# How to mitigate AD+SSO vulnerability? **URL:** \ **Category:** Ignition\ **Tags:** ignition79, ignition81\ **Created:** [May 24, 2022, 4:34pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970 "2022-05-24T16:34:30Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![cesrom](https://avatars.discourse-cdn.com/v4/letter/c/ea666f/32.png) [@cesrom](https://forum.inductiveautomation.com/u/cesrom)\ **Post date:** [May 24, 2022, 4:34pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/1 "2022-05-24T16:34:30Z")
We recently upgraded one of our Gateways to 8.1.17, and successfully re-enabled SSO for our clients, but I was wondering if there is a possibility to be “safe” while using SSO. SSO can be enabled for the Clients and for the Designer, but the [article](https://support.inductiveautomation.com/hc/en-us/articles/5979279808397-Active-Directory-SSO-Disabled-for-8-1-17-7-9-20-) does not talk specifically about which is vulnerable. So here I ask. 1. Are both vulnerable? 2. Is one “worse” than the other? 3. Are we “safe” if only SSO for the Designer is disabled? 4. How can I get a detailed description in order to reproduce within my organization? Thanks! ---
**Author:** ![dlorenzo](https://avatars.discourse-cdn.com/v4/letter/d/b19c9b/32.png) [@dlorenzo](https://forum.inductiveautomation.com/u/dlorenzo)\ **Post date:** [May 30, 2022, 7:15pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/2 "2022-05-30T19:15:11Z")
Sorry to hijack your thread. But I am having issues re-enabling SSO and it seems that you got it going. I have added the line to the java additional parameters and restarted the service. But I still can’t enable SSO under the AD user source config. Is there something else I need to do? Thanks. ---
**Author:** ![cesrom](https://avatars.discourse-cdn.com/v4/letter/c/ea666f/32.png) [@cesrom](https://forum.inductiveautomation.com/u/cesrom)\ **Post date:** [May 31, 2022, 4:28pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/3 "2022-05-31T16:28:12Z")
No worries. If you were following the instructions from the article, one thing that can be missed is that you’d need to replace the `X` from `wrapper.java.additional.X=-Dignition.enableInsecureAdSso=true` to a number as explained [here](https://docs.inductiveautomation.com/display/DOC81/Gateway+Configuration+File+Reference#GatewayConfigurationFileReference-ChangingJavaAdditionalParameters). E.g. `ignition.conf` lines 69-73: ```ini # Java Additional Parameters wrapper.java.additional.1=-Ddata.dir=data #wrapper.java.additional.2=-Xdebug #wrapper.java.additional.3=-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=*:8000 wrapper.java.additional.4=-Dignition.enableInsecureAdSso=true ``` ---
**Author:** ![Urvish\_Mehta](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/urvish_mehta/32/81912_2.png) [@Urvish\_Mehta](https://forum.inductiveautomation.com/u/Urvish_Mehta)\ **Post date:** [April 5, 2023, 3:12am UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/4 "2023-04-05T03:12:09Z")
I added this Line and I am still not able to login automatically. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/0/f09e890314fcc7c3f34540a7280f4748ba83e546.png) I enabled SSO enabled checkbox in project as well. Is there a way to confirm that SSO is enabled or not? Thanks ---
**Author:** ![zacht](https://avatars.discourse-cdn.com/v4/letter/z/ea5d25/32.png) [@zacht](https://forum.inductiveautomation.com/u/zacht)\ **Post date:** [April 5, 2023, 1:55pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/5 "2023-04-05T13:55:36Z")
> [@Urvish\_Mehta](#): > > I added this Line and I am still not able to login automatically. Did you restart the gateway after this step? ---
**Author:** ![Urvish\_Mehta](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/urvish_mehta/32/81912_2.png) [@Urvish\_Mehta](https://forum.inductiveautomation.com/u/Urvish_Mehta)\ **Post date:** [April 5, 2023, 6:13pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/6 "2023-04-05T18:13:04Z")
Hello zacht, yes I did. ---
**Author:** ![zacht](https://avatars.discourse-cdn.com/v4/letter/z/ea5d25/32.png) [@zacht](https://forum.inductiveautomation.com/u/zacht)\ **Post date:** [April 5, 2023, 6:20pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/7 "2023-04-05T18:20:15Z")
Can you copy and paste the contents of ignition.conf? I don't think it contains any sensitive information. ---
**Author:** ![cesrom](https://avatars.discourse-cdn.com/v4/letter/c/ea666f/32.png) [@cesrom](https://forum.inductiveautomation.com/u/cesrom)\ **Post date:** [April 5, 2023, 7:51pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/8 "2023-04-05T19:51:39Z")
Also, make sure you have checked **SSO Enabled** and properly configured the **SSO Domain** on your User Source. ---
**Author:** ![david.wooffindin](https://avatars.discourse-cdn.com/v4/letter/d/f475e1/32.png) [@david.wooffindin](https://forum.inductiveautomation.com/u/david.wooffindin)\ **Post date:** [September 20, 2023, 10:01pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/9 "2023-09-20T22:01:56Z")
No answer yet for the OP? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 20, 2023, 10:05pm UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/10 "2023-09-20T22:05:17Z")
> [@david.wooffindin](#): > > No answer yet for the OP? I'll take a stab. > [@cesrom](#): > > So here I ask. > > 1. Are both vulnerable? > 2. Is one “worse” than the other? > 3. Are we “safe” if only SSO for the Designer is disabled? > 4. How can I get a detailed description in order to reproduce within my organization? 1. yes 2. no 3. no 4. publicly available details are at [https://support.inductiveautomation.com/hc/en-us/articles/5979279808397-Active-Directory-SSO-Disabled-for-8-1-17-7-9-20-](https://support.inductiveautomation.com/hc/en-us/articles/5979279808397-Active-Directory-SSO-Disabled-for-8-1-17-7-9-20-) ---
**Author:** ![david.wooffindin](https://avatars.discourse-cdn.com/v4/letter/d/f475e1/32.png) [@david.wooffindin](https://forum.inductiveautomation.com/u/david.wooffindin)\ **Post date:** [October 30, 2023, 9:48am UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/11 "2023-10-30T09:48:26Z")
Hi, is there any planned fix for this in a future release ? Being able to use SSO would be a great benefit but not while the risk persists... ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [October 30, 2023, 11:59am UTC](https://forum.inductiveautomation.com/t/how-to-mitigate-ad-sso-vulnerability/59970/12 "2023-10-30T11:59:08Z")
It's a Microsoft problem, not an Ignition problem. Ignition turned it off by default because Microsoft hasn't fixed the problem. (Possibly not fixable. Convenience is often not compatible with security.) You should bug Microsoft.