topic Re: Connect with SSO on Experience Builder application deployed in Enterprise in ArcGIS Experience Builder Questions

Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Wed, 25 Oct 2023 14:14:43 GMT

Hello, I try to develop my application in Experience Builder Developer.

I I successfully deployed my application to my Portal but when I share the link to my colleagues, they can't access to my application.

I set the share parameter of the layer in the application to "Organization only" because we don't want to publish data.

So when they click on the link, a pop-up asks them to enter their username/password to access to the application. But we use SSO with our Windows session IDs. If we use it to log in and use the app, it doesn't work.

How can we configure all of this so that the login/password request is SSO?

Re: Connect with SSO on Experience Builder application deployed in Enterprise

AngelaSchirck — Thu, 26 Oct 2023 12:39:03 GMT

I'm not quite sure what you mean, how do YOU log in? We use an SSO, to login to Enterprise we click the link to our SSO, then put our SIM credentials. See image:

Which takes us here:

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Thu, 26 Oct 2023 12:42:09 GMT

Yes I know about that. But when I share the link of my arcgis experience builder, the application ask my users to type a login/password in a pop-up, not in the same windows that your screenshot is.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

AngelaSchirck — Thu, 26 Oct 2023 12:46:37 GMT

Oh, i know, something like this:

Did you use developers ed of EB? Can the people in your org sign in first and then access the app?

I'm not sure how to get around that...This might be a question for ESRI Support.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Thu, 26 Oct 2023 12:52:17 GMT

Yes exactly that !

And yes I use developer edition of experience builder.

If people sign first in their account, they can access to the application. But it would be better if when I send a link to my colleagues, they can also choice to connect by the SSO and not with this strange login/password popup.

I think I have to contact ESRI support.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

AngelaSchirck — Thu, 26 Oct 2023 12:53:49 GMT

One way around it...in our org we created an "admin" user that logs in directly not using the SSO. So if I log in with this account it works. You could possibly do that and give your colleagues these login credentials to view the app.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Thu, 26 Oct 2023 12:59:52 GMT

It could be a solution but not in long-term approach. If anyone move out of the society, we have to change the ID's. And this, everytime anyone leave the society.

Thanks for the idea !

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JeffreyThompson2 — Thu, 26 Oct 2023 13:02:21 GMT

That sounds super dangerous. I would not recommend that.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Thu, 26 Oct 2023 13:04:15 GMT

you mean about security ? I take note of your prevention.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JeffreyThompson2 — Thu, 26 Oct 2023 13:12:21 GMT

The suggestion above gives everyone a password that gets around whatever safeguards are on your company's SSO and gives them Admin access to your ArcGIS Enterprise. A malicious actor could literally destroy your entire Enterprise. And as it is a shared password, they could log in months after they got fired, blow up your system and you would never be able to prove who did it.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Thu, 26 Oct 2023 13:15:08 GMT

omg ok. not a good idea.

I will contact the support to understand if there is a possibility to get the SSO connexion windows just by clicking on the application link.

Thanks for your warning.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

AngelaSchirck — Thu, 26 Oct 2023 14:03:55 GMT

Yes, we don't give this information out to EVERYONE, just our GIS employees.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

abureaux — Fri, 19 Jan 2024 18:34:10 GMT

Experience Builder version 1.13?

There is apparently a bug starting in 1.13 that causes the behaviour you are seeing. The bug (BUG-000163104) is already scheduled to be fixed, but no date given yet. I am hoping it's fixed in 1.14 though.

I just had this issue and had to get assistance from Esri. Experience Building is supposed to just "know" what authentication method your Portal is using and then copy that, so no configuration should be necessary (as opposed to WAB where you had to change a hidden setting).

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Fri, 19 Jan 2024 19:17:16 GMT

Hi, I have the same problem previously on the version 1.12.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

abureaux — Fri, 19 Jan 2024 19:27:57 GMT

Darn! I'm not sure then.

May be worth a call to Esri since SSO should be working in 1.12. The only requirement they mentioned was that your portal needed to already be set up with SSO, and Experience Builder needed to be tied to that specific portal.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Fri, 19 Jan 2024 19:36:12 GMT

with esri support we found a solution but it create some bug on the application at the first connexion (corrected by a refresh)

the solution : Going on organization settings > Security Panel > Uncheck the connexion with ArcGIS ID's in the "Identifiers" subcategory (sorry i don't have the exact name of the panels because i'm with french language).

With this changement, the connexion with SSO works but when a user going on the application at the first time per utilisation, he can't see the information on the application (map is empty, no filter appears, etc.)

Re: Connect with SSO on Experience Builder application deployed in Enterprise

abureaux — Fri, 19 Jan 2024 21:25:52 GMT

Do you mean this option?

If so, I am unable to change that setting as we have a few built-in accounts still.

If rolling back to 1.12 doesn't give me what I want, I guess I'll call Esri support back and see if they have another suggestion.

(And no worries about not having the exact names. Your English is far better than my French!)

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Mon, 22 Jan 2024 08:24:58 GMT

Yes, this option.

Below this option, if you have a SSO option, you have the option to check it. But if you have already people who log in your Portal without SSO i have no idea to solve this.

Call the Esri Support is the best solution I think.

Re: Connect with SSO on Experience Builder application deployed in Enterprise

abureaux — Thu, 08 Feb 2024 17:09:56 GMT

Esri gave me misleading advice on this one. But I am more surprised that I didn't stumble across this KB sooner...

So EB works like WAB in that you need to add the AppID to your exported EB. Check out steps 4-6 here.

This gives you an SSO popup (assuming you are configured for SSO). The one thing that I seem to be missing is the popup component... assuming it still exists. In WAB, it was jimu.js > tokenUtils.js > popup: false,

Re: Connect with SSO on Experience Builder application deployed in Enterprise

JasonBOCQUET — Mon, 12 Feb 2024 09:48:30 GMT

Hi @abureaux thanks for your answer. I already do that; the AppID is correctly writted on the config.json files.

Have I said before, the problem was solved by uncheck "ArcGIS Login" option.