# Multiple roles based on location **URL:** \ **Category:** Ignition\ **Tags:** security\ **Created:** [August 31, 2021, 12:05pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464 "2021-08-31T12:05:08Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Thomas\_Putteman](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@Thomas\_Putteman](https://forum.inductiveautomation.com/u/Thomas_Putteman)\ **Post date:** [August 31, 2021, 12:05pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/1 "2021-08-31T12:05:08Z")
Hi all, I am creating different user accounts in my Ignition gateway. In the beginning it was easy: every user had one role. In the designer, I could enable/disable all functions based on the security option on the different components. No problems there. I am in the stage where I want to give multiple roles to one user. Based on the location/laptop the client is logged in, I want to give him a certain role. For example: - George is an administrator. He has his own desktop and when he logs in, he has the Administrator role. - When George needs to go to a different location, and he logs in on a different computer with the same account, I don’t want to give him the role of Administrator, but only as an operator. I know that I can check the hostname/ipaddress and stuff like that. But I am not sure how I can assign a “lesser” role in stead of the Administrator role. I tried working with Security Zones, but I don’t think that this will fix my problem. I have different Desktops that access the gateway, but only one gateway. The application is made in Vision. Any advice on how to do this best? Thanks in advance! ---
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [August 31, 2021, 12:30pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/2 "2021-08-31T12:30:39Z")
i think there is an option to set “must have all roles” not sure if its good practice to lock out admins based on locations tho… edit: seems to be “must match all security levels” ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/a/0/a0321537dd913c998fb42fa89fde7b5653522c05.png) ---
**Author:** ![Thomas\_Putteman](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@Thomas\_Putteman](https://forum.inductiveautomation.com/u/Thomas_Putteman)\ **Post date:** [August 31, 2021, 12:31pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/3 "2021-08-31T12:31:17Z")
Maybe I posted this a little bit to soon. Can I try working with security levels? I have no experience with that but gues I can do it ---
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [August 31, 2021, 12:39pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/4 "2021-08-31T12:39:19Z")
xd typed same time it seems ---
**Author:** ![Thomas\_Putteman](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@Thomas\_Putteman](https://forum.inductiveautomation.com/u/Thomas_Putteman)\ **Post date:** [August 31, 2021, 12:57pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/5 "2021-08-31T12:57:02Z")
Where could I find this option? ---
**Author:** ![Thomas\_Putteman](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@Thomas\_Putteman](https://forum.inductiveautomation.com/u/Thomas_Putteman)\ **Post date:** [August 31, 2021, 1:00pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/6 "2021-08-31T13:00:18Z")
Also, I do not want to shut out Administrator (it was a bad example). So I give a certain user different roles, and depending on its location, I want to assign it one of the roles that it has in its list ---
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [August 31, 2021, 1:14pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/7 "2021-08-31T13:14:59Z")
you should be able to find this on every place you put security xd like scripts or views itself ---
**Author:** ![Thomas\_Putteman](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@Thomas\_Putteman](https://forum.inductiveautomation.com/u/Thomas_Putteman)\ **Post date:** [August 31, 2021, 3:18pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/8 "2021-08-31T15:18:43Z")
So I’m not able to get this done at the moment. I’m starting to wonder it this is possible or not? ---
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [September 1, 2021, 6:31am UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/9 "2021-09-01T06:31:31Z")
how did you enable the single role security? it should be possible ---
**Author:** ![Thomas\_Putteman](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@Thomas\_Putteman](https://forum.inductiveautomation.com/u/Thomas_Putteman)\ **Post date:** [September 1, 2021, 6:56am UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/10 "2021-09-01T06:56:43Z")
I think that you are working on Perspective projects? There I can use the security levels. In Vision this is not possible I think. ---
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [September 1, 2021, 7:14am UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/11 "2021-09-01T07:14:38Z")
ah idk how security works in vision, havent used it to that extend there. you could call up the user roles through script tho. and check it all or any are in a predefined role array… ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [September 1, 2021, 8:05am UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/12 "2021-09-01T08:05:53Z")
[https://docs.inductiveautomation.com/display/DOC81/Security+Levels](https://docs.inductiveautomation.com/display/DOC81/Security+Levels) I'm pretty sure you'll need to set your Vision client to use the Identity Provider auth strategy in order for Roles for a user to actually be recognised by the Security Levels system. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/2/12e879db7447d20aef0ee58f988bf75f02c008b9.png) You can configure Security Zones to define your locations based on IP address(es), and then combine that with Security Levels -\> Authenticated -\> Roles -\> e.g. Administrator ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/9/090ea723715774af88058c7ec3456b4e61911ce6.png) I haven't actually used these yet myself, but you can restrict tag writes (and reads) using security zones and/or roles. Just note that I don't think these will "disable" the component the tag is used on, it will simply bring up an error popup if the user doesn't have the right privilege/area, which is one reason I haven't started using these... ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/9/692e3400df660b86c32b6782b8a2c3aae6c5d775.png) You can also supposedly use the `hasRole` expression function to read the security zone and role from the logged in user. > [@How to determine current Security Zone](https://forum.inductiveautomation.com/t/how-to-determine-current-security-zone/14246/7): > > Yeah, it’s in there, but only for the new client security settings added in 7.9.4 (Project Properties / Client / Permissions) We still need to backport the concept into the component security settings. You'll see my post there saying I couldn't get it working, but I don't think i'd changed my auth strategy to IdP for Vision when I tested it. Actually, this option didn't even exist back in v7.9.4.... @Carl.Gould, any tips or comments? What I do currently is bind each component's `enabled` property to an expression that uses: - `hasRole` to check if a user has a particular role (administrator, operator, engineer, etc.) and - if I need to restrict by area as well, I add another condition that looks at a vision client tag (or session custom prop) that is defined for each HMI, e.g. `[client]Security Zones/Packaging/Filtration/South Wall HMI`: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/0/6072def9f98f4a5abc7e9ce553e17ac4496ef6de.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/5/b5636e2fc527058d92d8a3555ea139803e4a597c.png) ---
**Author:** ![Thomas\_Putteman](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@Thomas\_Putteman](https://forum.inductiveautomation.com/u/Thomas_Putteman)\ **Post date:** [September 1, 2021, 11:18am UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/13 "2021-09-01T11:18:53Z")
Hi nminchin, Thank you for your input! If it will bring up an error pop-up, I won’t use it aswell. I am creating something else here so I can store the role in a client tag. Seems to work for now. Then I connect the enabled en visible properties to an expression, similar as you did. I was just hoping there would be an easier way. But it has to do like this i guess 🙂 BR ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [September 1, 2021, 11:27am UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/14 "2021-09-01T11:27:35Z")
I would suggest that you create a client tag for each of your roles, bind them to a expression with hasRole, and then you have the client tags you can reference as Booleans, Instead of having to compare strings all the time. It makes more complex expressions simpler and reduces the chance for errors ---
**Author:** ![Thomas\_Putteman](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@Thomas\_Putteman](https://forum.inductiveautomation.com/u/Thomas_Putteman)\ **Post date:** [September 1, 2021, 12:00pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/15 "2021-09-01T12:00:31Z")
Great advice! Thank your very much