see idea: Support for Multiple Simultaneous SAML and/or OIDC... - Esri Community
Category: Security / Authentication / Identity Management
Current Limitation:
ArcGIS Enterprise does not provide a mechanism to route users to a specific identity provider based on their role, group membership, or intended access level. All users authenticate through the same, single configured IdP path.
Use Case / Role & Context:
As an ArcGIS Enterprise administrator, I need to enforce stricter or dedicated authentication paths for privileged/administrative accounts, separate from standard staff SSO — for example, routing administrator logins through a dedicated IdP or authentication policy with mandatory MFA or privileged-access-management (PAM) controls, while standard staff use a separate, less restrictive corporate SSO IdP.
Without this capability, all users — including highly privileged administrators — must authenticate via the same IdP and policy as regular staff, which does not align with security best practices around separating privileged access from standard user access.
Proposed Solution:
Introduce a configurable login routing/discovery mechanism that directs users to the appropriate identity provider based on criteria such as:
- Role or group assignment,
- Requested access level (e.g., admin portal vs. standard app access),
- Domain-based or dedicated login URL routing.
This assumes and builds upon the ability to configure multiple identity providers (see related idea: "Support for Multiple Simultaneous SAML and/or OIDC... - Esri Community").
Impact / Business Value:
- Enables compliance with security best practices (separation of privileged access from standard user access).
- Aligns with Zero Trust principles by allowing risk-based, context-aware authentication routing.
- Reduces the blast radius of compromised standard-user credentials on administrative functions.
Current Workaround:
None available; privileged and standard users currently share the same authentication path.
