# User Authentication Using AD User Source

**URL:** <https://forum.inductiveautomation.com/t/user-authentication-using-ad-user-source/57228>\
**Category:** Ignition\
**Tags:** security\
**Created:** [March 15, 2022, 7:04pm UTC](https://forum.inductiveautomation.com/t/user-authentication-using-ad-user-source/57228 "2022-03-15T19:04:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elliot.lohr](https://avatars.discourse-cdn.com/v4/letter/e/3bc359/32.png) [@elliot.lohr](https://forum.inductiveautomation.com/u/elliot.lohr)\
**Post date:** [March 15, 2022, 7:04pm UTC](https://forum.inductiveautomation.com/t/user-authentication-using-ad-user-source/57228/1 "2022-03-15T19:04:46Z")

</div>

Hello. I am playing around with the scripting function `system.security.getUserRoles(username, password, authProfile)` using an AD as my User Source.

I am curious whether rules for lockout of accounts can be set at the gateway level, or they only come from the AD settings.

Came up with this question because according to a client, their AD will temporarily lockout at 5 unsuccessful logins, but I’m seeing it happen at 1 unsuccessful login.

---

<div class="post-metadata">

**Author:** ![bpreston](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@bpreston](https://forum.inductiveautomation.com/u/bpreston)\
**Post date:** [March 15, 2022, 7:27pm UTC](https://forum.inductiveautomation.com/t/user-authentication-using-ad-user-source/57228/2 "2022-03-15T19:27:01Z")

</div>

Edit your user source and look at what your lockout is set to. This is assuming your using the [classic auth strategy](https://docs.inductiveautomation.com/display/DOC81/Classic+Authentication+Strategy) since you mentioned AD user soruce.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/b/1bab440f77e5455f307a2d350fe4b0862b3e1aa5.png)

---

<div class="post-metadata">

**Author:** ![josborn](https://avatars.discourse-cdn.com/v4/letter/j/4bbf92/32.png) [@josborn](https://forum.inductiveautomation.com/u/josborn)\
**Post date:** [March 15, 2022, 7:35pm UTC](https://forum.inductiveautomation.com/t/user-authentication-using-ad-user-source/57228/3 "2022-03-15T19:35:24Z")

</div>

There’s actually two lockouts, on at the AD level and the one @bpreson mentions at the Ignition user source level. I don’t know if locking out at the AD level will also lock you out of ignition, but getting locked out in Ignition wont lock you out at AD.

---

<div class="post-metadata">

**Author:** ![elliot.lohr](https://avatars.discourse-cdn.com/v4/letter/e/3bc359/32.png) [@elliot.lohr](https://forum.inductiveautomation.com/u/elliot.lohr)\
**Post date:** [March 17, 2022, 7:13pm UTC](https://forum.inductiveautomation.com/t/user-authentication-using-ad-user-source/57228/4 "2022-03-17T19:13:52Z")

</div>

Thank you! I don’t know why I couldn’t find this when I was looking through my gateway settings.

The gateway lockouts were disabled so looks like it wasn’t happening at the gateway level.