nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Add support for retrieving SAML groups, when Azure AD is the SAML IDP and a user’s group membership exceeds 150.

s.schuette_ct

When an Azure Active Directory (AD) based Security Assertion Markup Language (SAML) user logs in to ArcGIS Online or ArcGIS Enterprise and is a member of more than 150 groups, the user's group claim is missing from the SAML assertion. As a result, that user is not added to any SAML-based enterprise groups in ArcGIS Online and/or ArcGIS Enterprise.
Azure AD limits the number of groups that can be sent in a SAML assertion response to 150. For more information, please see the Microsoft article titled "Configure group claims for applications with Azure Active Directory ".
Due to an update to AzureAD in late 2020, this is no longer a viable workflow. The limit of 150 groups is now a hard maximum leading to renewed demands for ArcGIS Enterprise to support the Microsoft Graph API for organizations with expansive group structures.

ENH-000142837

When Azure AD is the SAML Identify Provider, the Group Attribute is Missing from the User'

Microsoft Entra ID limits the number of groups that it will emit in a token to 150 for SAML assertions and 200 for JWT. If a user is a member of a larger number of groups, the groups are omitted. A link to the Microsoft Graph endpoint to obtain group information is included instead.

Configure group claims for applications by using Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

It is important that a mechanism to obtain all group information for use in ArcGIS is implemented.

Requirement: The IdP has to be the authority on groups, as they need to automatically update. Manual group mappings or creation of Groups within ArcGIS are no suitable solutions.

Find more posts tagged with

Open

Status: Open

Comments

ryanuthoff

Yup, we found out about this one the hard way. We had to completely abandon Azure groups due to this. Would love to have support for this again.

s.schuette_ct

Discussion:

Has anyone had issue with Azure passing users groups to Enterprise? - Esri Community

idp/Documentation/SAML/Configure Azure Entra ID.md at main · Esri/idp · GitHub

BUG-000123928 for Portal for ArcGIS

AlfredBaldenweck

It may be easier for you to semi-manually manage the groups by AD group, rather than having it go entirely automatic.

I have a script that checks AD group membership and manually adds the missing members to appropriate groups. I never bothered writing the side to remove members once they're no longer in the AD group, but I like it because I can schedule it as frequently as I want, as well as being able to make sure that the AD groups' members are in the right group. Because I never built the "remove" function, I can also add other people manually to the groups if I want without adding them to the AD group (and then also the folders that group can access). In any case, adding that remove function would not be super hard but I had no use for it.

Pardon my mess, but if you're interested…

import arcgis

import arcpy

import sys

sys.path.append(r"pathtowhereyouinstalledPYAD\modules")


from pyad import pyad

from pyad import adquery

def am(thing):

    arcpy.AddMessage(thing)

    print(thing)

    return



def addtoGp():

    '''


    :return:

    '''


    # Need to figure out authentication to do this across multiple

    # portals.

    ptlLkUp = {'Portal1': 'https://yourORG1.arcgis.com',

               'Portal2': 'https://yourORG2.arcgis.com',

               }


    # gpDict = {ADGroup: {"portals": {"portal1" : Group ID},

    #                     "members": [member list]}}

    gpDict = {

        "ADGroup1": {

            "portals": {"Portal1": "4b79e3e7f2114f2bbd0012a0ce24ee73"}

        }   

    }


    prtlDict = {}  # portal: {groupID: [member list]}

    # Get members for each group.

    for gp in gpDict:

        grpDN = pyad.from_cn(gp)._ADObject__distinguished_name

        gpDict[gp]["members"] = list(getAdMems(grpDN))


    # Shuffle into portals

    for gp in gpDict:

        for prtl in gpDict[gp]["portals"]:

            gpID = gpDict[gp]["portals"][prtl]

            gpMembers = gpDict[gp]["members"]

            if prtl in prtlDict:

                prtlDict[prtl][gpID] = gpMembers

            else:

                prtlDict[prtl] = {gpID: gpMembers}


    for portal in prtlDict:

        gis = arcgis.gis.GIS("HOME")  # portal signin idk how to do it yet

        for group in prtlDict[portal]:

            prtlGP = arcgis.gis.Group(gis, group)

            mems = prtlDict[portal][group]


            # It doesn't throw an error if the user doesn't exist.

            # Less validation on our end :)

            prtlGP.add_users(mems)

    return


def getAdMems(grpDN):

    '''

    Gets members of the given AD group.

