# Multiple roles based on location

**URL:** <https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464>\
**Category:** Ignition\
**Tags:** security\
**Created:** [August 31, 2021, 12:05pm UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464 "2021-08-31T12:05:08Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\
**Post date:** [September 1, 2021, 8:05am UTC](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464/12 "2021-09-01T08:05:53Z")

</div>

[https://docs.inductiveautomation.com/display/DOC81/Security+Levels](https://docs.inductiveautomation.com/display/DOC81/Security+Levels)

I'm pretty sure you'll need to set your Vision client to use the Identity Provider auth strategy in order for Roles for a user to actually be recognised by the Security Levels system.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/2/12e879db7447d20aef0ee58f988bf75f02c008b9.png)

You can configure Security Zones to define your locations based on IP address(es), and then combine that with Security Levels -\> Authenticated -\> Roles -\> e.g. Administrator

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/9/090ea723715774af88058c7ec3456b4e61911ce6.png)

I haven't actually used these yet myself, but you can restrict tag writes (and reads) using security zones and/or roles. Just note that I don't think these will "disable" the component the tag is used on, it will simply bring up an error popup if the user doesn't have the right privilege/area, which is one reason I haven't started using these...

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/9/692e3400df660b86c32b6782b8a2c3aae6c5d775.png)

You can also supposedly use the `hasRole` expression function to read the security zone and role from the logged in user.

> [@How to determine current Security Zone](https://forum.inductiveautomation.com/t/how-to-determine-current-security-zone/14246/7):
>
> Yeah, it’s in there, but only for the new client security settings added in 7.9.4 (Project Properties / Client / Permissions) We still need to backport the concept into the component security settings.

You'll see my post there saying I couldn't get it working, but I don't think i'd changed my auth strategy to IdP for Vision when I tested it. Actually, this option didn't even exist back in v7.9.4....

@Carl.Gould, any tips or comments?

What I do currently is bind each component's `enabled` property to an expression that uses:

- `hasRole` to check if a user has a particular role (administrator, operator, engineer, etc.) and
- if I need to restrict by area as well, I add another condition that looks at a vision client tag (or session custom prop) that is defined for each HMI, e.g. `[client]Security Zones/Packaging/Filtration/South Wall HMI`:

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/0/6072def9f98f4a5abc7e9ce553e17ac4496ef6de.png)  
 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/5/b5636e2fc527058d92d8a3555ea139803e4a597c.png)

---

_[View the full topic](https://forum.inductiveautomation.com/t/multiple-roles-based-on-location/50464)._