nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Migrate Built-In Named User accounts to Enterprise Named User accounts (Active Directory/SAML) in ArcGIS Enterprise/ArcGIS Online

jskinner

The below video will walk through migrating built-in named user accounts to enterprise named user accounts within ArcGIS Enterprise/ArcGIS Online using the attached scripts. The enterprise accounts can be SAML or, for ArcGIS Enterprise, Active Directory (IWA).

Note: My Esri training will not be maintained for AGOL accounts

The below script will print which users have Esri Access enabled. To maintain training, these users should be removed from the CSV and migrated manually. See the following link for more details for users that have Esri access enabled.

from arcgis.gis import GIS

gis = GIS('https://www.arcgis.com', username, password)
all_users = gis.users.search()

for user in all_users:
    if user.esri_access == 'both':
        print(user.username)

Migrate User Content and Groups - API 2.4.0 and earlier.zip

Migrate User Content and Groups - API 2.4.1 and later.zip

Find more posts tagged with

Comments

jskinner

@MikeFallon what version of ArcGIS Pro are you running?

MichaelFallon

@JakeSkinner We are testing the API 2.4.1 and later scripts with ArcGIS Online and are running into an error with the migration script. If a user owns content we are getting an AttributeError: 'dict' object has no attribute 'name' error at if folder.name != 'Root Folder: (line 201 in the ArcGIS Online script).

dcoley

Scratch my reply @JakeSkinner - I now see that the Logger.py is setting up the classes and definitions and environments....

Thanks again!

dcoley

Ok thanks @JakeSkinner -

This is what I see in the api documentation now:

https://developers.arcgis.com/python/latest/guide/advanced-concepts/

import logging
import sys
# Create logger
logger = logging.getLogger()
logger.setLevel(logging.INFO)
....

will setting logging like this at the top of the GetUsers and Migrate scripts work in place of using the Logger.py file?

jskinner

@DavidColey there's a Logger.py included with the zip file. This file has to exist in the same directory as the other scripts.

dcoley

Hello @JakeSkinner - can you tell me where the module Logger comes from?

from Logger import Logger

when I try to run the script (api > 2.4.1) for Built-In ArcGIS Online users in the Python IDLE the Logger module is not found.

I do not have Visual Studio or VSCode installed at the moment.

I am on Pro 3.6x.

VenkataKondepati

This is a very useful guide. Migrating built-in named users to Enterprise accounts can be tricky in federated environments, and having clear steps helps avoid common pitfalls — especially around account mapping and identity linkage. Thanks for laying out the workflow and considerations in one place.

– Venkat

jskinner

@DCWade since you are at Pro 3.1 and Server 11.1, you will want to use the 2.4.0 and earlier version of the scripts. Once you upgrade to Pro 3.4 and/or Server 11.5, the ArcGIS API will upgrade to 2.4.1.

DCWade

@JakeSkinner For the Enterprise script we are on ArcPro 3.1 and Server 11.1, but the ArcGIS Online script is failing for our AGOL accounts as well.

I was able to get the API 2.4.0 and earlier scripts to run in both environments, and in those the folder section does not call the "name" property. Not sure if anyone else has experienced issues with that

jskinner

@DCWade what version of ArcGIS Pro or ArcGIS Server is installed on the server where you executing the script?

DCWade

@JakeSkinner We are testing the API 2.4.1 and later scripts and are running into an error with the migration script. If a user owns content we are getting an AttributeError: 'dict' object has no attribute 'name' error at if folder.name != 'Root Folder: (line 185 in the ArcGIS Enterprise script, line 203 in the ArcGIS Online script).

It looks like folder.name is still an active arcgis module so I'm not sure why this line is flagging?

Thomas_Puthusserry

@JakeSkinner thanks for the quick response, appreciated.

Obviously, when I created the account via script, the agolshortname was appened (email_agolshortname) after the email and therefore the account is fine.

