nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Configure OpenID Connect logins

RomanBoros

Hi,

We are trying to setup an OpenID Connection to our ArcGIS Online.

All the necessary configurations were done on our Identity Provider and in the ArcGIS Online admin panel.

The button appeared on the login screen and after pressing we are redirected to the Identity Provider. After successful authentication the server redirects back to the portal and an error message is displayed.

Did not receive 'user profile' parameter from the provider.

Can you provide more details what might be the problem?

This is the response format that the identity provider returns from the user info endpoint

As Identity Provider we are using Identity Server 4.

The grant type for this client is authorization_code

We tried looking into documentation, but there is nothing about this error.

Thanks for your help.

Encuentra más publicaciones etiquetadas con

Administration

Accepted answers

ChristopherPawlyszyn

Another possibility may be that you haven't selected the option to include the access token in the header of the authentication request. I had the same issue on an ADFS 4.0 OpenID Connect configuration I was working on earlier in the week.

All comments

TomRussell1

I'm facing the same issue using the Keycloak IDM, we had previously used Keycloak's SAML integration but would like to transition to OIDC to align with other applications in our environment

RomanBoros

Unfortunately, SAML is not an option for us at the moment.

Our guess is they are expecting some non-standard parameter to be returned in the token.

ChristopherPawlyszyn

That error message typically means that the scopes are not being released to the service provider. Depending on whether you've specified those scopes in the OIDC configuration for ArcGIS Online/Portal for ArcGIS, you may need to remove them and potentially add other scopes if your provider is not set to allow the listed scopes to the service provider for the registered application.

RomanBoros

I do not think that is the case.

In the OIDC configuration we have "openid email profile" and I can confirm that the client in the Identity Server is setup in the way to allow those scopes.

ChristopherPawlyszyn

RomanBoros

Should I look for that option in the ArcGIS Online/Portal or on the Identity Server?

On the server the closes thing there is this parameter and that is set to true.

RomanBoros

After another attempt we found that parameter.

Setting that to true was the solution.

For anyone still wondering, you can find that at the bottom, when you try to edit the configuration.

Organization -> Settings -> Security -> Logins-> Configure login

MarkCederholm

I'm playing around with IdentityServer4 as an OpenID Connect source, and I am getting the same "user profile" error, although it works fine for a MVC client that uses the same parameters as ArcGIS Online. Next I created a custom IProfileService implementation to see if it's actually being called, and again it works fine for the MVC client, but with AGOL only IsActiveAsync is being called (and returning true); GetProfileDataAsync is never called.

pocalipse

Hi Mark

Did you find a solution for the OpenID problem - I have the exact same issue using KeyCloak!

HaraldLund

This will probably not help you directly, but I have a customer who were able to setup KeyCloak with ArcGIS Portal 10.9, but I do not have any details on the configuration. But when I was setting up the Okta setup, I also struggled with this error. I ended up with not checking the "Send access token in header", setting the UserInfo URL to empty but filling out the JWKS url. With the Okta configuration I uses Client Credential and Authorization Code. I also had to make sure the Claims where mapping correctly. I also have a sub claim added.

pocalipse

I think my problem is exactly the mapping - did you manage to figure out what claims ArcGIS is expecting?

MarkusSchenardi

has anybody solved this problem?

AriannaArona

Hi everybody,
I reopen the issue because I'm experiencing the same problem, but "send access token in header" is enabled and I set as "ArcGIS username field/claim name" email, that is returned from oidc system

claims: {
nickname: 'xyzxyzxyz xyzxy',
sub: 'XYZXYZXYZXYZXYZXYZXYZXYZXY',
given_name: 'xyzxyzx',
email: 'xyzx@xyzx.xy',
family_name: xyzxy'
]
},

Any suggestion?
Thank you all,
A.

SotiriosSoulantikas

Looks like this issue has not been resolved. I am trying to use Keycloak as IdP and enable login to our Portal via OIDC . I keep getting did not receive 'user profile' parameter from the provider no matter what I try 😞

As a side note, the keycloak endpoint at `protocol/openid-connect/userinfo` works but only after I manually added an `openid` client scope and enable include in token scope.

Any ideas?

I don't want to go back to SAML.!

HaraldLund

Hi, if you read through this in detail again, you should be able to establish and use OIDC:
https://doc.esri.com/en/arcgis-enterprise/latest/deploy/openid-connect-logins.html?pivots=os-windows
We have set up OIDC for several solutions using EntraID, and I also have been able ti set this up with Keycloack, but that was several years ago. Try without the use of pkce and make sure Keycloak passes the scopes. You may also troubleshoot with fiddler to see the traffic https://github.com/Esri/idp/blob/main/Documentation/OpenID/Troubleshooting%20OpenID%20Connect%20logins%20ArcGIS%20Enterprise.md

SotiriosSoulantikas

Thanks, @HaraldLund for this! 🙂

I have been playing around with the settings to no avail. I'd be curious, however, about the actual meaning of that error message. The Portal logs do not cast any light.

What is this 'user profile' parameter? What was the response like that did not contain that 'user profile' param? Does it actually use the userifo endpoint?

Curious 😄

SotiriosSoulantikas

I should have mentioned that my IdP instance is not publicly accesible.

However, I don't see how that would affect things, especially since the Portal is the same network, unless it's "phoning home" somehow.

Únete a la Conversación

Los miembros registrados pueden publicar, seguir actualizaciones y más. ¿Nuevo aquí? Regístrate gratis.

Enlaces Rápidos

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.