topic Re: Implementing ArcGIS Online Enterprise Logins with Existing Users in ArcGIS Online Questions

Implementing ArcGIS Online Enterprise Logins with Existing Users

ChrisTaylor — Mon, 09 Feb 2015 15:21:46 GMT

Hello,

We are looking into setting up enterprise logins using ADFS for our organization, but have many existing users. In the early days of our ArcGIS Online organization we thought we were being helpful by trying to match new users' accounts to their AD usernames. I remember hearing somewhere along the way that if we ever went to enterprise logins we would have to copy any affected user's content to a new & different user, delete their old AD-matched account, then copy the content back to their true ADFS account once EL has been implemented.

My question is how exactly does this all play out? There's no real development environment to AGOL so I'd like to know what I'm facing before I try it. Do all of the current AD-matched accounts have to be eliminated before we configure EL and 'flip the switch' so to speak? If ELs are enabled with AD-matched accounts still out there, will it cause conflicts or issues?

Thanks for your help.

Chris Taylor

GIS Web Developer

City of Kingston, ON

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

BrianO_keefe — Wed, 17 Jun 2015 15:02:24 GMT

It would be of interest to me as well to get an answer to this question. Any information would be helpful.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

VenusScott — Wed, 17 Jun 2015 15:37:28 GMT

Chris,

This is super easy to convert to. We had several users and each had several maps/apps with them. Once we implemented the enterprise logins it was very simple to import a list (or in a batch mode):

Once the users accepted it's super easy to "transfer ownership" of their maps/apps by selecting them all and use the "Change Owner" option:

You also have the option to create the same folder structure they have:

Once I moved everyone and everything over I deactivated (not delete) the old access.

LOVE not having to maintain users short of inviting them!

Venus Scott

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

RebeccaStrauch__GISP — Wed, 17 Jun 2015 15:42:47 GMT

There are some tools available, both free and paid, to help with this process. you can read more about them here

Tools · Esri/ago-admin-wiki Wiki · GitHub

and a blog post about some of these ArcGIS Online admin tools available on GitHub | ArcGIS Blog

I may eventually face the same thing, that is, moving users content to a AD account name, but so far I've not used the same AD account for AGOL account, (except for one of my, admin accounts) so I haven't gone thru the process. I have used some of the esri tools for moving constant however.

Edit: I like Venus' answer Above.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

BrianO_keefe — Wed, 17 Jun 2015 15:45:04 GMT

So how do you update this list?

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

BrianO_keefe — Wed, 17 Jun 2015 15:45:15 GMT

I'm curious, with my organization we have roughly 5,000 users. Obviously not everyone would ever even KNOW about ArcGIS.com, much less try to log in... but...

I thought that with the new 'credits' and AGOL accounts system starting to become the norm that the number of AGOL accounts was restricted to the number of specific licenses that organization utilizes. So if we were to incorporate this 'Enterprise Login' concept...

how would that affect our number of licenses vs AGOL accounts requirements?
Does this bypass those restrictions?
Does this require a different level of licensure?
Does each person that sign on use a license and if too many people are signed on the next person cannot sign on now until someone else signs off, like an implementation of an internal license server?
OR Do we grant a specific set of users an AGOL account and everyone else, even tho we've setup this Enterprise Login, won't ACTUALLY be able to sign in to AGOL until we purchase more licenses?

Really curious because this sounds like it would solve a lot of problems.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

RebeccaStrauch__GISP — Wed, 17 Jun 2015 15:59:01 GMT

Brian,

I'm in a similar situation....although only 300 users fir 50 AGOL/desktop licenses, but about 5000 users in the department...most (including managers) that have no clue about AGOL, unless the happen to link from our dept page or an email. I don't THINK federating active directory mean that all 5000 would need or get accounts (unless you purchase more). What I see this doing is not maintaining another, and possibly weaker, set of usernames and passwords. But, unless they announce a new way , it does not bypass the restrictions.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

VenusScott — Wed, 17 Jun 2015 16:26:50 GMT

Currently I get a monthly list of users who have left and compare it to our AGOL list of users. I will just deactivate the users at that point.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

BrianO_keefe — Wed, 17 Jun 2015 16:39:58 GMT

So is this process just allowing AGOL to verify username / password against an AD system then?

