OIDC Failover to Active Directory Authentication via Gateway Configuration File

Ignition
1

Hi everyone,

I'm looking for guidance on implementing an authentication failover strategy in Ignition.

Current Environment

  • Ignition is configured to use OIDC (OpenID Connect) as the primary authentication provider.
  • We also have Active Directory available as a secondary authentication source.
  • Our goal is to maintain operator and engineering access if the OIDC provider becomes unavailable due to a network outage, IdP failure, or maintenance.

Questions

  1. Is it possible to configure Ignition to automatically fail over from OIDC authentication to Active Directory?
  2. Can this behavior be defined through a gateway configuration file (e.g., gateway.xml, .conf, or other configuration files)?
  3. Has anyone implemented a solution where:
    • OIDC is the primary authentication method
    • Active Directory is used automatically when OIDC is unavailable
  4. If native failover is not supported, what is the recommended architecture for maintaining authentication availability?
  5. Are there any security, licensing, or session-management implications to be aware of?

Desired Behavior

Normal Operation:
User → OIDC Provider → Ignition

OIDC Unavailable:
User → Active Directory → Ignition

I'm interested in both supported Ignition approaches and any real-world implementations that others have used in production environments.

Thanks in advance for any guidance or examples.

Environment:

  • Ignition Version: 8.3
  • Identity Provider: [Azure AD / Entra ID .]
  • Active Directory: Microsoft AD
  • Gateway Redundancy: Yes

Looking forward to hearing how others have addressed this requirement.