# OIDC Failover to Active Directory Authentication via Gateway Configuration File

**URL:** <https://forum.inductiveautomation.com/t/oidc-failover-to-active-directory-authentication-via-gateway-configuration-file/116952>\
**Category:** Ignition\
**Tags:** ignition83\
**Created:** [August 31, 2026, 7:41pm UTC](https://forum.inductiveautomation.com/t/oidc-failover-to-active-directory-authentication-via-gateway-configuration-file/116952 "2026-08-31T19:41:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ksingh1](https://avatars.discourse-cdn.com/v4/letter/k/a9a28c/32.png) [@ksingh1](https://forum.inductiveautomation.com/u/ksingh1)\
**Post date:** [August 31, 2026, 7:41pm UTC](https://forum.inductiveautomation.com/t/oidc-failover-to-active-directory-authentication-via-gateway-configuration-file/116952/1 "2026-08-31T19:41:19Z")

</div>

Hi everyone,

I'm looking for guidance on implementing an authentication failover strategy in Ignition.

### Current Environment

- Ignition is configured to use **OIDC (OpenID Connect)** as the primary authentication provider.
- We also have **Active Directory** available as a secondary authentication source.
- Our goal is to maintain operator and engineering access if the OIDC provider becomes unavailable due to a network outage, IdP failure, or maintenance.

### Questions

1. Is it possible to configure Ignition to automatically fail over from OIDC authentication to Active Directory?
2. Can this behavior be defined through a gateway configuration file (e.g., `gateway.xml`, `.conf`, or other configuration files)?
3. Has anyone implemented a solution where:
  - OIDC is the primary authentication method
  - Active Directory is used automatically when OIDC is unavailable

4. If native failover is not supported, what is the recommended architecture for maintaining authentication availability?
5. Are there any security, licensing, or session-management implications to be aware of?

### Desired Behavior

```python
Normal Operation:
User → OIDC Provider → Ignition

OIDC Unavailable:
User → Active Directory → Ignition

```

I'm interested in both supported Ignition approaches and any real-world implementations that others have used in production environments.

Thanks in advance for any guidance or examples.

* * *

**Environment:**

- Ignition Version: 8.3
- Identity Provider: [Azure AD / Entra ID .]
- Active Directory: Microsoft AD
- Gateway Redundancy: Yes

Looking forward to hearing how others have addressed this requirement.

---

<div class="post-metadata">

**Author:** ![Bushmatic](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bushmatic/32/87014_2.png) [@Bushmatic](https://forum.inductiveautomation.com/u/Bushmatic)\
**Post date:** [September 1, 2026, 1:53am UTC](https://forum.inductiveautomation.com/t/oidc-failover-to-active-directory-authentication-via-gateway-configuration-file/116952/2 "2026-09-01T01:53:40Z")

</div>

No. Your only reasonably robust and achievable option is to put an identity broker in front of Ignition. You could look into Classic Authentication Strategy, but this doesn't work with Perspective -- almost certainly not an option. This has been a requested feature for a while:

> **[Ignition Security - Identity Provider Failover | Ignition Features and Ideas...](https://inductiveautomation.canny.io/ignition-features-and-ideas/p/ignition-security-identity-provider-failover)**
>
> We need the ability to specify a failover user source when our IDP can not be reached, i.e. the internal IDP. We have a Keycloak IDP configured and working

Identity broker examples...

Keycloak:

> **[Keycloak](https://www.keycloak.org/)**
>
> Keycloak - the open source identity and access management solution. Add single-sign-on and authentication to applications and secure services with minimum effort.

PingFederate:

> **[PingFederate](https://www.pingidentity.com/en/product/pingfederate.html)**
>
> PingFederate is an authentication authority that provides federated SSO capabilities for any identity and to any resource.