topic Re: Single Sign On experience with SAML on ArcGIS Enterprise ? in ArcGIS Enterprise Questions

Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Sat, 15 Feb 2020 08:32:53 GMT

Hello,

I am trying to figure out if it is possible to provide a single sign on experience in applications built with data from ArcGIS Enterprise that requires the user to authenticate on the plateforme.

Our portal is configured to use Enterprise Login via SAML with only one identity provider so users do not have any choice on the "sharing/rest/oauth2/authorize" page but to sign in to our IDP. I think it would make sense to forward them straight to the IDP but I believe it is not possible.

Many of our web applications are already secured with SAML and the map in the application built with secured data from ArcGIS Enterprise is just a small part of it. So once the user authenticate on the web application, the map does not show up because they have to authenticate once again to ArcGIS Enterprise. Users are a bit confused (I thought I was already signed in ?!) as there are used to the SSO experience.

I found out how to get rid of the authorization form "Request for Permission" by adding the web application to the "App Launcher" settings (too bad there is not a dedicated setting for that because ideally I would not want the app to be in the app launcher of ArcGIS Enterprise but just to be configured as "will not prompt members with the 'Request for Permissions' dialog" but that is just a small detail), but I cannot find a way to force the authentification to the IDP.

Any idea ? Did I miss anything ?

Thanks for your feedback !

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Mon, 24 Feb 2020 07:59:18 GMT

No thought ?

Does not seem like a use case for an organisation using SAML and Portal for ArcGIS with secured data ?

Thanks !

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

KarlieFreeman — Mon, 24 Feb 2020 17:26:14 GMT

I am following along because I would also like to know if anyone has found a solution to this.

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Wed, 26 Feb 2020 21:14:29 GMT

One dirty workaround I found is editing "signing_default.html" file located for 10.7.1 to simulate the click on the enterprise login, located on Windows:

C:\Program Files\Arcgis\Portal\framework\webapps\arcgis#sharing\WEB-INF\classes\oauthsignintemplates

By adding the following javascript code after "signIn.startup(oAuthInfo);":

var signInButton = document.getElementsByClassName("js-entlogin")[0];
if (signInButton)
{
signInButton.click();
}

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Thu, 27 Feb 2020 10:30:44 GMT

A slightly better but it is still editing a file we are not supposed to:

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>Sign In</title>
<script src="${contextPath}/files/scripts/detector.min.js"></script>
<link rel="stylesheet" href="${contextPath}/files/css/site.min.css">
<script src="${contextPath}/files/scripts/oauth2.js?v7.1.4"></script>
</head>
<body>
<div class="content-container"></div>
<form id="oauth" method="post" action="" class="hide">
<input id="oauth_state" value="" name="oauth_state">
<input value="true" name="authorize">
</form>
</body>
<script>
var oAuthInfo = ${oauthInfo};

document.getElementById("oauth_state").value = oAuthInfo.oauth_state;
var oauthForm = document.getElementById("oauth");
oauthForm.action= oAuthInfo.federationInfo.idpAuthorizeUrl;
oauthForm.submit();
</script>
</html>

Needless to say that it is not supported, a backup of the original file should be made, and I did not test very thoroughly: it is just a proof of concept as so far I did not find any better solution

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

SusanZwillinger — Thu, 26 Mar 2020 15:09:03 GMT

Nicole,

We ended up using a third party option from Rock Solid Knowledge Ltd in the UK (https://rocksolidknowledge.com). The component is called "SAML2P for IdentityServer 4". It is not inexpensive (we paid the US dollar equivalent of 3,000 pounds), but it worked well for us.

Let me know if you need more details.

Regards,

-Susan-

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Thu, 26 Mar 2020 16:05:35 GMT

Many thanks for quick reply Susan Zwillinger‌ !

Definitely interested to have more information about this component and specially your deployment with the ArcGIS Enterprise component.

