# Identity Provider Idp Security Level Rules

**URL:** <https://forum.inductiveautomation.com/t/identity-provider-idp-security-level-rules/65637>\
**Category:** Ignition\
**Created:** [October 25, 2022, 5:20am UTC](https://forum.inductiveautomation.com/t/identity-provider-idp-security-level-rules/65637 "2022-10-25T05:20:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\
**Post date:** [October 25, 2022, 5:20am UTC](https://forum.inductiveautomation.com/t/identity-provider-idp-security-level-rules/65637/1 "2022-10-25T05:20:58Z")

</div>

Say I wanted to give a tag write permissions more complex than I can give with just roles, for example (pseudo-code):

```auto
({Authenticated/Roles/Operator} and {Authenticated/Roles/Area_WWTP}) or {Authenticated/Roles/Master}

```

I assume that I would need to create a custom security level for each of these more complex examples and then configure a Security Level Rule for these in the idp.  
The User Manual doesn't mention anything about being able to use logical operators, but can I use something like:

```auto
containsAll({user:roles}, 'Operator', 'Area_WWTP')
||
containsAll({user:roles}, 'Master')

```

?

---

<div class="post-metadata">

**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\
**Post date:** [October 25, 2022, 5:40am UTC](https://forum.inductiveautomation.com/t/identity-provider-idp-security-level-rules/65637/2 "2022-10-25T05:40:43Z")

</div>

This does appear to work 🙂  
However, for example, say I had multiple areas (WWTP/Refrigeration/Line1/etc.)and multiple basic privileges (Supervisor/Operator/Engineer/Maintenance/etc). What if I wanted a particular user to be a Supervisor in WWTP but only have Operator level in Line1?  
I think I would then need multiple area roles, like WWTP\_Operator, WWTP\_Supervisor, Refrigeration\_Operator, Refrigeration\_Supervisor, etc. and I wouldn't then need custom roles defined, unless I'm missing something?

---

<div class="post-metadata">

**Author:** ![david.l](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@david.l](https://forum.inductiveautomation.com/u/david.l)\
**Post date:** [October 25, 2022, 1:31pm UTC](https://forum.inductiveautomation.com/t/identity-provider-idp-security-level-rules/65637/3 "2022-10-25T13:31:10Z")

</div>

We have multiple roles which I think is similar to your multiple area roles. We use Azure AD where all of the roles are defined (in App Registration). The security groups are defined in the Azure AD Enterprise Application screen and each group has 1 role associated with it. There is a 1 to 1 mapping of a group to a role.

Project1\_Operator  
Project1\_Maintenance  
Project1\_ViewOnly  
Project2\_Operator  
Project2\_Maintenance  
Project2\_ViewOnly  
Area1\_Operator  
Area1\_Maintenance  
Area1\_ViewOnly  
etc.