topic Re: Unable to Generate Tokens using SAML enterprise accounts in ArcGIS Enterprise Questions

Unable to Generate Tokens using SAML enterprise accounts

tigerwoulds — Fri, 07 May 2021 01:48:04 GMT

Running a Federated 1081 Enterprise deployment with Azure AD as our identity store.

I am unable to generate a token using our enterprise login credentials. Tested from https://webadaptor.domain.com/arcgis/sharing/rest/generateToken

But I get this error:

TigerWoulds_0-1620351958762.png

It does work if I use a built in account that isnt tied to our IDP. Any ideas why this happening?

Re: Unable to Generate Tokens using SAML enterprise accounts

ChristopherPawlyszyn — Fri, 07 May 2021 13:21:01 GMT

When using an external identity provider via either SAML or OpenID Connect, Portal for ArcGIS (as the service provider) has no connection to the user's credentials. The authentication process is handled by the return of the properties within the SAML assertion/response and mapped to appropriate values within the Portal user's profile. With that being the case, token generation at the Sharing/REST endpoint is not possible for those users and would need to be generated via the OAuth2 mechanism. I've attached a common workflow for the Python API that explains the process in a bit more detail.

Hope that helps!

User authentication with OAuth 2.0 | Working with different authentication schemes | ArcGIS API for Python

https://developers.arcgis.com/python/guide/working-with-different-authentication-schemes/

Re: Unable to Generate Tokens using SAML enterprise accounts

tigerwoulds — Fri, 07 May 2021 19:10:56 GMT

Okay thanks. What's interesting is that we do have another 1081 deployment with Azure AD as our IDP - and I can generate tokens using enterprise accounts.

Re: Unable to Generate Tokens using SAML enterprise accounts

Carlos_ArturoSarmiento_Royero — Thu, 23 Sep 2021 22:01:35 GMT

Hello friend, were you able to solve the problem? I have the same problem.

Re: Unable to Generate Tokens using SAML enterprise accounts

tigerwoulds — Fri, 24 Sep 2021 13:50:09 GMT

Unfortunately no. Here is my original problem that prompted this question. We were trying to generate a token to authenticate into a Web AppBuilder app. This did not work without using OAuth instead of generate token. Maybe this might help:

Re: WebApp Builder on IIS - Login only works with ... - Esri Community

Re: Unable to Generate Tokens using SAML enterprise accounts

Carlos_ArturoSarmiento_Royero — Fri, 24 Sep 2021 22:28:59 GMT

Thanks for your answer. Is it possible to somehow inject credentials through oauth so that the user does not have to authenticate through a page?

Re: Unable to Generate Tokens using SAML enterprise accounts

tigerwoulds — Sat, 25 Sep 2021 00:52:28 GMT

Other than making the app, map, and services public no. Depending on what you're doing, I've seen folks use a proxy file on a websever to bypass the login.

Proxy pages with the API | ArcGIS API for JavaScript

Re: Unable to Generate Tokens using SAML enterprise accounts

julian_svcs — Fri, 29 Oct 2021 00:54:47 GMT

I was able to implement the OAuth connection using the client_id. Is there a way to do this in an automated standalone python file (possibly through REST calls) which is seemless and does not require me to enter the OAuth2 approval code?

I want to be able to connect to multiple Portals via a script tool within a Toolbox.

Re: Unable to Generate Tokens using SAML enterprise accounts

MichaelNüßlein — Thu, 30 Mar 2023 08:26:06 GMT

Hi Julian,

your post is a little bit old in the meantime, still i want to ask if you have a solution for your problem? Because i have the same problem

Re: Unable to Generate Tokens using SAML enterprise accounts

julian_svcs — Thu, 30 Mar 2023 16:18:52 GMT

Hi @MichaelNüßlein. Unfortunately not if you are using enterprise logins through SAML. The automation only works if you use a built in Portal account.

Re: Unable to Generate Tokens using SAML enterprise accounts

Scott_Tansley — Thu, 30 Mar 2023 20:44:07 GMT

At 10.9.x or higher, you can login to the admin pages using SAML2. Before then the portal admin pages needed a built in user.

Re: Unable to Generate Tokens using SAML enterprise accounts

MichaelNüßlein — Fri, 31 Mar 2023 06:21:59 GMT

Dear Scott,

thank you for your response. We are working with 10.9.1 and our SAML-login manually works good. But i want to use the SAML login within a script on linux to automatically test the validity of the SAML signin certificate.

Re: Unable to Generate Tokens using SAML enterprise accounts

Scott_Tansley — Sat, 01 Apr 2023 08:20:42 GMT

I'm not a Python expert, but I would imagine you would need to find a set of libraries for supporting SAML2 due to the many interactions. I'm not sure I've come across this use-case before. Typically, scripts, because they are not human and so use OAuth (ArcGIS Token) account. Note that SAML2 largely represents human users.

Re: Unable to Generate Tokens using SAML enterprise accounts

julian_svcs — Sun, 02 Apr 2023 22:10:12 GMT

@MichaelNüßlein, you may have seen this already, but here are all the options on how to connect using different authentication schemes:

https://developers.arcgis.com/python/guide/working-with-different-authentication-schemes/

Re: Unable to Generate Tokens using SAML enterprise accounts

AndresCastillo — Wed, 24 Jul 2024 22:38:36 GMT

I was trying to login to a saml account via arcpy signintoportal gp tool, but it is not supported:
https://community.esri.com/t5/arcgis-pro-ideas/support-for-enterprise-login-in-arcpy/idi-p/1015426

"We won't be able to support SAML logins because they can use different identity providers (PKI or IWA). The workaround already mentioned works—start ArcGIS Pro, sign in manually, and select the 'sign me in automatically' button"

Also, I tried authenticating directly to the saml account with the generateToken api, which is called by arcpy signintoportal under the hood, but also not supported:

https://support.esri.com/en-us/knowledge-base/problem-unable-to-generate-tokens-using-arcgis-enterpri-000029156

"This issue is by design. It is not possible to allow token-based security with SAML-authenticated accounts without undermining the security provided by the SAML identity provider."

Re: Unable to Generate Tokens using SAML enterprise accounts

AndresCastillo — Tue, 20 Aug 2024 14:22:32 GMT

https://community.esri.com/t5/arcgis-api-for-python-questions/pass-ad-login-from-arcgis-to-arcpy/td-p/852979