# IDP Breaking Change in 8.1.2 AD/AD Hybrid Failover

**URL:** <https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226>\
**Category:** Ignition\
**Tags:** ignition80\
**Created:** [February 10, 2021, 10:17am UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226 "2021-02-10T10:17:06Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\
**Post date:** [February 10, 2021, 10:17am UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226/1 "2021-02-10T10:17:06Z")

</div>

Hi,

We use an Active Directory user source, which returns all the roles from AD. Problem is you cannot assign a badge to a user in a pure AD user source.

We then used a soft failover AD Internal Hybrid to assign the user badges, as originally recommended by @jspecht.

This worked really well until 8.1.2 as when a user logged in with a badge, the user would be found in the hybrid failover source, matched to a user in the pure AD source and return with the AD groups as roles. Similar to below:

```auto
{
  "tokenEndpointResponse": {
    "access_token": "<accesstoken>",
    "id_token": "<token>",
    "token_type": "Bearer",
    "expires_in": 3600,
    "scope": "openid"
  },
  "idTokenClaims": {
    "iss": "<idp name>",
    "aud": "ignition",
    "exp": 1612952433,
    "jti": "<jti>",
    "iat": 1612951833,
    "nbf": 1612951713,
    "sub": "<username>",
    "preferred_username": "<username>",
    "roles": [
      "all",
      "the",
      "roles",
      "from",
      "AD"
    ],
    "nonce": "<nonce>",
    "email": "<email>",
    "given_name": "<name>",
    "family_name": "<surname>",
    "amr": [
      "badge"
    ],
    "auth_time": 1612951058,
    "challenged": false
  }
}

```

Now, after upgrade to 8.1.2, it returns an empty list for roles if authenticated against the soft failover.

How can we restore this critical functionality, other than rolling back to 8.1.1?  
If we can assign a badge to a users to a pure AD user source, that would be ideal. We can replicate the user roles assignment in AD Hybrid source as that is not maintainable at scale.

Please assist.

Regards,  
Deon

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [February 10, 2021, 4:35pm UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226/2 "2021-02-10T16:35:27Z")

</div>

The changes in 8.1.2 indeed would break the workaround we came up with back then, unfortunately.

The only other workaround that comes to mind is something recently discussed here: [IdP/Database Hybrid](http://forum.inductiveautomation.com/t/idp-database-hybrid/39432/5)

In short: you can use an expression attribute mapper which invokes a jython script to fetch the roles of the user from the pure AD source given the username of the user which is returned from the OIDC token claims.

Let me know if that helps

---

<div class="post-metadata">

**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\
**Post date:** [February 10, 2021, 4:56pm UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226/3 "2021-02-10T16:56:35Z")

</div>

Hi Joel,

Thanks for the prompt reply.

I get the intention of the expression: get the roles from another user source based on the username of this requesting user?

```auto
runScript("system.user.getUser('Active Directory', '" + {idp-attributes:/saml2p:Response/saml2:Assertion/saml2:Subject/saml2:NameID/text()} + "').getRoles()")

```

This bit:

```auto
{idp-attributes:/saml2p:Response/saml2:Assertion/saml2:Subject/saml2:NameID/text()} 

```

is over my paygrade. Is this the correct syntax for the response of the Ignition idP?

I’ll give it a go.

Regards,  
Deon

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [February 10, 2021, 5:48pm UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226/4 "2021-02-10T17:48:31Z")

</div>

For the Ignition IdP, this should work for you:

```auto
runScript("system.user.getUser('Active Directory', '" + {attribute-source:idTokenClaims:preferred_username} + "').getRoles()")

```

---

<div class="post-metadata">

**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\
**Post date:** [February 10, 2021, 5:51pm UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226/5 "2021-02-10T17:51:21Z")

</div>

I got it a second before you posted!

It seems to work. Will test a bit more.

Thanks for the help

---

<div class="post-metadata">

**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\
**Post date:** [February 10, 2021, 6:11pm UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226/6 "2021-02-10T18:11:27Z")

</div>

It seems the roles are correctly pulled from the ‘Active Directory’ user source through the expression attribute mapping, but the security level rules no longer evaluate true.

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/c/6cc9e1b8aab338430c2090c68f440971a579c0ce.png)

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/8/e8ed45bf8fee5796c058077596e5bbd8bba1278b.png)

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/1/61b3b215acd11b21c353a13b1dcb5299c3f0f59b.png)

I assumed the `{idp-attributes:roles}` refer to the mapped attributes. Does this need to change?

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [February 10, 2021, 6:15pm UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226/7 "2021-02-10T18:15:20Z")

</div>

Try swapping

```auto
{idp-attributes:roles}

```

with

```auto
runScript("system.user.getUser('Active Directory', '" + {attribute-source:idTokenClaims:preferred_username} + "').getRoles()")

```