# Ignition Edge, user source fallback if IDP in not reachable **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [March 13, 2025, 3:49pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635 "2025-03-13T15:49:28Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [March 13, 2025, 3:49pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/1 "2025-03-13T15:49:28Z")
**Ignition Edge** Hi @jspecht, In Ignition Edge, is it possible to configure a user source fallback (Igntion default user source) if we use an Identity Providers (openID1 or SAML2). It's possible with an AD with **Failover Source** , but I don't find any settings if we use an IDP ? Edge panel is mainly used when central Ignition and the IDP are not reachable due to network outage.if we use an IDP how to connect in Ignition Edge in that case ? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [March 13, 2025, 3:57pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/2 "2025-03-13T15:57:17Z")
IdPs do not support the concept of "failover" in the same way as User Sources. If your IdP is an Internal Ignition IdP, then it uses a User Source to log in. This user source could have a failover configured. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [March 13, 2025, 4:13pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/3 "2025-03-13T16:13:46Z")
> [@jspecht](#): > > If your IdP is an Internal Ignition IdP, then it uses a User Source to log in. This user source could have a failover configured. the drawback is that user/paswword are not sync with the central gateway in that case. So if we wish to use the same "user source" at edge and at Ignition central, when edge is isolated from the network and can't reach the IdP, user can't connect anymore at edge ? It seems we can only use an AD user source for that use case ? **There is no option to have a local cache at edge to be able to connect when the external IdP is not reachable ?** (Edge panel edition with Perspective) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/5/456e660062e5ce0ec195a07308a769cf8c4b965b.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 13, 2025, 4:15pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/4 "2025-03-13T16:15:54Z")
If you aren't using a local IdP with Edge, you are screwing up. The Edge fallback needs to cover the **purely local** operations at that workstation. You simply cannot rely on a unified authentication system. The only IdP that Ignition could cache is **its own**. Which is **moot** if on the same gateway as Edge itself. All other IdPs are **external**. Any caching would have to be handled at the **one** URL configured as the IdP. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [March 13, 2025, 4:51pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/5 "2025-03-13T16:51:23Z")
I agree that a local IdP or some cache must be available at edge. Edge Panel main use case is when edge device is isolated from the network. But with several edge site and local Ignition Idp, we have to create "local" user on each site, with permanent password. It' means "generic" user with password without expiration 😮 It will be tedious to connect on each edge site to change regularly the password... **perhaps an EAM tack to sync Ignition local IdP data from the central gateway to igntion edge sites could be a solution ?** ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 13, 2025, 4:57pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/6 "2025-03-13T16:57:11Z")
Use `system.util.sendRequest()` from a central gateway to invoke a password change operation on target Edge device's user source. Or configure the permanent local user to only have the bare minimum privileges to operate the machine. Anything else can wait for network restoration. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [March 13, 2025, 5:04pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/7 "2025-03-13T17:04:07Z")
> [@pturmel](#): > > Use `system.util.sendRequest()` from a central gateway to invoke a password change operation on target Edge device's user source. I don't see a way to change the password with script ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 13, 2025, 5:59pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/8 "2025-03-13T17:59:04Z")
See `system.user.*`. You retrieve the user with `.getUser()`, alter the user object by setting the password property, then call `.editUser()` to save the modification(s). ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [March 13, 2025, 8:19pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/9 "2025-03-13T20:19:28Z")
user.get("Password") always return None. user.getProperties() return [badge, schedule, firstname, notes, language, username, lastname] I think user password is not avaible with script. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 13, 2025, 8:25pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/10 "2025-03-13T20:25:56Z")
I would not expect password to ever be readable. Try this: ```python from com.inductiveautomation.ignition.common.user import User aUser = system.user.getUser('SomeName', 'SomeSource') aUser.set(User.Password, "someNewPassword") response = system.user.editUser('SomeSource', aUser) ``` ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [March 13, 2025, 8:56pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/11 "2025-03-13T20:56:28Z")
Yes that works from gateway scope ! I suppose as the user object is serializable it can be sent in the payload of `system.util.sendRequest()` and transport all information (roles and password included) to update the user in the "remote" Ignition default user source if it works we can sync user (with all informations) between the central gateway and the edge site gateway. I hope that will be still available in 8.3 with new secret management ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 13, 2025, 9:17pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/12 "2025-03-13T21:17:55Z")
Don't send the user object in your message between gateways. Just send the user name and new password in the message payload and have the target gateway do the work. Return success or failure so your central script can cross that edge node off of its list of nodes that need rotated passwords. ---
**Author:** ![Chris\_Bingham](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Chris\_Bingham](https://forum.inductiveautomation.com/u/Chris_Bingham)\ **Post date:** [March 13, 2025, 9:27pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/13 "2025-03-13T21:27:26Z")
Is it an option to use Security Zones (especially, a `localhost` zone) whereby a user is **not** required to login in order to perform _basic_ operations if operating locally? One mentality is that a bad actor - on-location - can cause plenty of damage outside of the capability of the touchscreen. Any elevated operations would still require login. Arguably, anything mission critical should not require elevated permissions. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [March 13, 2025, 9:30pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/14 "2025-03-13T21:30:50Z")
I was thinking to sync all users from the central gateway to the edge every day. The user will mainly connect on the central gateway and change the password here. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 13, 2025, 9:31pm UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/15 "2025-03-13T21:31:42Z")
> [@mazeyrat](#): > > change the password here Yes, but send that to every system, not the user object. (I doubt it can be sent.) ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [March 25, 2025, 10:20am UTC](https://forum.inductiveautomation.com/t/ignition-edge-user-source-fallback-if-idp-in-not-reachable/103635/16 "2025-03-25T10:20:44Z")
User object can be sent in the payload og the gateway message. All data are serialized, but the **password is forced to None.** So this can't be used to sync the user & password between gateway. We will probably propose to synchronize user def between central gateway and all edge sites with a password change like you mentioned. For the central gateway, db user source, defautl source at edge. What's strange : **default user source has some password policy but not database user source...** 🤔 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/c/bc3d1ae1abe016d8efc0370b72e20e527de0b0c4.png)