> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Manage AAA sources through profiles

> How to configure and switch between multiple AAA sources using Itential Platform profiles, including adapter configuration, profile creation, and editing properties.json.

Itential Platform supports integration with several Authentication, Authorization and Accounting (AAA) sources. Upon initial installation, the system uses a local AAA service. This is often replaced with an external source such as OpenLDAP or Active Directory Domain Services. Access to the Platform will be denied if the AAA source is unavailable.

Itential Platform supports one active AAA source at a time. To provide redundancy, multiple AAA sources can be configured on the system. For example, if the Platform is integrated with a single LDAP server and that server becomes unavailable, users cannot log in. A secondary AAA source can be configured in advance so that operators can manually switch to it if the primary source becomes unavailable.

AAA sources cannot be federated by enabling multiple sources simultaneously. Doing so may prevent users from logging in to Itential Platform.

## Managing AAA sources via profiles

A profile designates the specific services (applications and adapters) that should be enabled on the Itential Platform server. It is loaded on system startup as defined in the [properties.json file](#appendix-a-propertiesjson). When an application or adapter is installed and configured, it can be enabled or disabled per profile. To manage multiple AAA sources via profiles:

1. Configure the relevant AAA adapters on the Itential Platform system.
2. Add these adapters to separate Itential Platform profiles.
3. Change the active profile based on which AAA source is to be used.

Only one Itential Platform profile may be active at any time. After making a new profile active, Itential Platform must be restarted for the changes to take effect.

### Configure AAA adapters

All relevant AAA adapters must be configured first. Adapters are the software components that handle sending and receiving data to and from external systems. A **broker** is responsible for delivering certain types of data to an adapter — AAA adapters (LDAP, AD, RADIUS) must be configured with the `aaa` broker to receive AAA-specific requests.

#### Open Admin Essentials

From the dashboard, launch **Admin Essentials**. This application is only available to administrator-level users.

#### Select the adapter

Expand **Adapters** in the Admin Essentials side navigation and select the adapter you want to configure.

#### Review and update the service config

The adapter's service config displays. The example below shows the **Local AAA** adapter configuration with **Advanced view** enabled (toggle in the upper-right corner to show JSON format). The key configuration is the `brokers` array — `aaa` must be present for the adapter to receive authentication requests.

![](/_fern-img/df408a947d42a9142beb816c4b4b04507ea0dda8985504ea884354f9f0cdabe5.webp)

Configure and test all required AAA adapters before proceeding.

### Create profiles

After all AAA adapters are configured, create one Itential Platform profile per AAA adapter by cloning the default profile.

#### Open Admin Essentials

From the dashboard, launch **Admin Essentials**.

#### Select the default profile

Expand **Profiles** in the side navigation and select the default profile (typically **profile1**).

#### Clone the profile

Click the **menu** button (stacked dots) in the upper-right corner and select **Clone**. Enter a name for the new profile — Itential recommends naming it to make the AAA source readily apparent — then click **Clone**.

Cloning the default profile ensures all required running properties and server configurations are included. In the example below, two profiles were created: **LDAP** and **LocalAAA**.

![](/_fern-img/6e0b4695002a5d8c2a8817331ae7c40a1e18c1e60749221b8b19f5e6d16c8544.webp)

### Configure profiles

#### Open Admin Essentials

From the dashboard, launch **Admin Essentials**.

#### Select the profile to configure

Expand **Profiles** in the side navigation and select the profile you want to edit.

#### Enable the appropriate adapter

Click the **Configure** tab. Under **Edit Profile Services**, select **Adapters**. Check the checkbox for the adapter to enable, then click the **Save** icon in the upper-left corner.

In the example below, the **LocalAAA** profile has the **Local AAA** adapter enabled — all other AAA adapters are disabled.

![](/_fern-img/b0066e94e7eab6710964bcf19563d411b2278bd35499eb51aa2b93af78f08ad5.webp)

In this example, the **LDAP** profile has the LDAP adapter enabled.

![](/_fern-img/3e398966e03f5d0813e88b6ece23c5ae0f18e2df0a1d7a5bc1f88328cf1f85fe.webp)

### Switch between profiles

#### Open Admin Essentials

From the dashboard, launch **Admin Essentials**.

#### Select the profile to activate

Expand **Profiles** in the side navigation and select the profile you want to make active.

#### Open metadata

Click the **menu** button (stacked dots) in the upper-right corner and select **View Metadata**.

#### Set the profile as active

Click the **Active Profile** toggle, then click **Save**. A success banner displays, prompting you to restart Itential Platform.

![](/_fern-img/15c3e584504b8ce770a3022968fedadebd2467f36cda09fc88dc3fbf6bbd3aef.webp)

#### Restart the Platform

Restart the Platform server. For environments using MongoDB replica sets, all Platform servers reading from that MongoDB database must be restarted.

In some Itential Platform versions, the active AAA adapter may not load properly if any other AAA adapter also has the `aaa` broker configured. As a precaution, ensure the `aaa` broker is **only** present in the configuration of the AAA adapter you intend to use.

### Edit the profile directly via properties.json

Itential recommends changing the profile configuration via the UI whenever possible. If an unavailable AAA source has made Itential Platform inaccessible, the active profile can be changed by editing `properties.json`:

#### Open properties.json

Navigate to `$IAP_HOME/current/properties.json` and open it in a text editor.

#### Update the profile ID

Find the `id` configuration line (for example, `"id": "LDAP"`) and change the value to the desired profile name (for example, `"id": "LocalAAA"`).

#### Restart the Platform

Restart the Itential Platform server.

## Appendix A: properties.json

Most configuration properties for Itential Platform are stored in named profiles in MongoDB. The `properties.json` file (`$IAP_HOME/current/properties.json`) provides the Platform with two key pieces of information:

* The location of the MongoDB database used as a data store.
* The name of the profile within that data store that is active on server start.

Example `properties.json` loading the `Local_AAA` profile from a local MongoDB installation:

```json
{
  "pathProps": {
    "description": "File Path Variables",
    "sdk_dir": "/opt/pronghorn-applications",
    "encrypted": true
  },
  "id": "Local_AAA",
  "mongoProps": {
    "credentials": {
      "passwd": "itentialPassword",
      "user": "itentialUser"
    },
    "db": "pronghorn",
    "url": "mongodb://localhost:27017"
  }
}
```