Resolving Ignition 8.3 Invalid reference 'temp' inAuthProfile

Every save on /app/platform/security/settings fails with Invalid reference: 'temp' against SystemAuthProfile. The cause is that the security-properties resource still points at the deleted temp user source, and the Identity Provider mode hides the field that holds that pointer. The fix has three parts: repoint SystemAuthProfile at a live user source, switch back to Identity Provider, and only then delete temp through the reference-checked path.

Where does the security-settings save request stop?

The request starts in the browser on the gateway web UI page /app/platform/security/settings. When you change any field on that page and save, the page posts the whole security-properties resource to the gateway configuration API, not only the field you changed. On this gateway the edited field was Gateway audit profile. The gateway then validates every property in the resource, including properties the current UI mode does not display. Validation fails on SystemAuthProfile, and the gateway returns the rejection to the page:

{"messages":[],"fieldMessages":[{"fieldName":"SystemAuthProfile","messages":["Invalid reference: 'temp'"]}]}

The request is well formed. Nothing fails at the network or authentication layer. The gateway's own reference validation rejects the resource because one property names a user source that no longer exists. Changing the audit profile, or any other field, only triggers the validation. The broken reference was already stored.

Check before moving on:

1. Open the browser developer tools and select the Network tab.
2. Change one field on the security settings page and save.
3. Confirm that the response body contains "fieldName":"SystemAuthProfile".

If a different fieldName appears, a different stale reference exists. Apply the same method below to that property.

How did 'temp' end up in SystemAuthProfile?

This gateway followed this sequence:

1. The gateway password was reset with gwcmd -p. That reset created a user source named temp, and the security settings were left referencing it.
2. Designer Authentication Strategy was switched to Identity Provider, because the site authenticates through SAML.
3. The Ignition-created temp user source was deleted.
4. A later edit to the security settings failed validation.

In Identity Provider mode, the user-source selector for Classic mode is hidden because that mode does not need it. Hiding the field does not clear its stored value. After the password reset, that selector held temp. When temp was deleted, the hidden value became a dangling reference. The validator checks the stored resource, not the visible form, so it still rejects the save.

Two settings share this page and are easy to confuse. The Designer Authentication Strategy controls how Designer sessions authenticate. The system user source controls who can make gateway configuration changes. The property that fails is SystemAuthProfile, the reference the deletion API reports under ignition/security-properties. On this gateway, the selector that held temp appeared under Designer Authentication Strategy > Classic. Switch the mode and watch which dropdown shows temp to confirm which UI control writes SystemAuthProfile on your build.

Check before moving on: switch Designer Authentication Strategy to Classic without saving. Confirm that the user-source dropdown shows temp, or shows a blank or invalid entry where temp used to be. That field is the one to fix.

Which resources still reference the user source?

User source deletion in 8.3 has a two-step guard. A standard delete request against a user source that other resources reference does not delete it. The gateway returns HTTP 200, meaning the request was received and valid, with "success": false and a list of the resources that point at the target. The request only completes when you resend it with confirm=true. The UI sends that when you accept the warning dialog.

The same call works as a read-only reference audit. A request against the default user source on a stock gateway looks like this:

<gateway>/data/api/v1/resources/ignition/user-source/default/<resource-hash>?confirm=false&collection=core

{
  "success": false,
  "changes": [],
  "problem": null,
  "references": [
    {
      "type": "ignition/security-properties",
      "name": "security-properties",
      "property": "SystemAuthProfile"
    }
  ]
}

Omitting confirm produces the same response as confirm=false. Read the <resource-hash> segment from the request the web UI sends when you click delete on a user source. Cancel the dialog before it resends with confirmation.

Check before moving on: run the unconfirmed delete against the user source you plan to make the new SystemAuthProfile target, such as default. An empty references array is fine here. You only need to know that the source exists and resolves.

How do you repoint SystemAuthProfile to a live user source?

The hidden field is only editable in Classic mode. Surface it, correct it, then restore Identity Provider mode. Do both steps before any other edit, because every save validates the whole resource.

1. Open /app/platform/security/settings.
2. Set Designer Authentication Strategy to Classic so the user-source selector appears.
3. In that selector, replace temp with a user source that exists and holds a working admin account. For example, use default or the production user source.
4. Set Designer Authentication Strategy back to Identity Provider. The SAML configuration is not affected because the Classic selector is independent of it.
5. Save once.

If your build refuses the save in Classic mode, use a fallback. Recreate a user source named exactly temp so the dangling reference resolves again, then save. Next, repoint the selector with the procedure above and save again. After that, temp is unreferenced and can be removed cleanly.

Before you save, confirm that the new target user source contains an account with gateway configuration rights. If SystemAuthProfile points at a source with no admin role, you lock yourself out of configuration changes. That lockout is the same situation that required gwcmd -p in the first place.

Check before moving on: in developer tools, the save response must not contain a fieldMessages entry for SystemAuthProfile. Reload the page, switch to Classic without saving, and confirm the selector shows the new user source. Then leave the page without saving.

How do you remove the temp user source without breaking references?

Once SystemAuthProfile points elsewhere, temp should have no referrers. Confirm that before deleting.

1. Start the delete of temp from the user sources page.
2. If the gateway shows a references warning, cancel it. In developer tools, inspect the unconfirmed response and read its references array.
3. For each entry, open the resource named by type and name, and change the listed property to a live source.
4. Repeat the unconfirmed delete until the gateway deletes temp without a warning, or until references comes back empty.

Do not accept the confirmation dialog while references remain. Confirming sends confirm=true, which forces the deletion and recreates the fault. The forced path exists for cases where you delete a resource and immediately replace it with another of the same name. It is not a shortcut around cleaning up references.

Check before moving on: the user sources list no longer shows temp, and no warning appeared during the final delete.

Which defects remain after the fix is applied?

The underlying behavior is tracked as IGN-14158. Two UI defects make this failure hard to diagnose, and both still exist after you correct the configuration:

Until the hidden-field indication ships, treat any security settings save error that highlights no field as a hidden-field reference. Read fieldMessages[].fieldName from the response, then switch UI modes until that field is visible.

How do you prove the gateway security configuration is clean end to end?

1. Security settings save: change Gateway audit profile, or any other field, on /app/platform/security/settings and save. The response carries no fieldMessages, and the change persists after a page reload.
2. Mode state: confirm Designer Authentication Strategy reads Identity Provider after reload.
3. Hidden reference: switch to Classic without saving. The selector shows the live user source, not temp or a blank. Leave without saving.
4. Reference audit: run an unconfirmed delete (confirm=false) against the user source now in SystemAuthProfile. The references array lists ignition/security-properties / SystemAuthProfile, which proves the pointer resolves to it. Cancel without confirming.
5. Designer login: open the Designer and authenticate through the SAML identity provider.
6. Configuration rights: log in to the gateway web UI with an account from the user source that SystemAuthProfile now references, and save a harmless configuration change.

FAQ