nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Identity Mangement: Leverage Portal User Store

Todd_Metzler

Please enable identity management in ArcGIS Monitor to leverage ArcGIS Enterprise Portal user store. Our organization is about to enable viewer and, possibly, manager permissions to a expanded group within our IT department and our end user department GIS leaders. Our IT Enterprise security model discourages any authentication that is not named user based and validated with MFA. User name and password use is limited by policy. Since the ArcGIS Portal identity management component is already approved for our use, this would be the ideal mechanism to leverage extending this component to ArcGIS Monitor.

Vind meer berichten getagd met

Closed

Status: Closed

Reacties

PatriceLabbé

I totally agree that we should be able to federate an ArcGIS Monitor instance to ArcGIS Enterprise so user authentication / authorization would be managed by the portal (allowing internal identity store and/or SAML and/or OpenID Connect).

This would also solve an issue with ArcGIS Monitor tokens used with collection feature services. Portal should be able to expose those services and manage access.

Specific privileges to ArcGIS Monitor (admin, manager, viewer) should be added to Portal too.

DerekLaw

At this time, there are no plans to enable ArcGIS Monitor to support logins using the enterprise portal identity store. This is not a good approach. The purpose of ArcGIS Monitor is to collect metrics on the system health and performance of ArcGIS Enterprise. If Monitor's logins were based on the enterprise portal identity store, then if portal were to become unavailable, this would affect Monitor. This is not a system architecture best practice. Monitor needs to be independent and separate from the components it is monitoring. So if portal were to become unavailable, Monitor would still continue to work and can inform admins the exact time when portal went offline.

FYI, we do have in the Dev backlog to support alternate login authentication options such as SAML, IWA and LDAP.

Hope this helps,

PatriceLabbé

Hi @DerekLaw,

I think if Portal is down but Monitor is up, the internal identity store of Monitor would still be usable.

So an ArcGIS Monitor admin or other internal identity store users would still be able to access it.

And maybe if Portal is down, we have a bigger issue to deal with?

My suggestion would be to be able to federate ArcGIS Monitor to Enterprise and still keep the internal Monitor identity store in the product.

joyoung_kerrvilletx

@Todd_Metzler I have an idea open for adding SAML support to ArcGIS Monitor. https://community.esri.com/t5/arcgis-monitor-ideas/add-support-for-saml-or-open-id-logins-to-arcgis/idi-p/1709340/jump-to/first-unread-message

Our organization is trying to reduce the number of "identity stores" that we have to use for both improved security and ease of use. For us, the solution is using SAML where possible to tie back to one identity store as much as possible.

Doe mee aan het gesprek

Meld je aan om te posten, content te volgen en meer. Nieuw hier? Registreer gratis.