Corp account login should add user to SAML groups

abureaux

Ask: Being logged into the S123 Field App should add a user to all appropriate SAML groups on the Portal

Overly long explanation: Had an odd issue today where a user couldn't submit a form. I eventually checked the sharing group, and they weren't added to the corporate "ALLCOMPANY" group which should contain 100% of employees.

This is a SAML group in the Portal which I updated a few days ago to point to a different group in our AD. As a result, all users were kicked out of the old group (not a concern).

As new users logged into the Portal to use web maps, they were added to the updated SAML group (cool. It's working).

But this one user was only logging in via the S123 Field App (I'm sure they would need other services eventually, but I'm a little thankful they didn't in this case). Apparently being logged in to the Field App doesn't sync up with the server in such a way as to re-add a user to SAML groups, thus creating odd security scenarios like this one.

They could...

1. Log into and access S123 Field App
2. Download locked forms

They could not...

1. Submit to locked forms as they weren't in the proper group (not an issue on it's own - I just want SAML groups to do their thing).

RobertAnderson3

That's a really interesting issue to come across, and probably rare to come across. 

I know the way Survey123 signs into ArcGIS Online is different than the other apps, so I imagine it's the same on the Portal/Enterprise side. I really wish they'd unify it..