    :param grpDN: ADGroup

    :return: List of members of given AD group.

    '''

    totalusers = set()

    q = adquery.ADQuery()

    whereClause = f"memberof = '{grpDN}'"

    q.execute_query(attributes=["distinguishedName", "mail"],

                    where_clause=whereClause,

                    )

    for i in q.get_results():

        dN = i["distinguishedName"]

        email = i["mail"]

        if ("OU=groups" in dN):

            totalusers.update(aquery(dN))

        else:

            totalusers.add(email)


    return totalusers


addtoGp()

There's also this set that I use to generate the groups in the first place, which is how I got the group IDs above.


def genGpDict():

    '''

    Generates dictionary of groups to be created.


    :return: dictionary of groups

    '''

    abbrev = {"AdminBound": "Administrative Boundaries",

              "Cad": "Cadastral",

              "Carto": "Cartography",

              "Clim": "Climate",

              "CultRestrict": "Cultural",

              "Energy": "Energy",

              "Facil": "Facilities",

              "Fire": "Fire",

              "FluidMin": "Fluid Minerals",

              "Forest": "Forestry",

              "Fuels": "Fuels",

              "Geol": "Geology",

              "Haz": "Hazardous Materials",

              "Hydro": "Hydrology",

              "Invspe": "Invasive Species",

              "LERestrict": "Law Enforcement",

              "Lands": "Lands",

              "ManageRestrict": "Management",

              "Oth": "Other",

              "Plan": "Planning",

              "Range": "Range",

              "Rec": "Recreation",

              "Socio": "Socioeconomics",

              "SolidMin": "Solid Minerals",

              "Specdesg": "Special Designation",

              "Trans": "Transportation",

              "Veg": "Vegetation",

              "Vis": "Visual Resources",

              "Whb": "Wild Horse and Burro",

              "Wildlife": "Wildlife"}


    gpDict = {}

    fos = {'ADPrefix1': ["Office 1", "OFF1"],

           'ADPrefix2': ["Office 2", "OFF2"]}

    for fo in fos:

        for abb in abbrev:

            adgp = f"{fo}{abb}"

            gpName = abbrev[abb]

            gpNameClean = gpName.replace(" ", "_")

            fAbb = fos[fo][1]

            fName = fos[fo][0]

            gpDict[adgp] = {"title": f"{fAbb}_{gpNameClean}",

                            "description": f"{gpName} group for the {fName}",

                            "access": "private"}

    return gpDict


def generateGps(portal = "Portal1"):

    '''

    Generates the group for the given portal.


    :param portal:

    :return:

    '''


    # Figure out good authentication protocol or just do this manually.

    gis = arcgis.gis.GIS('HOME')

    gpDict = genGpDict()


    gpIds = {} # to get the group ID to put in the membership part.

    for gp in gpDict:

        title = gpDict[gp]["title"]

        gpList = gis.groups.search(f'title:{title}')

        if len(gpList) > 0:

            gpIds[gp] = {"portals": {portal: gpList[0].id}}

            continue

        newgroup = gis.groups.create_from_dict(gpDict[gp])

        gpIds[gp] = {"portals": {portal: newgroup.id}}


    print(gpIds)

    return


generateGps()

I would also looooooooooooooove to know an easy way to switch portals, if anyone knows. I was only working on two portals (AGOL and Enterprise), but my organization has at least 22.

Aled Wyn Jones

@s.schuette_ct Esri have published a workaround for this using the Graph API:

idp/Documentation/SAML/Configure Azure Entra ID.md at main · Esri/idp · GitHub

This works around the 150 group assertion limit. I believe another workaround is to scope group assertions per Entra ID application. It's called "Azure group filtering options" as mentioned on that github readme.

s.schuette_ct

@Aled Wyn Jones Thank you. I`d prefer to have documentation like this as part of the official documentation.

ryanuthoff

Perhaps this Esri technical support article should be updated to include this workaround. https://support.esri.com/en-us/knowledge-base/when-azure-ad-is-the-saml-identify-provider-the-group-a-000022190

The support article indicates that there is no workaround and that 150 groups is the hard limit. But according to you, there is a workaround.

I also agree with @s.schuette_ct that this should be a part of the official documentation. I never would have found this on a random github site. Doing any sort of internet search like "esri portal saml 150 group limit" does not pull up that github site either.