# How are LDAP (AD) roles even used? **URL:** \ **Category:** Ignition\ **Tags:** security\ **Created:** [January 29, 2025, 3:20am UTC](https://forum.inductiveautomation.com/t/how-are-ldap-ad-roles-even-used/101532 "2025-01-29T03:20:12Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [January 29, 2025, 5:02am UTC](https://forum.inductiveautomation.com/t/how-are-ldap-ad-roles-even-used/101532/2 "2025-01-29T05:02:59Z")
Groups in AD become the roles for the users. When using AD without a database in hybrid mode, the roles match exactly. So if they belong to a group named "Domain Users" they'll also now have that role you can use in permissions and other security scenarios. Here's a recent discussion/scenario I brought up and the solution to it in the case where standard graphics are made to work with a standard set of roles but AD groups/roles don't match the names. > [@Dynamic AD Security Roles](https://forum.inductiveautomation.com/t/dynamic-ad-security-roles/101237/6): > > For completeness, here's what the client tags look like for anyone else needing to implement this in the future: Each tag is simply an expression like hasRole('sg\_Plant1\_Supervisor') Then in bindings for a simple permission, you only need to bind directly to the Vision client tag. For more complex bindings, you can use the tag/tags directly in expressions. For an extra added bonus, in my case, I'm naming my default tag provider the same as the plant name being used by the company in… --- _[View the full topic](https://forum.inductiveautomation.com/t/how-are-ldap-ad-roles-even-used/101532)._