# Mixed (up) Security Model **URL:** \ **Category:** Ignition\ **Created:** [July 18, 2011, 11:37pm UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108 "2011-07-18T23:37:02Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jkramer](https://avatars.discourse-cdn.com/v4/letter/j/35a633/32.png) [@jkramer](https://forum.inductiveautomation.com/u/jkramer)\ **Post date:** [July 18, 2011, 11:37pm UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108/1 "2011-07-18T23:37:02Z")
Hi All, I need to have all clients auto login to a project, while allowing a few power users (authenticated via AD) to make some changes at runtime. What I’m thinking is I would have everyone auto login, but then for those that need to make changes, have them click a login button which would prompt them for a username and password that would be authenticated against AD. A “logout” button would then login the auto-login user. Is that possible, and if so how? Thanks in advance for any help! ---
**Author:** ![Travis.Cox](https://avatars.discourse-cdn.com/v4/letter/t/b9bd4f/32.png) [@Travis.Cox](https://forum.inductiveautomation.com/u/Travis.Cox)\ **Post date:** [July 19, 2011, 12:38am UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108/2 "2011-07-19T00:38:28Z")
Yes, that is possible using the system.security.switchUser function. Once you auto-login you can call that function with another valid username and password and the client will reload. If you want to logout just switch it back to the auto-login username and password. There is an example window in our Example project: [inductiveautomation.com/downloads/extras](http://inductiveautomation.com/downloads/extras) that you can copy into your project. It basically opens a switch user window allowing the user to enter in a username and password. It calls the system.security.switchUser function when the user presses ok. The function will let you know whether or not the username and password is valid. ---
**Author:** ![jkramer](https://avatars.discourse-cdn.com/v4/letter/j/35a633/32.png) [@jkramer](https://forum.inductiveautomation.com/u/jkramer)\ **Post date:** [July 19, 2011, 2:37pm UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108/3 "2011-07-19T14:37:52Z")
Thanks Travis. That’s good information. But I think in my mind I’m mixing two authentication profiles - ADHybrid for the “power” users and default for the auto-login. What Authentication Profile do I choose for the project to allow both? ---
**Author:** ![Travis.Cox](https://avatars.discourse-cdn.com/v4/letter/t/b9bd4f/32.png) [@Travis.Cox](https://forum.inductiveautomation.com/u/Travis.Cox)\ **Post date:** [July 19, 2011, 3:41pm UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108/4 "2011-07-19T15:41:14Z")
You can choose either the ADHybrid or the default as the authentication profile for the project. Whichever one you select first needs to failover to the second. So for example if you attach the default authentication profile to the project it will try to use that one first. You can set the default profile to failover to the ADHybrid profile which a failover mode set to soft. That way it will try the first profile and if the username and password don’t exist it will try the second profile. In your case the default may only have one username and password which is used as the auto-login. Hope this helps. ---
**Author:** ![jkramer](https://avatars.discourse-cdn.com/v4/letter/j/35a633/32.png) [@jkramer](https://forum.inductiveautomation.com/u/jkramer)\ **Post date:** [July 19, 2011, 5:51pm UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108/5 "2011-07-19T17:51:16Z")
Worked like a charm. Thanks Travis! ---
**Author:** ![dion.botha](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dion.botha](https://forum.inductiveautomation.com/u/dion.botha)\ **Post date:** [December 7, 2018, 7:09pm UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108/6 "2018-12-07T19:09:13Z")
> [@Travis.Cox](#): > > lt authentication profile to the project it will try to use that one first. You can set the default profile to failover to the ADHybrid profile which a failover mode set to soft. That way it will try the first profile and if the username and password don't exist it How then do you set up security in the designer? I can't see the roles associated with the failover authentication profile... Maybe I need to duplicate the name of each role I want in the failover profile in the primary profile? ---
**Author:** ![Travis.Cox](https://avatars.discourse-cdn.com/v4/letter/t/b9bd4f/32.png) [@Travis.Cox](https://forum.inductiveautomation.com/u/Travis.Cox)\ **Post date:** [December 7, 2018, 7:29pm UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108/7 "2018-12-07T19:29:40Z")
> [@dion.botha](#): > > Maybe I need to duplicate the name of each role I want in the failover profile in the primary profile? Yes, we only show the roles for the primary user source. You should add all of the possible roles in there so you can select from that in the designer. ---
**Author:** ![dion.botha](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dion.botha](https://forum.inductiveautomation.com/u/dion.botha)\ **Post date:** [December 10, 2018, 5:04pm UTC](https://forum.inductiveautomation.com/t/mixed-up-security-model/3108/8 "2018-12-10T17:04:39Z")
Thanks Travis, I am still having a small issue that I have posted here, would really appreciate if you could take a look. > [@Multiple User Sources - Failover roles not fully coming through](http://forum.inductiveautomation.com/t/multiple-user-sources-failover-roles-not-fully-coming-through/21314): > > Hi guys, I am trying to setup a login architecture that uses 3 user sources. AD Hybrid (project user source) which soft fails over to Database which soft fails over to Internal (guest user) I have this working fine in that users from both sources can log into my project except the security isn’t working correctly… For a user that falls into the database user source, I have assigned a particular role that I have duplicated in the AD Hybrid user source. I can see this user along with this rol…