# Ignition AD / Database Hybrid User Source – New AD User Cannot Login Immediately (Login Works After ~2 Hours)

**URL:** <https://forum.inductiveautomation.com/t/ignition-ad-database-hybrid-user-source-new-ad-user-cannot-login-immediately-login-works-after-2-hours/113444>\
**Category:** Ignition\
**Created:** [January 21, 2026, 1:16pm UTC](https://forum.inductiveautomation.com/t/ignition-ad-database-hybrid-user-source-new-ad-user-cannot-login-immediately-login-works-after-2-hours/113444 "2026-01-21T13:16:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![senthoormani.m](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@senthoormani.m](https://forum.inductiveautomation.com/u/senthoormani.m)\
**Post date:** [January 21, 2026, 1:16pm UTC](https://forum.inductiveautomation.com/t/ignition-ad-database-hybrid-user-source-new-ad-user-cannot-login-immediately-login-works-after-2-hours/113444/1 "2026-01-21T13:16:22Z")

</div>

Hello All,

We are using an **Active Directory / Database Hybrid User Source** in Ignition.

**Issue Description:**

When we **manually add a new user in Active Directory** :

- The user **cannot log in to Ignition immediately**

- Login **starts working only after 1–2 hours**

From our observation, it took **delay for new user login.**

1. Are there any **Ignition or AD settings** to reduce this delay?

2. Is there any way to **force refresh** the user/group cache?

3. Has anyone else faced this issue and found a solution?

**Expected Behavior:** New AD users should be able to log in **immediately** after added in AD.

Any guidance or best practices would be appreciated.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Jesse\_Van\_Hill](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jesse_van_hill/32/56876_2.png) [@Jesse\_Van\_Hill](https://forum.inductiveautomation.com/u/Jesse_Van_Hill)\
**Post date:** [February 20, 2026, 5:28pm UTC](https://forum.inductiveautomation.com/t/ignition-ad-database-hybrid-user-source-new-ad-user-cannot-login-immediately-login-works-after-2-hours/113444/2 "2026-02-20T17:28:16Z")

</div>

The AD/DB hybrid user source does not involve any caching in the authentication path and it reaches out directly to the LDAP server to authenticate.

If using AD, I would use the OpenLDAP `ldapwhoami` utility to try to authenticate with the same user. You could also try using `ldapsearch` if you are using an LDAP server that does NOT support the “Who AM I?” extended operation.

If you are using a distributed LDAP server, it is possible that replication is taking that long. For instance, while creating an AD user the user on the local domain controller is available immediately, it can take over an hour for the user to propagate to other servers.

I hope that helps.

---

<div class="post-metadata">

**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\
**Post date:** [February 20, 2026, 6:51pm UTC](https://forum.inductiveautomation.com/t/ignition-ad-database-hybrid-user-source-new-ad-user-cannot-login-immediately-login-works-after-2-hours/113444/3 "2026-02-20T18:51:49Z")

</div>

> [@Jesse\_Van\_Hill](#):
>
> If you are using a distributed LDAP server, it is possible that replication is taking that long. For instance, while creating an AD user the user on the local domain controller is available immediately, it can take over an hour for the user to propagate to other servers.

I'd bet it's this. If you need a user to log in quickly, it's best to make the change on the DC server that Ignition points to, otherwise you're at the mercy of AD replication. Your IT group can speed up how frequently AD replicates, but this sounds to me like the most likely reason for the delay.