The account created manually, when the user email is given in the 'User Identifier' field, in the next screen it automatically adds the agolshortname. With that the user can login via SAML

Now I have tested what you said above: Created a new built-in user with agolshortname appended. In the csv, didn't add the agolshortname (just email). Ran the script which created the new user with just email and assigned to groups etc. This user can login via SAML. However I got some traceback error related to old user, but nothing an issue.

Does this mean that the IDPusername (email) cannot be used in another AGOL account?

jskinner

@Thomas_Puthusserry do you see any differences with the user accounts created from the script, and the one created manually? A customer I'm working with ran the same script last week and noticed the SAML account created via the script did not append the _agolshortname to the SAML account since they did not have that specified in the CSV. However, the account still worked without the shortname. This may be different for different SAML IDPs, though.

Thomas_Puthusserry

@JakeSkinner After enabling SAML in the AGOL, the script is running and new user is created and all items / groups transferred to the new account. However the new user cannot login: get this error:

However, if I add a new user to connect via SAML then it works, which means the setup is correct. So why is that the user id created with script is not enabled to login?

jskinner

@Thomas_Puthusserry yes, I believe this may be a requirement for you to successfully create the SAML account.

Thomas_Puthusserry

@JakeSkinner The main idea behind using your script is to move the users to SAML authentication. However the AGOL org where I tried your script, the SAML authentication part is not yet configured. Wonder whether there is any such requirements prior to migrating users?

Thomas_Puthusserry

@JakeSkinner That was something I tried. Couple of different combinations, but nothing seems working (used a short email: surname@email.com) but same error

jskinner

@Thomas_Puthusserry within the CSV, remove the agol shortname from the new username. See if that works.

Thomas_Puthusserry

@JakeSkinner

I just tested this and it worked. I assume there is no restriction in the length of the user name?

GISLondon

Yes, that works manually

jskinner

@Thomas_Puthusserry are you able to manually create the user firstname.surname@email.com_agol_shortname?

Thomas_Puthusserry

@JakeSkinner I am trying to use the scripts to create a new user in AGOL and transfer the contents.

Step1. Created the built-in user list successfully. Used a built-in admin user account

Step2. Tried to create a new user ID from the list, for one user. However it failed. The message is:

Creating new standard user with id: firstname.surname@email.com_agol_shortname
Unable to create firstname.surname@email.com_agol_shortname

Tried with variations of the new username, but no success.

What could be the issue?

jskinner

@TarigAhmedTXHSDS,

This column should be populated if you have any Application licenses (i.e. ArcGIS Pro, Insights, Field Maps, etc) assigned to the user. Ex:

TarigAhmedTXHSDS

Thank you so much for the video and scripts.

We are preparing to move to IAMOnline authentication.

When I ran the script to get the users for Portal. I noticed the Apps column is empty!

Could you please help me?

Best regards,

--------------------------------------------------

Tarig Ahmed, GISP | GIS Administrator

SHARP DSHS-IT Analytics Team

tarig.ahmed@hhs.texas.gov | 469-261-0849

DSHS ArcGIS Online | DSHS ArcGIS Enterprise Portal

ErikNelson1

@JakeSkinner we determined that our python environment did not match our 10.9 Portal version.

The script ran successfully after running it in a python environment that was compatible with our Enterprise version.

jskinner

@ErikNelson1 can you test the below code on another machine that has ArcGIS Pro installed:

from arcgis.gis import GIS
gis = GIS(url="https://gis.organization.com/portal", username="username", password="password", verify_cert=False)

ErikNelson1

@JakeSkinner

Yes, we are able to sign into our Portal with the admin credentials we've entered in the script.
We do not have reverse proxies in place.
We tested creating another built-in Portal admin account, setting the security question, and using those admin credentials in the script but we're still encountering the same errors.

jskinner

@ErikNelson1 ,

1. Are you able to sign into Portal with the credentials you are providing in the script?

2. Do you have any reverse proxies in place?

3. Is there another built-in admin account you can try?

ErikNelson1

@JakeSkinner yes, we do have a security question set for the built-in account we're using

jskinner

@ErikNelson1 do you have a security question set for the built-in account you are using?

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.