We need a large-scale deployment of approximately 1,000 Ignition Edge panels distributed across geographically remote sites spanning thousands of kilometers. These systems support a mobile workforce of hundreds of operational and maintenance personnel. Due to the nature of remote infrastructure, WAN connectivity to many sites can be intermittent or unavailable for extended periods. In many cases, personnel travel to site specifically because communications are down. Currently, authentication is integrated with a centralized OT Active Directory (or other identity provider). While this model works effectively under normal network conditions, it creates a critical operational risk during network outages. When a user changes their password centrally (e.g., due to expiry or security policy), that change is not necessarily available to remote Ignition Edge panels if those panels are disconnected from the domain controller or identity provider. This creates a scenario where a user may arrive at a remote site—possibly one they have never visited before—and be unable to log in locally because the panel cannot validate credentials against the central authority. We propose a built-in, resilient distributed authentication mechanism within Ignition (including full compatibility with the Perspective module) that supports the following capabilities: Forced Distributed Credential Synchronization: When a user’s password or authentication factor is changed centrally, Ignition Gateway should securely and automatically propagate updated authentication artifacts to all registered Edge nodes in the fleet. This propagation should be policy-driven, secure, and auditable. The goal is that every Edge panel maintains a locally verifiable, up-to-date authentication state for authorized users. Offline-Capable Authentication Cache with Secure Revalidation: Each Ignition Edge instance should maintain an encrypted, tamper-resistant local authentication cache containing sufficient credential material (e.g., salted password verifiers, public keys, or token validation metadata) to allow secure offline login when disconnected from the identity provider. When connectivity is restored, automatic reconciliation and revalidation should occur. Policy-Based Fleet Distribution Controls: Administrators should be able to define which users or roles are distributed to which Edge nodes (e.g., global operators vs. region-specific personnel), minimizing attack surface while ensuring operational continuity. Event-Driven Push Model: Credential updates should be “pushed” to all Edge systems immediately upon change, rather than relying solely on periodic polling. This ensures password changes, revocations, or account lockouts propagate rapidly across the fleet. Revocation and Emergency Lockout Handling: A mechanism should exist for high-priority revocations (e.g., compromised credentials) to invalidate cached credentials fleet-wide as soon as connectivity is restored, with optional time-based expiry for offline authentication. Support for Modern Authentication Mechanisms (Including FIDO Passkeys): Consider support for FIDO2/WebAuthn passkeys as a potential model for distributed authentication resilience. With passkey-based authentication, a user’s identity could be anchored to asymmetric cryptographic credentials rather than centrally validated passwords. Ignition could distribute the relevant public key material to all Edge nodes, enabling local cryptographic validation even when offline. This model would: Eliminate password synchronization challenges. Improve phishing resistance. Enable strong, hardware-backed authentication. Allow local login validation without live access to a domain controller. Full Perspective Module Compatibility: The solution must work seamlessly with Perspective sessions, including role-based security, session management, and audit logging. Offline logins should still enforce project security rules and record audit events locally for later synchronization. Operational Outcome: This feature would enable personnel to log in securely to any Ignition system in the fleet—even during prolonged network outages—provided they were authorized prior to the outage. It would eliminate a significant operational risk where personnel are physically present on site but technically locked out due to WAN failure. A resilient, distributed authentication mechanism purpose-built for large, geographically dispersed Ignition deployments would materially enhance Ignition’s suitability for critical infrastructure, remote operations, and edge-heavy architectures. This capability would position Ignition as a leader in secure, fleet-scale, offline-capable industrial identity management.
