nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Migrieren Sie integrierte Named User-Konten zu Enterprise Named User-Konten (Active Directory/SAML) in ArcGIS Enterprise/ArcGIS Online

JakeSkinner

Das untenstehende Video führt durch die Migration integrierter Named User-Konten zu Enterprise Named User-Konten innerhalb von ArcGIS Enterprise/ArcGIS Online unter Verwendung der beigefügten Skripte. Die Enterprise-Konten können SAML oder, für ArcGIS Enterprise, Active Directory (IWA).

Hinweis: Mein Esri-Training wird für AGOL-Konten nicht gepflegt

Das untenstehende Skript gibt aus, welche Benutzer Esri Access aktiviert haben. Um das Training beizubehalten, sollten diese Benutzer aus der CSV entfernt und manuell migriert werden. Siehe den folgenden link für weitere Details zu Benutzern, die Esri Access aktiviert haben.

from arcgis.gis import GIS

gis = GIS('https://www.arcgis.com', Benutzername, Passwort)
all_users = gis.users.search()

for user in all_users:
    if user.esri_access == 'both':
        print(user.username)

https://www.youtube.com/embed/TilWsDa0rvo?feature=oembed

Migrate User Content and Groups - API 2.4.1 and later.zip

Migrate User Content and Groups - API 2.4.0 and earlier.zip

Finde mehr Beiträge mit dem Tag

Kommentare

PeterKnoop

@JakeSkinner great script! I think there might be one minor thing you've overlooked: the user's Group role (Member or Group Manager) in a group. For example, in "ArcGIS Online - Migrating User Content and Groups.py", around line 175, you would want to check the group role of the user's built-in online account, and assign the same group role to the user's enterprise account when you add them to the group (usernames = Member and admins = Group Manager.)

Also, for anyone using this script to process a very large lists of accounts, you run the risk of exceeding the operations rate limit, and the possibility of the script failing part way through processing a user. For such a case, I would highly recommend sticking a 5-second sleep in between processing each user.

JakeSkinner

@PeterKnoop good catch on adding the users to Groups. I've updated the scripts to add them as either users/managers.

ErikNelson1

@JakeSkinner Thank you for the script!

We are coming across issues connecting to our Enterprise portal in the Get Built-In Users Script. We tested several variations of our portal's url but we have been getting errors. We are trying to run the script on a virtual machine in our ArcGIS Enterprise environment. When using our portal url and portal admin credentials we are getting this error: "Exception: User not allowed for this account (Error Code: 403)". We tried adding the ':7443' port to the url and it times out and gives us the same error.

Example of what we have been using: gis = GIS(url="https://gis.organization.com/portal", username="username", password="password", verify_cert=False)

We also tried to add portal server's IP address in combination with the port number which looks something like :

gis = GIS(url="https://Portal IP Address:7443/arcgis", username="username", password="password", verify_cert=False)

but we get the following error:

"Exception: A general error occurred: Could not login. Please ensure you have valid credentials and set your security login question."

Any guidance or suggestions would be greatly appreciated as we cannot seem to get past the initial step of connecting to the portal url in the built-in users script that you have shared.

JakeSkinner

@ErikNelson1 what type of account are you using to connect to Portal? Do you know if it's a built-in, active directory, or SAML? SAML is not currently supported.

ErikNelson1

@JakeSkinner we are using a built-in admin account to connect to the Portal.

JakeSkinner

@ErikNelson1 do you have a security question set for the built-in account you are using?

ErikNelson1

@JakeSkinner yes, we do have a security question set for the built-in account we're using

JakeSkinner

@ErikNelson1 ,

1. Are you able to sign into Portal with the credentials you are providing in the script?

2. Do you have any reverse proxies in place?

3. Is there another built-in admin account you can try?

ErikNelson1

@JakeSkinner

Yes, we are able to sign into our Portal with the admin credentials we've entered in the script.
We do not have reverse proxies in place.
We tested creating another built-in Portal admin account, setting the security question, and using those admin credentials in the script but we're still encountering the same errors.

JakeSkinner

@ErikNelson1 can you test the below code on another machine that has ArcGIS Pro installed:

from arcgis.gis import GIS
gis = GIS(url="https://gis.organization.com/portal", username="username", password="password", verify_cert=False)

ErikNelson1

@JakeSkinner we determined that our python environment did not match our 10.9 Portal version.

The script ran successfully after running it in a python environment that was compatible with our Enterprise version.

TarigAhmedTXHSDS

Thank you so much for the video and scripts.

We are preparing to move to IAMOnline authentication.

When I ran the script to get the users for Portal. I noticed the Apps column is empty!

Could you please help me?

