# Security in Ignition. Is it possible to group the roles fetched from active directory and then create security levels in Ignition, which can be used for accessing gateway login

**URL:** <https://forum.inductiveautomation.com/t/security-in-ignition-is-it-possible-to-group-the-roles-fetched-from-active-directory-and-then-create-security-levels-in-ignition-which-can-be-used-for-accessing-gateway-login/108364>\
**Category:** Ignition\
**Tags:** security\
**Created:** [July 11, 2025, 11:35am UTC](https://forum.inductiveautomation.com/t/security-in-ignition-is-it-possible-to-group-the-roles-fetched-from-active-directory-and-then-create-security-levels-in-ignition-which-can-be-used-for-accessing-gateway-login/108364 "2025-07-11T11:35:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akhil\_Mattam](https://avatars.discourse-cdn.com/v4/letter/a/c77e96/32.png) [@Akhil\_Mattam](https://forum.inductiveautomation.com/u/Akhil_Mattam)\
**Post date:** [July 11, 2025, 11:35am UTC](https://forum.inductiveautomation.com/t/security-in-ignition-is-it-possible-to-group-the-roles-fetched-from-active-directory-and-then-create-security-levels-in-ignition-which-can-be-used-for-accessing-gateway-login/108364/1 "2025-07-11T11:35:12Z")

</div>

I am fetching the users and Roles from Active directory. Is it possible to create a security level and group the roles fetched from the active directory. so that i can easily create user access to Ignition gateway

---

<div class="post-metadata">

**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\
**Post date:** [July 11, 2025, 6:48pm UTC](https://forum.inductiveautomation.com/t/security-in-ignition-is-it-possible-to-group-the-roles-fetched-from-active-directory-and-then-create-security-levels-in-ignition-which-can-be-used-for-accessing-gateway-login/108364/2 "2025-07-11T18:48:51Z")

</div>

Yes, what I've done is created Vision Client tags (if you're using Perspective you can use Security Levels to map/group security groups to levels). The Vision client boolean expression tags have the following expression as an example:

```python
hasRole('Supervisor') || hasRole('AD-Group-Supervisor') ||
hasRole('Technician') || hasRole('AD-Group-Technician') ||
hasRole('Administrator') || hasRole('AD-Group-Admin') &&
{[System]Client/User/Username} != ''

```

The last line is required to get the expression to re-evaluate, and you just need to replace all the `hasRole()` functions with your groups from AD. Then to check security on any components, you can just tag those client tags directly. I also put all these role tags in a folder named "Role" but that's up to you how you want to organize it.

---

<div class="post-metadata">

**Author:** ![Akhil\_Mattam](https://avatars.discourse-cdn.com/v4/letter/a/c77e96/32.png) [@Akhil\_Mattam](https://forum.inductiveautomation.com/u/Akhil_Mattam)\
**Post date:** [July 14, 2025, 6:43am UTC](https://forum.inductiveautomation.com/t/security-in-ignition-is-it-possible-to-group-the-roles-fetched-from-active-directory-and-then-create-security-levels-in-ignition-which-can-be-used-for-accessing-gateway-login/108364/3 "2025-07-14T06:43:53Z")

</div>

ok.  
But is it possible to group the roles from active directory and create a security levels based the group to give permission for the users in that group to access Gateway config page and Designer access permission?

---

<div class="post-metadata">

**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\
**Post date:** [July 14, 2025, 12:47pm UTC](https://forum.inductiveautomation.com/t/security-in-ignition-is-it-possible-to-group-the-roles-fetched-from-active-directory-and-then-create-security-levels-in-ignition-which-can-be-used-for-accessing-gateway-login/108364/4 "2025-07-14T12:47:27Z")

</div>

If you're using any configuration that uses levels instead of roles, you can create rules to link the 2 together.

> **[Security Level Rules | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/platform/security/identity-provider-authentication-strategy/security-level-rules)**
>
> When a user accesses a project, they can fall into one or more of many Security Levels that you can set up. The Security Level Rules determine if the user has that Security Level or not. The rules come in the form of expressions that can access any...