topic Re: Automate Enterprise with Active Directory in ArcGIS API for Python Questions

Automate Enterprise with Active Directory

chill_gis_dude — Thu, 01 Feb 2024 22:50:15 GMT

Hey all,

I am curious if anyone can speak on the subject of automating users in their enterprise deployment with active directory? I am the sole admin & publisher for my company's enterprise deployment, all of ours users are added manually by me as viewers, with the occasional mobile worker/data editor. I'd like my enterprise user list to basically sync with our company's windows active directory. Our IT has added a field in AD for what groups people can access in portal so the end goal is have AD drive what groups people can access in enterprise. I am familiar with python so that is a possibility. Right now I add people manually by clicking "add members based on existing enterprise users" shown in the image below. Thanks for any input!

Re: Automate Enterprise with Active Directory

AbeCoughlin — Thu, 01 Feb 2024 23:11:18 GMT

First, Active Directory or the full SAML piece? It sounds like the full SAML piece if you're talking about Windows groups.> Settings > Logins you have to set up the SAML configuration.

Then, in the Group, you have to enter the group identifier that you've chosen to use in AD (name, GUID, etc).

And of course, the Windows pieces have to be setup in AD first.

We've done straight AD without SAML before, we're on SAML for logins now and we're about to implement SAML for groups (tests are successful).

Abe.

Re: Automate Enterprise with Active Directory

Brian_Wilson — Fri, 02 Feb 2024 00:23:09 GMT

We have it set so that people get added to Enterprise the first time they login with Active Directory. We have 2 "admin" accounts that are in Enterprise, everyone else is normally a "Viewer" and if we need them to have more rights then we have them add themselves and then we bump up the account to whatever level they need. Works fine.

Re: Automate Enterprise with Active Directory

chill_gis_dude — Mon, 05 Feb 2024 16:51:58 GMT

Thanks Abe! Looks pretty efficient, I'll have to look into this. I'm not familiar with our AD setup so I'm going to reach out to our IT to see if we have SAML.