Understanding User Roles and Security Levels in Ignition: A Practical Example

This is a good observation and question, the confusion is mainly coming from the fact that Perspective is not actually using your User Source, rather Perspective is using an internal Identity Provider which has a source of: your internal User Source. Perspective is based entirely on Identity Providers, and that means Security levels are the attribute we build logic against for Perspective.

"Authenticated/Roles/OperateGroup1" is a String representing a Security Level Path, since you are using an internal User Source the string defaults to: Authenticated/Roles/{roleName} for the roles you create in the User Source. This is not the same as adding Security Levels to the Gateway webpage.

It may seem like I have described a connection that is directly User Source > IdP, but in reality an Identity Provider should be considered a 3rd party source of user information. By default, Ignition has no reference to the Security Levels that a connected Identity Provider has (this is even more apparent when connecting a 3rd party Idp, it is less clear when using an internal source).

If you refer to Identity Provider Authentication Strategy in the User Manual you will find an image that shows the overview of the Identity Provider connection to Ignition.

In this image you can see that the IdP is distinct from your server, when you use an internal User Source you are essentially forcing Ignition to consider its own User Source data as incoming IdP data. It still uses this same flow, meaning on step 3 Ignition sends the login information to your internal IdP and in step 6 it returns with your access token which includes the Security Levels. You can see the token by using the "test login" button on the Identity Provider in the webpage, and is a good way to confirm things are working as you expect on initial connection.

Since IdPs are separate from Ignition it will never generate Security Levels for you automatically, so you must create them even for internal User Sources. The user manual has most of the information you need. Generally the steps for IdP security setup are: connect Idp > setup User Attribute Mapping if needed > setup Security Levels > setup User Grants if needed.

2 Likes