# IdP failover from Entra SSO to AD?

**URL:** <https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184>\
**Category:** Ignition\
**Tags:** security, ignition81\
**Created:** [June 20, 2024, 9:43pm UTC](https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184 "2024-06-20T21:43:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hw79](https://avatars.discourse-cdn.com/v4/letter/h/838e76/32.png) [@hw79](https://forum.inductiveautomation.com/u/hw79)\
**Post date:** [June 20, 2024, 9:43pm UTC](https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184/1 "2024-06-20T21:43:04Z")

</div>

Our gateways are set up to use Active Directory for the IdP.

I'd like to get our gateways set up to use SAML but can't risk locking users out if there's no internet connection. Is there a way to set an IdP failover from a SAML user source (Entra SSO) to AD?

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [June 20, 2024, 10:37pm UTC](https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184/2 "2024-06-20T22:37:42Z")

</div>

There is no failover in IdPs themselves. Ignition's native IdP can point at a **user source** that can have failover.

---

<div class="post-metadata">

**Author:** ![hw79](https://avatars.discourse-cdn.com/v4/letter/h/838e76/32.png) [@hw79](https://forum.inductiveautomation.com/u/hw79)\
**Post date:** [August 29, 2024, 4:12pm UTC](https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184/3 "2024-08-29T16:12:27Z")

</div>

am I able to make a SAML user source that fails over to AD?

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [August 29, 2024, 4:22pm UTC](https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184/4 "2024-08-29T16:22:52Z")

</div>

No. SAML is a type of IdP, not a user source.

---

<div class="post-metadata">

**Author:** ![hw79](https://avatars.discourse-cdn.com/v4/letter/h/838e76/32.png) [@hw79](https://forum.inductiveautomation.com/u/hw79)\
**Post date:** [August 29, 2024, 4:34pm UTC](https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184/6 "2024-08-29T16:34:37Z")

</div>

How could one use a SAML IdP, like Azure Active Directory, but have a backup plan for if the on-prem gateway lost internet connection? How would the users log in?

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [August 29, 2024, 4:37pm UTC](https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184/7 "2024-08-29T16:37:57Z")

</div>

I think the best you can do is have two projects, with the different login types. You'd want to make the "real" project inheritable, and only have the usable leaf projects set the login type and source.

You simply cannot point at an IdP outside your site and have it work when the internet is down. Don't make critical operations rely on the internet. 🤷‍♂️