# Move to AD user source to OpenID identity provider

**URL:** <https://forum.inductiveautomation.com/t/move-to-ad-user-source-to-openid-identity-provider/107024>\
**Category:** Ignition\
**Tags:** ignition81, perspective\
**Created:** [June 4, 2025, 2:35pm UTC](https://forum.inductiveautomation.com/t/move-to-ad-user-source-to-openid-identity-provider/107024 "2025-06-04T14:35:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fsallan](https://avatars.discourse-cdn.com/v4/letter/f/7ba0ec/32.png) [@fsallan](https://forum.inductiveautomation.com/u/fsallan)\
**Post date:** [June 4, 2025, 2:35pm UTC](https://forum.inductiveautomation.com/t/move-to-ad-user-source-to-openid-identity-provider/107024/1 "2025-06-04T14:35:54Z")

</div>

Hello,

I have a perspective project with Igniton 8.1.43. For user authentication we are using an AD/Internal Hybrid (user\_AD) user source and a internal user source as AD failover (user\_internal). In addition, we synchronise user\_internal from user\_AD sources by scripting.

The perspective project is setup with an automatically generated identity provider user\_AD and the user source user\_AD.

Now we want to move to an OpenId Identity provider, but we expect to maintain the roles defined in user sources.

We have some doubt about the use of OpenID identity provider:

1. Is it feasible match OpenID users with an internal usersource automatically or using scripting. Some views and actions in perspective are checking user roles.
2. What happens if the identity provider fails? How can we use the internal user source as failover?
3. Actually, we have set some users (administrators or API users) only on internal user source because these are internal users and not are include on Active Directory. If we move to OpenID IdP, can this user login to perspective project?

Many thanks in advance

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [June 4, 2025, 4:18pm UTC](https://forum.inductiveautomation.com/t/move-to-ad-user-source-to-openid-identity-provider/107024/2 "2025-06-04T16:18:01Z")

</div>

1. No idea. If OpenID has an API, then probably yes.

2. No. Only an internal Identity Provider can fail over, as that is a property of the user source. Identity providers themselves have no failover functionality at all.

3. No.

---

<div class="post-metadata">

**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\
**Post date:** [June 4, 2025, 4:23pm UTC](https://forum.inductiveautomation.com/t/move-to-ad-user-source-to-openid-identity-provider/107024/3 "2025-06-04T16:23:56Z")

</div>

As @pturmel said on everything, you're going to be at the mercy of the IdP you use. If you need to maintain some internal users, you're going to have to use project inheritance to have one project use the internal IdP and the other use the external IdP. You'll have to use security levels and mapping to get them to both line up to the same `Authenticated/Roles/whatever` roles though to make your life easier (you did use the `isAuthorized()` function and not `hasRole()` right?)