dfca0694f0844.png)

But I can't find a reason, beyond the convenience of having a [list of roles to use in scripting](https://www.docs.inductiveautomation.com/docs/8.1/appendix/scripting-functions/system-user/system-user-getRoles), that this property needs to be populated at all. Because (afaik)...

> A user's roles are retrieved from the user object with no reference to that user source's roles.

Any user can have any role assigned (based on their LDAP user object attributes) regardless of what that user source's list of roles is. I don't know what use it's supposed to have.

* * *

It's been bugging me, not understanding this, so I figured I'd just ask to see if I'm missing something here.

1. Is this just a vestigial setting that was previously used but no longer is?
2. Is there just not as much of a need for it with this kind of user source in particular, so it was added to keep the functionality between user sources consistent?
3. Am I simply overthinking this??

I'd appreciate any thoughts on the topic! I [hear](https://forum.inductiveautomation.com/t/automate-user-source-creation/89298/2) AD user sources are getting a [glow up](https://forum.inductiveautomation.com/t/active-directory-nested-groups/16890/14) in v8.3 in any case.

* * *

**Unrelatedly...**  
I miss the time when I didn't know what this meant... 😅  
`(&(objectClass=user)(!(objectClass=computer))(memberOf:1.2.840.113556.1.4.1941:=CN=MyGroup,OU=MyOU,OU=MyDept,DC=ACME,DC=NET))`

---

<div class="post-metadata">

**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\
**Post date:** [January 29, 2025, 5:02am UTC](https://forum.inductiveautomation.com/t/how-are-ldap-ad-roles-even-used/101532/2 "2025-01-29T05:02:59Z")

</div>

Groups in AD become the roles for the users. When using AD without a database in hybrid mode, the roles match exactly. So if they belong to a group named "Domain Users" they'll also now have that role you can use in permissions and other security scenarios.

Here's a recent discussion/scenario I brought up and the solution to it in the case where standard graphics are made to work with a standard set of roles but AD groups/roles don't match the names.

> [@Dynamic AD Security Roles](https://forum.inductiveautomation.com/t/dynamic-ad-security-roles/101237/6):
>
> For completeness, here's what the client tags look like for anyone else needing to implement this in the future: Each tag is simply an expression like hasRole('sg\_Plant1\_Supervisor') Then in bindings for a simple permission, you only need to bind directly to the Vision client tag. For more complex bindings, you can use the tag/tags directly in expressions. For an extra added bonus, in my case, I'm naming my default tag provider the same as the plant name being used by the company in…