# SSO or straight up LDAP user source? **URL:** \ **Category:** Ignition\ **Tags:** ignition79\ **Created:** [December 19, 2018, 6:35pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511 "2018-12-19T18:35:20Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![alfred\_dussault](https://avatars.discourse-cdn.com/v4/letter/a/dc4da7/32.png) [@alfred\_dussault](https://forum.inductiveautomation.com/u/alfred_dussault)\ **Post date:** [December 19, 2018, 6:35pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/1 "2018-12-19T18:35:20Z")
I’m relatively new to Ignition, and this may be covered already in the forums, but I couldn’t find a search function in the forums… so We will be moving to 2 factor authentication with PKI cards in the near future, and the passwords in AD will be changing -every day- to an unknown (to the user) value. If we turn on single sign on will that work in this scenario? (as long as they are logged into windows?) if not, is there a way to authenticate the users using a straight up LDAP server? thanks in advance for any assistance. Fred ---
**Author:** ![witman](https://avatars.discourse-cdn.com/v4/letter/w/d2c977/32.png) [@witman](https://forum.inductiveautomation.com/u/witman)\ **Post date:** [December 20, 2018, 12:12am UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/2 "2018-12-20T00:12:42Z")
I don’t have the answer to your question, but if the forum looks anything like it does on my browser on your browser, tap the magnifying glass near top right to bring up a search box like this: ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/5/598b644c1d4286e4a416c9cf8f1eeafd7a5bd805.png) ---
**Author:** ![alfred\_dussault](https://avatars.discourse-cdn.com/v4/letter/a/dc4da7/32.png) [@alfred\_dussault](https://forum.inductiveautomation.com/u/alfred_dussault)\ **Post date:** [December 20, 2018, 1:57pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/3 "2018-12-20T13:57:48Z")
aahh yes, different browser does the trick… Thanks for the tip. Hopefully I can find, or receive some help on the original intent of my OP. Thanks again. ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [December 20, 2018, 1:59pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/4 "2018-12-20T13:59:39Z")
There is a way to authenticate users using an LDAP server. We use our AD as a user source. ---
**Author:** ![alfred\_dussault](https://avatars.discourse-cdn.com/v4/letter/a/dc4da7/32.png) [@alfred\_dussault](https://forum.inductiveautomation.com/u/alfred_dussault)\ **Post date:** [December 20, 2018, 2:05pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/5 "2018-12-20T14:05:23Z")
I’m very familiar with using ldap queries against Active directory. (I have extensive scripting experience) However, I know the schema’s between active directory, and say dirsrv-389 LDAP are very different, and the queries that are required are similar, but different enough to -not work-. hence the question. edit: If you know of a way to use something like dirsrv-389 as a user source, I’d be happy to give it a go. Thanks! ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [December 20, 2018, 4:37pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/6 "2018-12-20T16:37:19Z")
I guess it depends on how much of the heavy lifting you want to do. You seemed to indicate that you were using Active Directory so perhaps that was a poor assumption on my part. That said it is possible to tailor the Active Directory User source to connect to other LDAP servers, so long as you understand that it was intended to work with AD. Here are a couple of links where other people have been successful doing such things, they are a little dated. > [@Role Search filter for LDAP Authentification](http://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705): > > I try to configure Ignition to use LDAP Authentification. Ignition v7.5.5 The LDAP is openDS version 2.2 Users and Roles are configured as follows : in openDS : in Ignition : Username Prefix : uid= Username Suffix : ,ou=utilisateurs,dc=itinisere,dc=fr User Search Base : dc=itinisere,dc=fr ser Search Filter : (&(objectClass=utilisateur)(uid={0})) User Name Attribute : uid User Name Attribute : Role Name Attribute : cn Role Search Base : Role Search Filter : (&(objectClass=groupOf… > [@LDAP Integration](http://forum.inductiveautomation.com/t/ldap-integration/7086): > > Hi All We’re running the 389 ([http://en.wikipedia.org/wiki/389\_Directory\_Server](http://en.wikipedia.org/wiki/389_Directory_Server)) LDAP server on Linux and I’m trying to set up a LDAP connection for Ignition. Has anybody managed to do it? There seem to be a couple of issues using the “Active Directory” LDAP setup when trying to connect to a 389/Redhat LDAP server: The Ignition setup seems to expect a property on the users that links them to roles (User Role Attribute). In our setup the property is on the group using the memberUid (using t… ---
**Author:** ![alfred\_dussault](https://avatars.discourse-cdn.com/v4/letter/a/dc4da7/32.png) [@alfred\_dussault](https://forum.inductiveautomation.com/u/alfred_dussault)\ **Post date:** [January 16, 2019, 2:25pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/7 "2019-01-16T14:25:14Z")
I think I’ll start another thread for this. Hi, Thanks for your responses. I was able to get the user authentication source working against our dirsrv-389 ldap instance with your help. Now I’m running into a different issue and I’m hoping there is a work around. all of our UID’s in ldap are numeric. So while I can authenticate successfully using the “Test authentication profile” it won’t let me use the numbers due to Ignitions limitation on user names starting with a number. so my question is this. there are other attributes that are unique in ldap that I can use to find users. email or whatever. but I can’t seem to get the right stuff put together to authenticate successfully. so what I want to do is use some other ldap attribute as the ignition username, and still be able to authenticate. Has anyone been able to accomplish that? Thanks, Fred ---
**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\ **Post date:** [January 17, 2019, 2:46pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/8 "2019-01-17T14:46:00Z")
Under advanced settings for the user source you can specify which LDAP attribute is used as the username. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/9/9f3d1c9e86a7c5dbdb1957278c0fd7728256592c.png) ---
**Author:** ![alfred\_dussault](https://avatars.discourse-cdn.com/v4/letter/a/dc4da7/32.png) [@alfred\_dussault](https://forum.inductiveautomation.com/u/alfred_dussault)\ **Post date:** [January 17, 2019, 3:07pm UTC](https://forum.inductiveautomation.com/t/sso-or-straight-up-ldap-user-source/21511/9 "2019-01-17T15:07:33Z")
Hi, unfortunately, it doesn't work. > [@Numeric ldap UID's, ldap attribute as ignition username or prepend/strip character](http://forum.inductiveautomation.com/t/numeric-ldap-uids-ldap-attribute-as-ignition-username-or-prepend-strip-character/21913): > > Hi, I was able to get the user authentication source working against our dirsrv-389 ldap instance with help from the forum. so thanks for that. Now I’m running into a different issue and I’m hoping there is a work around. all of our UID’s in ldap are numeric. So while I can authenticate successfully using the “Test authentication profile” it won’t let me use the numbers due to Ignitions limitation on user names starting with a number. so my question is this. there are other attributes th…