# Use Different Identity Provider For Different Security Zones

**URL:** <https://forum.inductiveautomation.com/t/use-different-identity-provider-for-different-security-zones/43204>\
**Category:** Ignition\
**Tags:** ignition80\
**Created:** [February 9, 2021, 7:00pm UTC](https://forum.inductiveautomation.com/t/use-different-identity-provider-for-different-security-zones/43204 "2021-02-09T19:00:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![joyja](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/joyja/32/9401_2.png) [@joyja](https://forum.inductiveautomation.com/u/joyja)\
**Post date:** [February 9, 2021, 7:00pm UTC](https://forum.inductiveautomation.com/t/use-different-identity-provider-for-different-security-zones/43204/1 "2021-02-09T19:00:11Z")

</div>

Is it possible to change which Identity Provider is used for authentication based on the Security Zone?

For instance I have an on-premise gateway that is also accessible from the internet through a reverse proxy on a VPS and an ssh tunnel. I want to use an OIDC IDP when someone is accessing from the internet and use the default IDP when someone is accessing on premise.

Right now I’m accomplishing by maintaining two projects that are identical other than the IDP selected exporting resources between the two when I make changes, but would be nice to have a single project that used different IDPs depending on security zone of the client.

---

<div class="post-metadata">

**Author:** ![kcollins](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcollins/32/19646_2.png) [@kcollins](https://forum.inductiveautomation.com/u/kcollins)\
**Post date:** [February 9, 2021, 10:06pm UTC](https://forum.inductiveautomation.com/t/use-different-identity-provider-for-different-security-zones/43204/2 "2021-02-09T22:06:43Z")

</div>

I don’t believe you can pivot the Identity Provider on a given project. However, you might explore making the base project inheritable, and then creating two sub-projects where, at that layer, you could override the Identity Provider / User Source settings. This would at least minimize your needing to keep the project resources in sync manually. Take a look at [Project Inheritance](https://docs.inductiveautomation.com/display/DOC81/Project+Inheritance). In version 8.1.2, the Designer now lets you manage project properties overrides:

 ![override project resources](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/1/e12436053c7da5fcc840108590b4f8ca5a10e124.gif)

See [Property Inheritance](https://docs.inductiveautomation.com/display/DOC81/Project+Properties#ProjectProperties-PropertyInheritance) for more on this. **Note** that due to the manner in which these resources are stored in the gateway, overriding a given section may apply overrides to several different property panes in the dialog. That is the reason why overriding _Project-\>General_ causes override indications to appear in _Project-\>Permissions_ and _Vision-\>Permissions_, for example. Just something to be aware of at the moment, that situation may improve in the future.

---

<div class="post-metadata">

**Author:** ![joyja](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/joyja/32/9401_2.png) [@joyja](https://forum.inductiveautomation.com/u/joyja)\
**Post date:** [February 9, 2021, 11:42pm UTC](https://forum.inductiveautomation.com/t/use-different-identity-provider-for-different-security-zones/43204/3 "2021-02-09T23:42:28Z")

</div>

I had thought about project inheritance, but wanted to confirm that was the right approach before moving resources around. Thanks for confirming!