# Single Sign On across Ignition Gateways using Active Directory **URL:** \ **Category:** Ignition\ **Tags:** perspective, ignition81\ **Created:** [January 14, 2026, 5:43pm UTC](https://forum.inductiveautomation.com/t/single-sign-on-across-ignition-gateways-using-active-directory/113295 "2026-01-14T17:43:25Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![parker.williams](https://avatars.discourse-cdn.com/v4/letter/p/f04885/32.png) [@parker.williams](https://forum.inductiveautomation.com/u/parker.williams)\ **Post date:** [January 14, 2026, 5:43pm UTC](https://forum.inductiveautomation.com/t/single-sign-on-across-ignition-gateways-using-active-directory/113295/1 "2026-01-14T17:43:25Z")
Hello, I need to set up Single Sign On using Active Directory across Ignition gateways and projects within those gateways. Currently I only have access to two gateways. One is on my computer locally, and the other in a different location that I do not have physical access to. I am working on getting access to at minimum one other one for testing purposes. I have contacted my IT department to setup SSO on the locally hosted gateway, and from my understanding of the docs and the ticket I submitted, IT will give me OpenID connect or Oauth2 credentials to use for authentication. This could be a question for IT, but would the credentials given work for all of the gateways (including ones on different networks but under the same domain name), or would I need to get credentials for each gateway individually? Another question, is this set up possible? If it is, how exactly would I pass authentication to another gateway? I had a look at the docs and really the only thing I could find is gateway networks, but I am not sure what the correct way to do this is. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [January 14, 2026, 5:56pm UTC](https://forum.inductiveautomation.com/t/single-sign-on-across-ignition-gateways-using-active-directory/113295/2 "2026-01-14T17:56:11Z")
You don't (exactly) share auth between the two. Instead, you set up as many gateways as you have to point back to your central AD instance. When an end user needs to log in, they'll be automatically sent to the identity provider (AD in this case) to perform any login/authorization steps needed) - Ignition never sees the credentials. Then the identity provider redirects the user back to the gateway and essentially says "okay, Alice/Bob are allowed to login, here's the roles they have". > **[Identity Provider Authentication Workflow​ - Identity Provider Authentication...](https://www.docs.inductiveautomation.com/docs/8.3/platform/security/identity-provider-authentication-strategy#identity-provider-authentication-workflow)** > > An Identity Provider (IdP) offers a way for users to log in to Ignition using credentials stored outside of Ignition. An IdP creates, maintains, and manages identity (login) information while providing authentication services to Ignition. This... The actual process of setting up the IdPs is annoyingly convoluted, but usually something IT departments have a fair amount of experience with: > **[Configuring Identity Providers | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.3/platform/security/identity-provider-authentication-strategy/configuring-identity-providers)** > > Registering the Ignition Gateway ---
**Author:** ![tgarrison](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/tgarrison/32/80965_2.png) [@tgarrison](https://forum.inductiveautomation.com/u/tgarrison)\ **Post date:** [January 14, 2026, 10:12pm UTC](https://forum.inductiveautomation.com/t/single-sign-on-across-ignition-gateways-using-active-directory/113295/3 "2026-01-14T22:12:31Z")
> [@paul-griffith](#): > > The actual process of setting up the IdPs is annoyingly convoluted, but usually something IT departments have a fair amount of experience with: And they still suck at it... ---
**Author:** ![Chris\_Bingham](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Chris\_Bingham](https://forum.inductiveautomation.com/u/Chris_Bingham)\ **Post date:** [January 14, 2026, 11:11pm UTC](https://forum.inductiveautomation.com/t/single-sign-on-across-ignition-gateways-using-active-directory/113295/4 "2026-01-14T23:11:00Z")
> [@parker.williams](#): > > IT will give me OpenID connect or Oauth2 credentials to use for authentication. If this is the case, you would set up a new Identity Provider, whereby the OIDC provider would handle the SSO across multiple gateways. While it’s possible to link OIDC with to an AD User Source (within Ignition), I recommend you work with IT to ensure that everything you need for authentication (especially user Roles) can be returned by the OIDC provider, and abandon the AD source.