# Ignition Security Question **URL:** \ **Category:** Ignition\ **Tags:** security\ **Created:** [August 21, 2025, 7:13pm UTC](https://forum.inductiveautomation.com/t/ignition-security-question/110068 "2025-08-21T19:13:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Alex\_Rayburg](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@Alex\_Rayburg](https://forum.inductiveautomation.com/u/Alex_Rayburg)\ **Post date:** [August 21, 2025, 7:13pm UTC](https://forum.inductiveautomation.com/t/ignition-security-question/110068/1 "2025-08-21T19:13:08Z")
Hello friends, I am lost in the sauce. I am implementing a AD/Ignition Hybrid user source. I have it connected and on the users tab I can see everyone(username, email, phone) and assign ignition defined roles. I did not like how the user source automatically appended my name Alex.Rayburg with “@domain” because people are use to using their full email to sign into things. So I go to settings and uncheck the box “automatic suffix” and I can now sign in with [alex.rayburg@domain.com](mailto:alex.rayburg@domain.com) but when I made this change, all the names under the user tab for the user source is gone and therefore I can not assign roles to [alex.rayburg@domain.com](mailto:alex.rayburg@domain.com) and roles I assigned before the suffix setting change do no get carried through to [alex.rayburg@domain.com](mailto:alex.rayburg@domain.com)(I can imagine why). So in conclusion I want to assign roles to [alex.rayburg@domain.com](mailto:alex.rayburg@domain.com) a valid log in but do not know how to. Added context: I also made an IdP for this hybrid user source. Screenshots below ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/2/428a625bc06a6cfbf82487a713647049332a2f31.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/a/ca6ca2211ff6238bcea03f70f4b3a2ac64812906.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/0/4042a0d9e02d496427a89d1a29a4c72e21708f27.png) ---
**Author:** ![Alex\_Rayburg](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@Alex\_Rayburg](https://forum.inductiveautomation.com/u/Alex_Rayburg)\ **Post date:** [August 21, 2025, 7:19pm UTC](https://forum.inductiveautomation.com/t/ignition-security-question/110068/2 "2025-08-21T19:19:13Z")
I did a poor job of blurring things out, I cant delete, if some admin thinks I didn’t blur out critical info in that first SS please remove the post lol. the email is fine ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [August 21, 2025, 7:21pm UTC](https://forum.inductiveautomation.com/t/ignition-security-question/110068/3 "2025-08-21T19:21:09Z")
Regarding the original problem, see if [General Help with AD Internal Hybrid - #3 by Transistor](https://forum.inductiveautomation.com/t/general-help-with-ad-internal-hybrid/91143/3) helps. (You would then log in as Administrator to fix things up.) ---
**Author:** ![Alex\_Rayburg](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@Alex\_Rayburg](https://forum.inductiveautomation.com/u/Alex_Rayburg)\ **Post date:** [August 21, 2025, 7:31pm UTC](https://forum.inductiveautomation.com/t/ignition-security-question/110068/4 "2025-08-21T19:31:33Z")
Thanks for the reference! The one thing I am encountering though is that I am unable to add users to the AD/Hybrid User source. I can create roles sure, but the user list is blank and there is no button to add user like with the default source. ---
**Author:** ![Alex\_Rayburg](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@Alex\_Rayburg](https://forum.inductiveautomation.com/u/Alex_Rayburg)\ **Post date:** [August 22, 2025, 12:28pm UTC](https://forum.inductiveautomation.com/t/ignition-security-question/110068/5 "2025-08-22T12:28:07Z")
Thanks for the reference! The one thing I am encountering though is that I am unable to add users to the AD/Hybrid User source. I can create roles sure, but the user list is blank and there is no button to add user like with the default source. To reiterate. I find it so weird that the list of users disappears when I tick off this setting in the AD/Hybrid User source, ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/e/9eb309c8d1b2e15c39245255d132e2bdadd9b843.png) Reading this, you would think this simply means users have to type in the full email to sign in which is true that does happen, but why is my user list gone feels like a bug, I cant assign roles to an empty list of users ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [August 22, 2025, 12:32pm UTC](https://forum.inductiveautomation.com/t/ignition-security-question/110068/6 "2025-08-22T12:32:42Z")
Sorry, I don't have an answer for you. It was some years back that I got it working for the organisation I was with. The main benefit with the hybrid is that you couldn't get locked out completely. I suggest you get in contact with Support - if you have a contract. [https://support.inductiveautomation.com/hc/en-us](https://support.inductiveautomation.com/hc/en-us). ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 2, 2025, 2:45pm UTC](https://forum.inductiveautomation.com/t/ignition-security-question/110068/7 "2025-09-02T14:45:18Z")
Hi @Alex_Rayburg - The Gateway uses the “Gateway Username” and “Password” settings in a bind operation with the LDAP server to “log in” as the Gateway user. Once logged in, the Gateway does a search operation to list all users under the configured “User Listing Base” and using the configured “User List Filter”. The “Automatic Suffix” setting applies to this Gateway user credential in addition to all other user credentials passed from Ignition to the LDAP server. When you disabled the “Automatic Suffix” setting, did you also update your Gateway username to also use the `username@domain` format? If not, this could explain why the user list fails to populate since it’s possible that now the Gateway is only passing the Gateway username without the automatic domain suffix.