nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Automatically Assign Users to Groups

ZachBodenner

Hello,

I need some help understanding my Enterprise Portal identity store. I have manually set up groups in Enterprise Portal (10.8.1) that roughly correspond to the Active Directory user groups within the organization (Parks, Police, Fire, Assessing, Engineering etc). The Portal is configured for single sign-on where users are simply presented with the blue ESRI sign in button and their AD credentials are passed to the Portal. Additionally, the Portal is configured to automatically create user account if they have not yet signed in. This is the thing I want to work on.

My goal is to automatically place new users into Portal groups based on AD groups they are a part of, but this is where I get a little confused (I wasn’t primarily responsible for setting this up when we initially rolled out our Portal). So clearly there is some relationship between our Portal sign in configuration and our Windows AD. In the organization’s security settings, the login redirect hits our AD server, I can download the metadata xml, all that. But when I looking at the Identity Store config in the PortalAdmin directory, it shows that the Portal is configured with the type BUILTIN. I must not understand completely because it doesn’t seem to make sense that user store configuration would be built in if there is such a relationship with the actual AD.

How do I appropriately configure the Portal to allow for automatic group placement when a new member signs in for the first time (without removing any currently existing Portal users in the process, if at all possible)? I’m not sure if I’ve provided enough/the right info for anyone to help out, so let me know if there’s anything else I can provide.

Thanks!

Find more posts tagged with

Administration

Accepted answers

All comments

GrantSmith122

Hi! I have a bit of a follow up question on this thread. Our org has set up a SSO SAML login that passes a memberOf attribute through each login request. Using SAML Tracer, we see that the memberOf information comes through like this:

>CN=[value1],OU=[value2],dc=[value3],dc=[value4],dc=[value5]</saml:AttributeValue>

When we are in our Portal setting up groups, how exactly do we need to specify the Group Name setting under "Being a member of a SAML group"? Is it just the [value1] item in the example above? Do we need to somehow concatenate all the values together? Do we need quotes? Any help will be appreciated!

Scott_Tansley

I look after about 30 clients, mostly Local Government and Utilities. Your network admin can reach out to me via direct message on my profile or LinkedIn.

This whole subject is pretty BAU now. I would say it's tried and trusted if that's the issue?

ZachBodenner

So my network admin thinks that we should be able to implement this feature, but is looking for some examples of other organizations that have made it work. Are there any viewers of this thread that have successfully implemented automatic group assignation and would be willing to share their experiences?

ZachBodenner

I'm not 100% sure what the SAML2 provider is. Or rather, I know that we use Microsoft Active Directory (Microsoft Management Console?), but is that the same thing as the Provider? That would make the most sense to me anyway.

Scott_Tansley

Do you know what your SAML2 Identity Provider is? You have to configure it to broadcast the groups that your users belong to as a part of the SAML2 token exchange.

What is happening behind the scenes is that the IDP will send a token for 'user1' , and if that same token has the SEC-GroupName in it, then when they log in there is a 'text match' which gives them the privileges.

If user1 is logged in to the portal, and is later added to the group in the AD, then Portal is unaware of this until the user logs out and logs in (to the Portal). This is because there isn't a direct connection to the AD. The connection only happens at the point of the handshake between Portal and the IDP. Therefore changes to the AD after that event do not get reflected in portal until the next handshake.

But I have seen some client sites where Azure AD (for example) has not been posting the group membership in the token, so Portal has nothing to match against. You may need to check the IDP end of the equation as well.

ZachBodenner

Ah yes, so I did do that, and then created a new group, set the property in the settings so that only members of "SEC-GroupName" can join. Then we created a test user belonging to that group in Active Directory (to have a fresh faced login) and then I used that account to sign in to the Portal for the first time and they were not placed into the Portal group.

ReeseFacendini

From what you described, it appears that your Enterprise deployment is configured with SAML and not the traditional Active Directory connection. To have users added to groups, you would need to edit the SAML configuration (Settings -> Security -> Logins) and verify Enable SAML base group membership is turned on. The link below details how to configure this in more detail

https://enterprise.arcgis.com/en/portal/latest/administer/windows/create-groups.htm#ESRI_SECTION1_5E3FFFAA1B7E443FBB1E483E070B1979

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.