Best regards,

--------------------------------------------------

Tarig Ahmed, GISP | GIS Administrator

SHARP DSHS-IT Analytics Team

tarig.ahmed@hhs.texas.gov | 469-261-0849

DSHS ArcGIS Online | DSHS ArcGIS Enterprise Portal

JakeSkinner

@TarigAhmedTXHSDS,

This column should be populated if you have any Application licenses (i.e. ArcGIS Pro, Insights, Field Maps, etc) assigned to the user. Ex:

Thomas_Puthusserry

@JakeSkinner I am trying to use the scripts to create a new user in AGOL and transfer the contents.

Step1. Created the built-in user list successfully. Used a built-in admin user account

Step2. Tried to create a new user ID from the list, for one user. However it failed. The message is:

Creating new standard user with id: firstname.surname@email.com_agol_shortname
Unable to create firstname.surname@email.com_agol_shortname

Tried with variations of the new username, but no success.

What could be the issue?

JakeSkinner

@Thomas_Puthusserry are you able to manually create the user firstname.surname@email.com_agol_shortname?

GISLondon

Yes, that works manually

Thomas_Puthusserry

@JakeSkinner

I just tested this and it worked. I assume there is no restriction in the length of the user name?

JakeSkinner

@Thomas_Puthusserry within the CSV, remove the agol shortname from the new username. See if that works.

Thomas_Puthusserry

@JakeSkinner That was something I tried. Couple of different combinations, but nothing seems working (used a short email: surname@email.com) but same error

Thomas_Puthusserry

@JakeSkinner The main idea behind using your script is to move the users to SAML authentication. However the AGOL org where I tried your script, the SAML authentication part is not yet configured. Wonder whether there is any such requirements prior to migrating users?

JakeSkinner

@Thomas_Puthusserry yes, I believe this may be a requirement for you to successfully create the SAML account.

Thomas_Puthusserry

@JakeSkinner After enabling SAML in the AGOL, the script is running and new user is created and all items / groups transferred to the new account. However the new user cannot login: get this error:

However, if I add a new user to connect via SAML then it works, which means the setup is correct. So why is that the user id created with script is not enabled to login?

JakeSkinner

@Thomas_Puthusserry do you see any differences with the user accounts created from the script, and the one created manually? A customer I'm working with ran the same script last week and noticed the SAML account created via the script did not append the _agolshortname to the SAML account since they did not have that specified in the CSV. However, the account still worked without the shortname. This may be different for different SAML IDPs, though.

Thomas_Puthusserry

@JakeSkinner thanks for the quick response, appreciated.

Obviously, when I created the account via script, the agolshortname was appened (email_agolshortname) after the email and therefore the account is fine.

The account created manually, when the user email is given in the 'User Identifier' field, in the next screen it automatically adds the agolshortname. With that the user can login via SAML

Now I have tested what you said above: Created a new built-in user with agolshortname appended. In the csv, didn't add the agolshortname (just email). Ran the script which created the new user with just email and assigned to groups etc. This user can login via SAML. However I got some traceback error related to old user, but nothing an issue.

Does this mean that the IDPusername (email) cannot be used in another AGOL account?

DCWade

@JakeSkinner We are testing the API 2.4.1 and later scripts and are running into an error with the migration script. If a user owns content we are getting an AttributeError: 'dict' object has no attribute 'name' error at if folder.name != 'Root Folder: (line 185 in the ArcGIS Enterprise script, line 203 in the ArcGIS Online script).

It looks like folder.name is still an active arcgis module so I'm not sure why this line is flagging?

JakeSkinner

@DCWade what version of ArcGIS Pro or ArcGIS Server is installed on the server where you executing the script?

DCWade

@JakeSkinner For the Enterprise script we are on ArcPro 3.1 and Server 11.1, but the ArcGIS Online script is failing for our AGOL accounts as well.

I was able to get the API 2.4.0 and earlier scripts to run in both environments, and in those the folder section does not call the "name" property. Not sure if anyone else has experienced issues with that

JakeSkinner

@DCWade since you are at Pro 3.1 and Server 11.1, you will want to use the 2.4.0 and earlier version of the scripts. Once you upgrade to Pro 3.4 and/or Server 11.5, the ArcGIS API will upgrade to 2.4.1.

VenkataKondepati

This is a very useful guide. Migrating built-in named users to Enterprise accounts can be tricky in federated environments, and having clear steps helps avoid common pitfalls — especially around account mapping and identity linkage. Thanks for laying out the workflow and considerations in one place.

– Venkat

DavidColey

Hello @JakeSkinner - can you tell me where the module Logger comes from?

from Logger import Logger

when I try to run the script (api > 2.4.1) for Built-In ArcGIS Online users in the Python IDLE the Logger module is not found.

I do not have Visual Studio or VSCode installed at the moment.

I am on Pro 3.6x.

Nehmen Sie an der Diskussion teil

Angemeldete Mitglieder können Beiträge verfassen, Updates folgen und mehr. Neu hier? Registrieren Sie ein kostenloses Konto.

Schnellzugriffe

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.