# Security levels rules expressions **URL:** \ **Category:** Ignition\ **Created:** [November 23, 2024, 3:22pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037 "2024-11-23T15:22:34Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 23, 2024, 3:22pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/1 "2024-11-23T15:22:34Z")
I created a custom security level called "management" and i want roles in identity provider "default" called admin and operator to have this level of security , i typed 'containsAny({user:roles},'admin','operator')' but no response ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [November 23, 2024, 3:56pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/2 "2024-11-23T15:56:30Z")
What do you mean by no response? Have you tested a login with your IdP to make sure the roles you're expecting to receive from it match your security level rule/expression? How are you trying to use these security levels? ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 23, 2024, 5:04pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/3 "2024-11-23T17:04:23Z")
I am testing it by controlling write permission of a memory tag in designer and it gives me error(something like write access denied) in all custom levels ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [November 23, 2024, 6:58pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/4 "2024-11-23T18:58:09Z")
Does the user you're logged into the designer with belong to these roles or security levels you're testing? If not, it won't let you write to those tags. Designer permissions don't always mean you inherently have access to write tags also. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 24, 2024, 7:27pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/5 "2024-11-24T19:27:07Z")
Yes, i am logged in with admin role in same idp, ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [November 24, 2024, 7:35pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/6 "2024-11-24T19:35:27Z")
> [@Ahmed\_badawi1](#): > > ... but no response > [@Ahmed\_badawi1](#): > > ... and it gives me error ... That _is_ a response. > [@Ahmed\_badawi1](#): > > (something like write access denied) You need to be precise in describing the setup, what you expect and what you got. Otherwise it's going to be like pulling teeth to get the required information from you. Show your setup. > [@Ahmed\_badawi1](#): > > i typed 'containsAny({user:roles},'admin','operator')' Show **where** you put this. Use well-cropped screengrabs and post code where appropriate. Please see [Wiki - how to post code on this forum](https://forum.inductiveautomation.com/t/wiki-how-to-post-code-on-this-forum/77831). ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 24, 2024, 7:42pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/7 "2024-11-24T19:42:49Z")
Take it easy mr semi conductor, just i created some custom security levels and from identity provider section , i added security level rules expressions and it is not working , i just need to know how can i test these expressions to make sure it is properly written ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [November 24, 2024, 8:23pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/8 "2024-11-24T20:23:32Z")
Transistor is asking for screenshots of where you've put this. As I've asked, also test a login to the IdP to make sure the roles are exactly "admin" and "operator" when you login. Screenshots of this would help. Also screenshots of how you've configured security on your tags. The more information you provide, the more helpful everyone here can be, but when you're vague and not providing extra information when we ask for it, no one here will be able to help you out. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 24, 2024, 9:02pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/9 "2024-11-24T21:02:36Z")
Yes, i totally understand that, thanks for helping me in my problem, i will provide you with snips in near future ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 24, 2024, 9:06pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/10 "2024-11-24T21:06:31Z")
Just i am a bit confused with the security levels under 'authenticated/roles', how it is related to the idp roles ? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 24, 2024, 10:52pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/11 "2024-11-24T22:52:00Z")
Identity providers do **not** expose lists of known roles/groups. You only get roles **after** login, and only the ones that user possesses. Therefore, to use roles in security controls, you, the programmer, must **tell the gateway** what roles you expect to receive that are meaningful to design-time configuration. That's it. **You** must populate the gateway's authenticated roles with role names that you wish to use in security configuration elsewhere in the gateway. Because the gateway can't _automatically_ produce this information at design time. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 25, 2024, 8:04am UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/12 "2024-11-25T08:04:31Z")
![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/6/e6ab8dc698d6966b431e947ca7ecf93d92a4b0b9.png) yes, i used the custom security levels here in general security section and i had to reset the gateway password 3 times 😅 ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 25, 2024, 12:59pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/13 "2024-11-25T12:59:47Z")
You should open a support ticket and have IA look over your shoulder. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 25, 2024, 5:23pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/14 "2024-11-25T17:23:40Z")
Excuse me I didn't get what you mean ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 25, 2024, 5:31pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/15 "2024-11-25T17:31:02Z")
Visit IA Support's "Help Center" and open a ticket. Then an IA staff member can help you share your screen so they can see what is really wrong. Always recommended when this forum's _volunteers_ are at our wit's end. (This forum is **not** formal IA support.) ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 25, 2024, 7:19pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/16 "2024-11-25T19:19:28Z")
Ok, i just need to know how the security levels under 'authenticated/roles' related to idp roles, appreciate if you have explanation of how this system is designed ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [November 25, 2024, 8:07pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/17 "2024-11-25T20:07:17Z")
As previously mentioned, when using an IdP, roles come from the IdP. To see how they come in, you'll need to test the login of the IdP from the "More" button of the IdP on the Ignition Gateway page: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/5/258cb2d026cea4e7fcf54fb591c6b2e888e1d0b4.png) Once you login with this IdP (or if you're already logged in with it), you'll get the response with a list of roles like this: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/d/2db0f26fedf8c0872bb6ee666bc6ebae6e313bc3.png) Then if you click on the Security Level Grants page, you'll see how those roles come into your security levels like this: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/a/2a7041c77d02baef8c5c508162775ea6c9baa2d3.png) ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 25, 2024, 8:30pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/18 "2024-11-25T20:30:43Z")
Yes, thanks for clarification ---
**Author:** ![gilles.levesque](https://avatars.discourse-cdn.com/v4/letter/g/919ad9/32.png) [@gilles.levesque](https://forum.inductiveautomation.com/u/gilles.levesque)\ **Post date:** [November 28, 2024, 3:00pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/19 "2024-11-28T15:00:09Z")
I use an expression with hasRole() on Numeric fields Editable property and Enable property on PushButton and it work well. ---
**Author:** ![Ahmed\_badawi1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Ahmed\_badawi1](https://forum.inductiveautomation.com/u/Ahmed_badawi1)\ **Post date:** [November 30, 2024, 6:20pm UTC](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037/20 "2024-11-30T18:20:48Z")
![Screenshot_2024-11-30-16-14-13-77_40deb401b9ffe8e1df2f1cc5ba480b12](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/b/1ba19ffc59e86fef7582d89430a73fc084cb3361.jpeg) ![Screenshot_2024-11-30-16-13-21-43_40deb401b9ffe8e1df2f1cc5ba480b12](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/9/b962f2f162a59f955a3392f34bb0e9b5cb17e265.jpeg) That is what i am talking about and wanted to understand, the security levels under 'authenticated/roles' is related to idp roles by making its names identical [Next page](https://forum.inductiveautomation.com/t/security-levels-rules-expressions/99037.md?page=2)