AGOL: OIDC username not consistant with SAML username

Question

Hello,

Now that group membership have been enabled on AGOL for OIDC provider, we would like to switch authentication provider from SAML to OIDC.

But I noticed a difference of behavior between SAML and OIDC providers which is a bit confusing.

Let's say my organization username is "guineapig" and my organization name is "MYORG" (ie: AGOL URL is https://MYORG.maps.arcgis.com)

Currently, if I log in with SAML, my AGOL username will be "guineapig_MYORG" which is fine.

But if I log in with OIDC, my AGOL username will be "guineapig4" solely. As you can see, an integer was added at the end because "guineapig" already exists in AGOL as a built-in account so my username is mapped to "guineapig4" instead of "guineapig" or "guineapig_MYORG".

I would prefer the SAML way of adding the organization suffix to make it unique. I looked everywhere and it does not seem to be configurable. But why is there this difference of behavior ?

Is that a BUG or a feature ? I am confused.

Thanks,

Nicolas

NicolasGIS · Answer

@RajkumarPadmanabhan, do you now understand the issue and the difference of behavior ? Any logical explanations to that ? We just have a fresh AGOL instance created in Europe for privacy reason and would like to start on a good foot with OIDC but we can't because of this.

User will wonder why am I `alastname7823`  ?  So we are considering back SAML as idp which would be a step backward. On ArcGIS Enterprise, we do not have this issue of course.

Any recommandations ? Should an Idea be created ? A support case ?

Thanks

NicolasGIS · Answer

Thanks for your reply @RajkumarPadmanabhan . I would like the same user format. Not an issue about migrating from SAML to OIDC. Do you see what I mean ? Did I miss anything documentation wise ? Thanks

RajkumarPadmanabhan · Answer

@NicolasGIS Do you just desire the userame formats to look similar or are you hoping to reuse the same account when migrating from SAML to OIDC (in order to avoid the need to transfer data\roles\etc)?