# WebDev - Security Zones

**URL:** <https://forum.inductiveautomation.com/t/webdev-security-zones/95076>\
**Category:** Ignition\
**Tags:** ignition81, scripting\
**Created:** [August 23, 2024, 1:56pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076 "2024-08-23T13:56:30Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![luc.martin](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@luc.martin](https://forum.inductiveautomation.com/u/luc.martin)\
**Post date:** [August 23, 2024, 1:56pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/1 "2024-08-23T13:56:30Z")

</div>

I'm on 8.1.41

Is there a way to use Security Zones in WebDev module ?

I want to secured some WebDev scripts to give access to specific IP addresses without authentification required.

I don't want to hardcode allowed ip addresses in my scripts, I want to be able to configure it in the gateway...

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 23, 2024, 2:06pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/2 "2024-08-23T14:06:23Z")

</div>

Not in convenient built in way, but if you have a `GatewayContext` there's nothing stopping you from grabbing the [SecurityZoneManager](https://files.inductiveautomation.com/sdk/javadoc/ignition81/8.1.43/com/inductiveautomation/ignition/gateway/authentication/securityzones/SecurityZoneManager.html) and doing something with it, like call `getZonesFor()` with some `IdentityTraits` you built using the IP address from the request header.

---

<div class="post-metadata">

**Author:** ![luc.martin](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@luc.martin](https://forum.inductiveautomation.com/u/luc.martin)\
**Post date:** [August 23, 2024, 2:16pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/3 "2024-08-23T14:16:19Z")

</div>

> [@Kevin.Herron](#):
>
> GatewayContext

Something like this?

gateway = request["context"]  
listOfZones = gateway.SecurityZoneManager.getZonesFor(request["remoteAddr"])

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 23, 2024, 2:18pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/4 "2024-08-23T14:18:12Z")

</div>

Almost, but `getZonesFor` requires you build an `IdentityTraits` object.

---

<div class="post-metadata">

**Author:** ![luc.martin](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@luc.martin](https://forum.inductiveautomation.com/u/luc.martin)\
**Post date:** [August 23, 2024, 2:22pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/5 "2024-08-23T14:22:38Z")

</div>

Not familiar with that, have you some examples for me ?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 23, 2024, 2:24pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/6 "2024-08-23T14:24:52Z")

</div>

You should be able to figure this out from looking at the Javadoc, it's a necessary skill if you will be using classes from the SDK.

It would look something like this:

```python
from com.inductiveautomation.ignition.gateway.authentication.securityzones import IdentityTraits

id = IdentityTraits.newBuilder.ipAddress(request["remoteAddr"]).build()

```

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 23, 2024, 2:33pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/7 "2024-08-23T14:33:04Z")

</div>

Another thing to keep in mind here is that the usefulness/accuracy of the remote address as seen by the WebDev module will depend entirely on your network architecture.

---

<div class="post-metadata">

**Author:** ![luc.martin](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@luc.martin](https://forum.inductiveautomation.com/u/luc.martin)\
**Post date:** [August 23, 2024, 3:26pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/8 "2024-08-23T15:26:07Z")

</div>

Seems that something going wrong with the IdentityTraits

The first part of my code working well and retun list of securityzones

```python
gateway = request["context"]
szm = gateway.getSecurityZoneManager() 
listOfZones = szm.getZones()
return {'json': {"Zones for {}:".format(request["remoteAddr"]): listOfZones}}

```

But when I try to build the IdentityTraits I got server error  
`com.inductiveautomation.ignition.common.script.JythonExecException: Traceback (most recent call last): File "", line 8, in doGet AttributeError: 'reflectedfunction' object has no attribute 'ipAddress'`

```python
from com.inductiveautomation.ignition.gateway.authentication.securityzones import IdentityTraits 
identity = IdentityTraits.newBuilder.ipAddress(request["remoteAddr"]).build()
return {'html': "Here !!!"}

```

---

<div class="post-metadata">

**Author:** ![luc.martin](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@luc.martin](https://forum.inductiveautomation.com/u/luc.martin)\
**Post date:** [August 23, 2024, 3:28pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/9 "2024-08-23T15:28:32Z")

</div>

Was missing () for newBuilder

```python
identity = IdentityTraits.newBuilder().ipAddress(request["remoteAddr"]).build()

```

---

<div class="post-metadata">

**Author:** ![luc.martin](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@luc.martin](https://forum.inductiveautomation.com/u/luc.martin)\
**Post date:** [August 23, 2024, 3:48pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/10 "2024-08-23T15:48:52Z")

</div>

szm.getZonesFor(identity) always return empty list

```python
	gateway = request["context"]
	szm = gateway.getSecurityZoneManager() 
	listOfZones = szm.getZones()

	from com.inductiveautomation.ignition.gateway.authentication.securityzones import IdentityTraits 
	identity = IdentityTraits.newBuilder().ipAddress(request["remoteAddr"]).build()
	identityZones = szm.getZonesFor(identity)
	return {'json': 
				{
					"Zones for {}: ".format(identity.getIpAddress()): identityZones,
					"Zones for context: " : listOfZones
				}
			}

```

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/7/476ae51ce19312e4503d65143f921f5eb0285a09.png)

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/c/7c2599aa203df1dcc1ddd6ad083e9fcb51618f57.png)

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 26, 2024, 1:33pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/11 "2024-08-26T13:33:08Z")

</div>

In the Gateway, set the logger for "Security.SecurityZones.Zone" to DEBUG level and then send the request again and see what gets logged.

---

<div class="post-metadata">

**Author:** ![luc.martin](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@luc.martin](https://forum.inductiveautomation.com/u/luc.martin)\
**Post date:** [August 26, 2024, 1:52pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/12 "2024-08-26T13:52:02Z")

</div>

Zone 'WebDev\_API' does not match due to incorrect value for qualifier 'direct-connection'. Remote machine sent: '{ip-address=10.7.15.64}'

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 26, 2024, 1:58pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/13 "2024-08-26T13:58:12Z")

</div>

Ok, I think you need to set some additional attributes on the `IdentityTraits` you build.

Probably call `isDirect(true)` and `gatewayScope()`: [IdentityTraits.Builder](https://files.inductiveautomation.com/sdk/javadoc/ignition81/8.1.43/com/inductiveautomation/ignition/gateway/authentication/securityzones/IdentityTraits.Builder.html)

---

<div class="post-metadata">

**Author:** ![luc.martin](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@luc.martin](https://forum.inductiveautomation.com/u/luc.martin)\
**Post date:** [August 26, 2024, 2:02pm UTC](https://forum.inductiveautomation.com/t/webdev-security-zones/95076/14 "2024-08-26T14:02:29Z")

</div>

> [@luc.martin](#):
>
> direct-connection

missing isDirect, isSecure and gatewayScopre()

```python
identity = IdentityTraits.newBuilder().ipAddress(request["remoteAddr"]).isDirect(True).isSecure(False).gatewayScope().build()

```