Automatically assign User Type and Role based on AD groups

markovic_m

Hello,

We are using ArcGIS Enterprise with Active Directory authentication (LDAP/IWA) and we are looking for a way to automatically assign a User Type (license) and a Role to users based on their Active Directory group membership.

The expected workflow would be:

• A user belongs to one or more AD groups

• Each AD group is mapped to:

  • a specific ArcGIS User Type

  • a specific Portal Role (standard or custom)

• When the user logs in (or is created), the User Type and Role are assigned automatically

From what I understand, ArcGIS Enterprise does not natively support mapping AD groups to user types or roles.

Can anyone confirm:

1. Whether this is possible natively in recent versions of ArcGIS Enterprise?

2. If not, what is the recommended best practice?

Any feedback or real-world experience would be greatly appreciated.

Thank you!

TravisSaladino

Another approach is to set up the ArcGIS Enterprise portal's group store to use AD. Then as a portal administrator, add all the users from an AD group to the portal. In this workflow you get to assign the user type and role for all the members you are adding from that AD group all at one time. 

See the Group Store Configuration help at https://enterprise.arcgis.com/en/portal/latest/administer/windows/use-your-portal-with-ldap-and-portal-tier-authentication.htm#:~:text=Directory%20group%20configuration%20information%20(in%20JSON%20format)%20in%20the-,Group%20store%20configuration,-(in%20JSON%20format)%20text%20box%20as%20shown%20below

This doc seem to be specific to making groups in ArcGIS Enterprise based on groups in AD, but it is not that limited. 

See the Enterprise help at https://enterprise.arcgis.com/en/portal/latest/administer/windows/add-members-to-your-portal.htm#:~:text=to%20the%20portal.-,Add%20from%20a%20group,-If%20your%20portal for the workflow.