# IDP Breaking Change in 8.1.2 AD/AD Hybrid Failover

**URL:** <https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226>\
**Category:** Ignition\
**Tags:** ignition80\
**Created:** [February 10, 2021, 10:17am UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226 "2021-02-10T10:17:06Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [February 10, 2021, 4:35pm UTC](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226/2 "2021-02-10T16:35:27Z")

</div>

The changes in 8.1.2 indeed would break the workaround we came up with back then, unfortunately.

The only other workaround that comes to mind is something recently discussed here: [IdP/Database Hybrid](http://forum.inductiveautomation.com/t/idp-database-hybrid/39432/5)

In short: you can use an expression attribute mapper which invokes a jython script to fetch the roles of the user from the pure AD source given the username of the user which is returned from the OIDC token claims.

Let me know if that helps

---

_[View the full topic](https://forum.inductiveautomation.com/t/idp-breaking-change-in-8-1-2-ad-ad-hybrid-failover/43226)._