# Locked out - urgent **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [September 22, 2020, 5:08pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943 "2020-09-22T17:08:35Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![vipo](https://avatars.discourse-cdn.com/v4/letter/v/eada6e/32.png) [@vipo](https://forum.inductiveautomation.com/u/vipo)\ **Post date:** [September 22, 2020, 5:08pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/1 "2020-09-22T17:08:35Z")
So I was messing around with Identity Providers… And somehow, I’m now locked out of the gateway. Is there a way to set the IDP back to default, through CLI or some xml config file on the gateway itself ? Please help… this is urgent ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [September 22, 2020, 5:11pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/2 "2020-09-22T17:11:34Z")
[https://docs.inductiveautomation.com/display/DOC80/Gateway+Command-line+Utility#GatewayCommand-lineUtility-ResetthePassword](https://docs.inductiveautomation.com/display/DOC80/Gateway+Command-line+Utility#GatewayCommand-lineUtility-ResetthePassword) ---
**Author:** ![vipo](https://avatars.discourse-cdn.com/v4/letter/v/eada6e/32.png) [@vipo](https://forum.inductiveautomation.com/u/vipo)\ **Post date:** [September 22, 2020, 5:17pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/5 "2020-09-22T17:17:21Z")
that did however solve the problem… I was under the impression that it only reset the password… but appearently it made a temp IDP also… thanks for the help ---
**Author:** ![drewdin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/drewdin/32/3363_2.png) [@drewdin](https://forum.inductiveautomation.com/u/drewdin)\ **Post date:** [January 20, 2022, 2:29pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/6 "2022-01-20T14:29:16Z")
I’m in the same boat, they say temp but I cant remove them. what did you end up doing? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 20, 2022, 2:33pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/7 "2022-01-20T14:33:52Z")
After you reset the credentials, and re-commission, your gateway web interface’s security is set to the temporary identity provider & user source. You have to fix your original user source to allow you to log in, and change the gateway to use it again. When the temporary source isn’t used anywhere, then you should be able to remove it. (Including logging back into the gateway with the corrected original user source.) ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [January 20, 2022, 3:11pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/8 "2022-01-20T15:11:33Z")
We decided a good strategy was to have the IdP do a soft failover to Ignition’s default provider and have the Administrator in there so that if anything happens the IdP we can still get in to fix it. It works. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 20, 2022, 3:29pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/9 "2022-01-20T15:29:10Z")
> [@Transistor](#): > > do a soft failover to Ignition’s default provider My clients all do this too, so they can put contractors in the default provider instead of giving them domain accounts. ---
**Author:** ![drewdin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/drewdin/32/3363_2.png) [@drewdin](https://forum.inductiveautomation.com/u/drewdin)\ **Post date:** [January 21, 2022, 1:28am UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/10 "2022-01-21T01:28:59Z")
Thanks, I missed changing it in the general section of identity providers. I’m good now! ---
**Author:** ![Gabriel\_de\_la\_Cruz](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Gabriel\_de\_la\_Cruz](https://forum.inductiveautomation.com/u/Gabriel_de_la_Cruz)\ **Post date:** [February 3, 2022, 10:05pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/11 "2022-02-03T22:05:06Z")
> [@Transistor](#): > > IdP do a soft failover Is there a tutorial on how to set the failover for IdP? ---
**Author:** ![kvane](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kvane/32/22228_2.png) [@kvane](https://forum.inductiveautomation.com/u/kvane)\ **Post date:** [February 3, 2022, 10:47pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/12 "2022-02-03T22:47:57Z")
The Failover User Source is a setting on the User Source that the IdP is using, so it can be a little confusing to find. First navigate to your IdP settings (Config \> Security \> Identity Providers) and note the User Source it is using. Then navigate to the User Source (Config \> Security \> User Sources) and edit it. Here you will find the two settings needed for failover: “Failover Source” and “Failover Mode”. As others have noted it is common practice to set the Failover Source to the default Internal User Source with a soft Failover Mode. ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [February 3, 2022, 10:56pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/13 "2022-02-03T22:56:03Z")
Try this: ![Ignition IdP config](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/7/87c1fe1262f0e5c1b3a84f8e76af8df29b366637.png) Then create a user source: ![Ignition user source](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/5/7554c44f83287bdebf3efa5e7f23c80d8e046d9a.png) and further down the page … ![Ignition user source 2](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/d/3da422a6f6d5d9829968cc6089ae885248c110be.png) 1. Your company’s domain name. 2. Get this from your IT department. 3. Same. 4. You’ll need a service account set up so that Ignition can log in to Active Directory to check credentials. 5. Set the password. 6. … 7. … 8. SSO option. 9. In my case it was essential that this was in capital letters. ---
**Author:** ![edward.fowler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/edward.fowler/32/24179_2.png) [@edward.fowler](https://forum.inductiveautomation.com/u/edward.fowler)\ **Post date:** [June 24, 2024, 8:03pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/14 "2024-06-24T20:03:32Z")
> [@kvane](#): > > First navigate to your IdP settings (Config \> Security \> Identity Providers) and note the User Source it is using v8.1.41 @kvane I'm setting up an OpenID Connect IdP. I don't see any configuration for setting the User Source (in my case Ignition default). Suggestions? Thank you. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 24, 2024, 8:05pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/15 "2024-06-24T20:05:19Z")
No such thing. IdP's cannot do failover. Ignition user sources can do failover, and Ignition's native IdP can point at any such user source. IdPs cannot be configured to do failover. Any such would have to supported by the IdP itself. Recent similar topic: > [@IdP failover from Entra SSO to AD?](https://forum.inductiveautomation.com/t/idp-failover-from-entra-sso-to-ad/92184): > > Our gateways are set up to use Active Directory for the IdP. I'd like to get our gateways set up to use SAML but can't risk locking users out if there's no internet connection. Is there a way to set an IdP failover from a SAML user source (Entra SSO) to AD? ---
**Author:** ![edward.fowler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/edward.fowler/32/24179_2.png) [@edward.fowler](https://forum.inductiveautomation.com/u/edward.fowler)\ **Post date:** [June 25, 2024, 12:07pm UTC](https://forum.inductiveautomation.com/t/locked-out-urgent/38943/16 "2024-06-25T12:07:33Z")
@pturmel I didn't think so. Thanks Phil !