# Security Level Clarification **URL:** \ **Category:** Ignition\ **Tags:** vision\ **Created:** [August 11, 2023, 6:25pm UTC](https://forum.inductiveautomation.com/t/security-level-clarification/77771 "2023-08-11T18:25:39Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![kcui](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcui/32/51446_2.png) [@kcui](https://forum.inductiveautomation.com/u/kcui)\ **Post date:** [August 11, 2023, 6:25pm UTC](https://forum.inductiveautomation.com/t/security-level-clarification/77771/1 "2023-08-11T18:25:39Z")
Hi - I am a bit confused on a particular aspect of Gateway security. Hoping someone can shed some light. The example here is for illustrative purposes. It is my understanding that the Gateway uses Security Levels in the default (Ignition) Identity Provider to authenticate, and that roles had to be added to the Security Levels in order to work with a given IdP. When I go to _Security --\> General_ and for the settings "Gateway Config Permissions" and "Status Page Permissions", I see _Authenticated/Roles/Administrator_. I would then expect this role to be within the Security Levels page, but is it not. Similarly, if I create a new role called _roleGWAdmin_, add this role to the aforementioned settings, then create a new user and assign this role to them, that user is still able to log in despite not being in the Security Levels list. Am I misunderstanding how the Gateway checks users and roles? I'd like to understand this better because I plan on having a separate role for Gateway configuration and a different admin role for my Vision application (the latter using a Classic security approach). Thanks ---
**Author:** ![andrew.budaiev](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrew.budaiev/32/72921_2.png) [@andrew.budaiev](https://forum.inductiveautomation.com/u/andrew.budaiev)\ **Post date:** [August 12, 2023, 12:33am UTC](https://forum.inductiveautomation.com/t/security-level-clarification/77771/2 "2023-08-12T00:33:02Z")
When you logging into your Config Page Identity Provider will authenticate against a User Source. If your Roles were added to your User Source (which they've been) you will be authenticated. Your Roles still exist even if they are not visually visible in the Security Levels tab (that's my understanding) ---
**Author:** ![kcui](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcui/32/51446_2.png) [@kcui](https://forum.inductiveautomation.com/u/kcui)\ **Post date:** [August 12, 2023, 4:33am UTC](https://forum.inductiveautomation.com/t/security-level-clarification/77771/3 "2023-08-12T04:33:23Z")
> [@andrew.budaiev](#): > > Your Roles still exist even if they are not visually visible in the Security Levels tab (that's my understanding) Thanks. I think my confusion is when I would need roles to the Security Levels. It is stated (in the manuals and one of the training videos) that one needs to add them to ensure they match against what is in the Identity Provider. For the "default" internal Ignition IdP, I guess user roles do not need to be added to the Security Levels? In other words, this is only for external / non-Ignition IdPs? ---
**Author:** ![andrew.budaiev](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andrew.budaiev/32/72921_2.png) [@andrew.budaiev](https://forum.inductiveautomation.com/u/andrew.budaiev)\ **Post date:** [August 14, 2023, 5:46am UTC](https://forum.inductiveautomation.com/t/security-level-clarification/77771/4 "2023-08-14T05:46:57Z")
> [@kcui](#): > > I think my confusion is when I would need roles to the Security Levels. You will need them in the Security Levels for them to be visible in the Designer. But I agree it can be confusing and I'm not the best man on this topic 😔