# I need help understanding the Security Level interaction with Tag Provider

**URL:** <https://forum.inductiveautomation.com/t/i-need-help-understanding-the-security-level-interaction-with-tag-provider/98583>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [November 13, 2024, 8:54pm UTC](https://forum.inductiveautomation.com/t/i-need-help-understanding-the-security-level-interaction-with-tag-provider/98583 "2024-11-13T20:54:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Francisco\_Franco](https://avatars.discourse-cdn.com/v4/letter/f/7ea924/32.png) [@Francisco\_Franco](https://forum.inductiveautomation.com/u/Francisco_Franco)\
**Post date:** [November 13, 2024, 8:54pm UTC](https://forum.inductiveautomation.com/t/i-need-help-understanding-the-security-level-interaction-with-tag-provider/98583/1 "2024-11-13T20:54:22Z")

</div>

Hello. I'm trying to set up nested Security Levels for managing who can use, change and create new tags in the Designer.

I've setup my security levels like this:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/1/2118aba5ac7bf1548a56d8030880b363e3838308.png)

Then, I have set up my TagProvider to use said Security levels for defining who can interact with the tags, as in the following screenshot:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/5/85e92f3613a957589833b11ea05821a3cd22c13e.png)

When I do a Test Login, my user already has those Security Levels granted, as it's shown in the following screen:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/6/7692f1bfd8f717fa7a471a7e8afdb148cb6e6c10.png)

Nevertheless, when I start a Designer session with the specified users, I can't even see the tags created in the tag provider, nor create new tags.

In the other hand, if I use roles instead of Security Levels, everything works alright.

I set up the roles like this:

Tag Read Permissions: Authenticated/Roles/Monitor  
Tag Write Permissions: Authenticated/Roles/Operator  
Tag Editing Permissions: Authenticated/Roles/TagCreator

With this I can see and add new tags with no issue.

I thought that I could simplify it by doing the Security Zone mapping instead of adding all the subsequent roles to the users. I was planning using the nested Zones as in the second picture to make the deepest security zone inherit all of the other permissions.

When using roles instead, I need to add all three roles to my PLCUser\_TagCreator user.

Is there anything wrong in my expression or setup? Thanks in advance for the feedback.

---

<div class="post-metadata">

**Author:** ![Francisco\_Franco](https://avatars.discourse-cdn.com/v4/letter/f/7ea924/32.png) [@Francisco\_Franco](https://forum.inductiveautomation.com/u/Francisco_Franco)\
**Post date:** [November 13, 2024, 10:39pm UTC](https://forum.inductiveautomation.com/t/i-need-help-understanding-the-security-level-interaction-with-tag-provider/98583/2 "2024-11-13T22:39:27Z")

</div>

I'm now 100% sure that the expression for my custom Security Level is not working. Am I missing something in the syntaxis?

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/d/7d86cdfb62153d050393927386b7cce77e8f7837.png)

---

<div class="post-metadata">

**Author:** ![Francisco\_Franco](https://avatars.discourse-cdn.com/v4/letter/f/7ea924/32.png) [@Francisco\_Franco](https://forum.inductiveautomation.com/u/Francisco_Franco)\
**Post date:** [November 14, 2024, 3:31pm UTC](https://forum.inductiveautomation.com/t/i-need-help-understanding-the-security-level-interaction-with-tag-provider/98583/3 "2024-11-14T15:31:23Z")

</div>

I Found the answer! I'm leaving this so it hopefully helps anyone else.

This was the part doing the trick:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/b/4b99be4cd97c754265c7880212ec2c4cde000206.png)

So it happens that I had my settings in Security General to use the Classic Authentication Strategy, and the Security Levels exists only in a Identity Provider Level. That's why no matter how I would set up my security levels, as I was not using my identity provider when logging in to mi designer, I could not access my tags.

So, I solved it by switching to use the identity provider login under "Security \> General" in the Gateway.