Skip to content

Windows Single Sign-On for Ignition Perspective

How a domain user opens an Ignition Perspective page and is signed in automatically — no username or password — using Active Directory, AD FS (OpenID Connect) and Kerberos. Complete build record, replication steps and a troubleshooting guide from the working lab.

Windows Server 2025 AD DS · AD CS · DNS · AD FS Ignition 8.3.9 / Perspective 3.3.9 Built 2 Oct 2026 Status: working ✔

Sanitized public copy

Host names, IP addresses, the domain and certificate thumbprints in this copy are placeholders (example.local, DC01, 10.0.0.10, ...). Replace them with your own values (Values used in this build lists them). Nothing here is a real credential.

Overview

What was built, and the one design decision everything else follows from.

Key fact: Ignition cannot do Kerberos / "Windows login" by itself.

The old “SSO Enabled” option of the Active Directory user source was disabled in Ignition 8.1.17 for a security vulnerability and is deprecated. The supported way to get silent Windows sign-in is to put an external identity provider (IdP) in front of Ignition. Here that IdP is AD FS, speaking OpenID Connect. AD FS is the component that actually performs the Windows (Kerberos) authentication; Ignition only trusts the token AD FS returns.

What you end up with

  • An AD domain controller that also hosts DNS, an Enterprise Certificate Authority and AD FS.
  • Two TLS certificates issued by your own CA: one for AD FS, one for Ignition (both with the right Subject Alternative Names).
  • An Ignition 8.3 Gateway on HTTPS (port 8043) using that certificate and trusting your CA.
  • An OIDC client in AD FS for Ignition, and an ADFS identity provider in Ignition mapped to AD attributes.
  • A Perspective project that requires authentication and shows who is signed in.
  • A Group Policy that makes domain browsers send Windows credentials to AD FS automatically.

Architecture

Client PC domain-joined, Edge/Chrome signed in as EXAMPLE\user GPO: AD FS = Intranet zone Ignition Gateway 8.3 https://ignition.example.local:8043 Perspective project “SSOTest” IdP “ADFS” (OIDC client) AD FS (federation service) https://adfs.example.local gMSA EXAMPLE\adfs-svc$ Windows Integrated Auth (Kerberos) DNS server adfs / ignition → DC IP (AD-integrated zone) AD CS (example-CA) issues both TLS certificates AD DS / KDC users, groups, Kerberos tickets ① open page ② redirect ③ Kerberos ticket verify ticket,read groups

Everything in this lab (DC, CA, DNS, AD FS, Ignition) runs on one server, DC01. That is fine for a lab; see Production notes for how to split it.