So if I understand correctly, you configured your Portal for ArcGIS "Enteprise login" to use the "SAML2P for IdentityServer 4" identity provider but then how does it prevent ArcGIS Enteprise from displaying a sign in page when non logged in as you mentioned on your thread:

Can single sign on be achieved using OpenID Connect with a SAML add-in for ArcGIS Enterprise/Portal?

How did you get rid of it in order to make the authentification to the identity provider automatic and thus provide an SSO experience ?

Thanks

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Fri, 03 Apr 2020 14:06:48 GMT

Hello Susan Zwillinger‌,

Any update on this question ?

Thanks !

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Tue, 30 Jun 2020 17:39:34 GMT

Just upgraded to 10.8 and ... good news this feature has been implemented !

By this feature, I mean, quoting from my original question:

"Our portal is configured to use Enterprise Login via SAML with only one identity provider so users do not have any choice on the "sharing/rest/oauth2/authorize" page but to sign in to our IDP. I think it would make sense to forward them straight to the IDP but I believe it is not possible."

=> if you have only one identity provider, you are automatically redirected to this IDP. No more additionnal popup. That is to say if you're application is secured by this IDP, you can have an SSO experience !

I did not find anything related to that feature in 10.8 release note but it is very good news !

Thanks ESRI

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

Ranga_Tolapi — Mon, 23 Nov 2020 07:28:51 GMT

We’re using ArcGIS 10.8.1, problem still persist.

Even though only Enterprise login (Azure AD) is configured at ArcGIS portal, getting challenged by 2 additional dialogs, 1st one is for sign-in and 2nd one is for permission. Please refer to the enclosed screenshots.

To enable smooth Single Sign-On for our application, these both dialogs were impacting the user experience. How to suppress both the dialogs?

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Wed, 25 Nov 2020 20:00:04 GMT

For the permission dialog, I think you have to add it to app launcher as described on my post:

"I found out how to get rid of the authorization form "Request for Permission" by adding the web application to the "App Launcher" settings (too bad there is not a dedicated setting for that because ideally I would not want the app to be in the app launcher of ArcGIS Enterprise but just to be configured as "will not prompt members with the 'Request for Permissions' dialog" but that is just a small detail)"

Regarding the sign-in dialog, I don't understand. I stopped having this problem at 10.8.1.

Will do some tests again

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

Ranga_Tolapi — Thu, 26 Nov 2020 03:04:35 GMT

Noted with thanks @NicolasGIS, I will try adding web application to the "App Launcher".

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Thu, 26 Nov 2020 14:02:15 GMT

@Ranga_Tolapi , following your message I ran additional tests and the outcome is quite surprising:

- Install ArcGIS Enteprise 10.8, configure Enterprise login only => no sign-in dialog

- Install ArcGIS Enteprise 10.8.1, configure Enterprise login only => sign-in dialog is displayed (your case)

-Install ArcGIS Enteprise 10.8, configure Enterprise login only and upgrade to 10.8.1 => no sign-in dialog (my case)

So it seems like it worked out by chance at 10.8 but is no longer reproductible... As I said, I had not found anything in the release notes about this so it's not very surprising... But it's too bad !

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

HeatherM_JDI — Fri, 06 Aug 2021 18:48:58 GMT

Hi NicolasGIS! Is this still working for you? We are suffering the same pain...

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

HeatherM_JDI — Fri, 06 Aug 2021 18:57:12 GMT

Hi @SusanZwillinger are you still using this?

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

SusanZwillinger — Fri, 06 Aug 2021 19:18:58 GMT

Hi @HeatherM_JDI, I don't think we are using the SAML2P for IdentityServer 4 add-in now. We upgraded to 10.8 and the client is now using an SAP portal for authentication. Users have the option to log in via SAP or through a local user account (similar to the way that it was when we were using the add-in).

Re: Single Sign On experience with SAML on ArcGIS Enterprise ?

NicolasGIS — Fri, 06 Aug 2021 19:37:22 GMT

Hi,

this issue is solved at 10.9 (for SAML provider only and not OIDC unfortunately).

Otherwise in 10.8.1 it does not work except if you upgrade from 10.8 as explained on my post !