Or is this allowing an AD system to generate AGOL users?

I'm researching this as an option for AGOL account management.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

BrianO_keefe — Wed, 17 Jun 2015 16:42:21 GMT

Rebeca rebeca "What I see this doing is not maintaining another, and possibly weaker, set of usernames and passwords."

Is there better documentation on what this does or how somewhere? I need to know "for sure" what and how this works before it could even be considered. It APPEARS to be an amazing option that make a LOT of things simpler.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

VenusScott — Wed, 17 Jun 2015 16:50:42 GMT

Correct, it just verifies username / password against an AD system.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

VenusScott — Wed, 17 Jun 2015 16:59:33 GMT

Brian,

We have over 13k City employees but we only have 100 AGOL users. Most of what I call our GIS Super Users are the only ones I have set up on AGOL. These super users create maps for their departments and make them "public" for viewing purposes which uses no license. If it needs to be limited to just a "group" or department, our GIS Super Users have an AD group created to secure the feature/map service or only the small group of users are then added to AGOL.

I have yet to reach the limit on the number of licenses we have so I can't tell you what AGOL would actually do. ESRI staff please chime in here?

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

BrianO_keefe — Wed, 17 Jun 2015 17:43:03 GMT

First off... I'm jealous.

Having that many power users would be so nice. We are still on the ground floor when it comes to establishing GIS for our organization. So you just give all users an account? Or do you have a "department" account for publishing/editing maps/data that are department specific?

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

VenusScott — Wed, 17 Jun 2015 19:42:30 GMT

Thanks!

Here is what I have set up:

Groups consist of either the department of the GIS staff (whom I give ownership to) or ( if warranted) an application/project name for enterprise use. Users can belong to one or many of these groups.

I had to set up a custom role for limiting "credit" costing items on AGOL (uploading features, geocoding, etc.) and applied it to most users because we really want them to utilize our investment of ArcGIS servers. We use AGOL more for easy map and app creation and templates. The users in turn use our map/feature services from our servers.

I just discovered the "Admin Tools for ArcGIS Online" in the Marketplace.arcgis.com and will play with it to make my AGOL admin job more efficient. (New toy to play with, whoo hoo!)

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

RebeccaStrauch__GISP — Wed, 17 Jun 2015 19:44:01 GMT

There is documentation, but I think the experiences Venus can talk first hand about how they implemented. My comment about passwords without using active directory is because users can set their own passwords, of course, on AGOL. I think a password rule option is available now, but I know I haven't implemented or forced my users to change their passwords yet......but hope to soon. I'm sure they are not strong right now....my guess, for my users only.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

VenusScott — Wed, 17 Jun 2015 20:23:00 GMT

I should also mention that there are circumstances where we still use the old "named users" access. One of these instances is where the named user "City of Phoenix" owns of all our public enterprise GIS map viewers. This way, any of us four AGOL admin's can maintain these maps/apps for coverage purposes.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

NathanEnge — Tue, 29 Sep 2015 21:56:31 GMT

Of course, now that Portal is included with 10.3.1, to have non-authenticated users access the publicly (behind firewall) or as I call it privately-anonymous - would relieve the AGOL licensing restrictions in terms of number of users in your AGOL organizational subscription.

Plus, Portal uses IWA to authorize/authenticate against AD - so you don't have to use ADFS.

There are AGO tools available to move items between accounts. ago-assistant. However, normally I suggest republishing to Portal.

Re: Implementing ArcGIS Online Enterprise Logins with Existing Users

NeillJobe — Tue, 08 Dec 2015 16:13:29 GMT

Venus,

This may be of interest to you. Our Migrate Users tool, in Admin Tools for ArcGIS Online & Portal, can help you move content between existing users and newly created users when turning on ADFS - Check it

Hope this helps.