# Odd hasRole behavior firing off more than expected in a client tag? **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [November 4, 2026, 1:32pm UTC](https://forum.inductiveautomation.com/t/odd-hasrole-behavior-firing-off-more-than-expected-in-a-client-tag/117734 "2026-11-04T13:32:24Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [November 4, 2026, 1:32pm UTC](https://forum.inductiveautomation.com/t/odd-hasrole-behavior-firing-off-more-than-expected-in-a-client-tag/117734/1 "2026-11-04T13:32:24Z")
Using 8.1.47. Had a situation where I setup client tags like `isAdmin` `isOperator` `isViewer` where I made expressions like ```python //in designer {[System]Client/System/SystemsFlag=1 || //or actual check (hasRole({[.]rolesPrefix}+'admin', {[System]Client/User/Username}), {[System]Client/System/UserSource}) && {[.]../EffectiveUserName}!='') ``` where rolesPrefix is just a string constant used since this is relating to a AD User source and this project will be on different plants with differnet prefixes. `[.]../EffectiveUserName` is just checking if the username matches the autologin user (via a client tag that is a hardcoded string) by `if({[.]isLoggedIn, {[System]Client/User/Username}, '')` where isLogged in is just the comparison to the string constant tag. When we were developing this initially we had issues with some slowness and the `hasRole` and I fixed that by changing the AD Connection referral policy to ignore and that was sufficient then. Now the computers on site and it is suffering the same issues with the same policy still in place so its a legitimate connection latency issue. What I don't understand is its happening while users are still logged in, or even if the auto user is just logged in. I would have expected `hasRole` to only execute on any user change but i was getting WatchDogEDT's every 2-3 minutes and some really bad freezing. I fixed by changing `hasRole({[.]rolesPrefix}+'admin', {[System]Client/User/Username})` to `indexOf({[System]Client/User/RolesString, {[.]rolesPrefix}+'admin')>-1` and the issue is completely gone now. I am just confused. Why was the hasRole constantly executing outside of user login/logouts? This expected behvaior to check if roles changed ont he AD side? Though then why doesn't the RolesString method suffer from the same issue. ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [November 4, 2026, 1:59pm UTC](https://forum.inductiveautomation.com/t/odd-hasrole-behavior-firing-off-more-than-expected-in-a-client-tag/117734/2 "2026-11-04T13:59:38Z")
I've never had that issue, but did have an issue with the AD logins causing the EDT watchdog error so I changed over to using an asynchronous login now and that problem went away. For hasRole I use the short version with just the role name. I do like your idea of the prefix and may try it out today to simplify setting that up per site. The only thing I do to trigger the tag to re-evaluate is check if the username is not blank after an && so that it always evaluates as true but triggers on every login. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [November 4, 2026, 2:07pm UTC](https://forum.inductiveautomation.com/t/odd-hasrole-behavior-firing-off-more-than-expected-in-a-client-tag/117734/3 "2026-11-04T14:07:12Z")
> [@michael.flagler](#): > > I've never had that issue, but did have an issue with the AD logins causing the EDT watchdog error so I changed over to using an asynchronous login now and that problem went away. Yea this was my second idea to try I was just trying to avoid scripting if I didn't need it. Right I just don't get _why_ my expression was re-triggering so often. I guess maybe some other part of it is causing this, and hasRole reaches out to the AD directly while indexOf / RolesString is only updated on login. But I don't see why. I can't imagine the SystemFlag is changing at all within the vision client, and my other parts of the expression just string comparing the current username to hardcoded autoloign username. I guess I could write a tag change script to log any changes and I could probably figure it out but its working now and is on site so I don't want to go through that. This isn't an ongoing problem so nothing urgent but I do dislike not understanding why it was not working as expected before. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [November 4, 2026, 6:22pm UTC](https://forum.inductiveautomation.com/t/odd-hasrole-behavior-firing-off-more-than-expected-in-a-client-tag/117734/4 "2026-11-04T18:22:34Z")
Amusingly, I thought I remembered something like this but it was the exact inverse problem; `hasRole` not firing often enough: > [@Client tag expression with hasRole NPE](https://forum.inductiveautomation.com/t/client-tag-expression-with-hasrole-npe/100483): > > I've got a weird issue, and I'm not sure if this is because of my usage or if there is an actual problem going on here. I want to use a Vision Client tag to generate some bit based on the current user roles. IE if the user has the "Operator" role then we will turn on a client tag so that it can be easily tweaked down the road. The expression that I'm using is: hasRole('Operator',{[System]Client/User/Username}) The User Source I'm using has a failover to another user source. The main user so… Nothing code-wise has changed in between, especially not in 8.1, so I can't really explain it. If you send a report in to support they'd probably investigate further. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [November 4, 2026, 7:50pm UTC](https://forum.inductiveautomation.com/t/odd-hasrole-behavior-firing-off-more-than-expected-in-a-client-tag/117734/5 "2026-11-04T19:50:30Z")
I did see that post and it was where I got the `indexOf` solution. I too also have a user source with a failover, though my primary is the AD and the failover is a database one. Yea I will send some information over. Thanks!