topic Re: AGOL: OIDC username not consistant with SAML username in ArcGIS Online Questions

AGOL: OIDC username not consistant with SAML username

NicolasGIS — Tue, 19 Nov 2024 06:41:09 GMT

Hello,

Now that group membership have been enabled on AGOL for OIDC provider, we would like to switch authentication provider from SAML to OIDC.

But I noticed a difference of behavior between SAML and OIDC providers which is a bit confusing.

Let's say my organization username is "guineapig" and my organization name is "MYORG" (ie: AGOL URL is https://MYORG.maps.arcgis.com)

Currently, if I log in with SAML, my AGOL username will be "guineapig_MYORG" which is fine.

But if I log in with OIDC, my AGOL username will be "guineapig4" solely. As you can see, an integer was added at the end because "guineapig" already exists in AGOL as a built-in account so my username is mapped to "guineapig4" instead of "guineapig" or "guineapig_MYORG".

I would prefer the SAML way of adding the organization suffix to make it unique. I looked everywhere and it does not seem to be configurable. But why is there this difference of behavior ?

Is that a BUG or a feature ? I am confused.

Thanks,

Nicolas

Re: AGOL: OIDC username not consistant with SAML username

CMV_Erik — Wed, 20 Nov 2024 22:29:06 GMT

I think it may be a bug that affects SAML as well. I tried to add a number of users today using CSV file and it seemed to work. They reported they couldn't log in so I went back and looked and most of the username was missing. Tried again and saw numbers appended to all user accounts, and there was not way to change them. I was able to add the user manually, but that's the first time I've needed to in years.

This is the first user I've attempted to add a user since the upgrade last week, so I assume this is a bug introduced by the upgrade

EDIT: I opened a ticket and support alluded to a new bug affecting multiple users, but I didn't get the specifics.

My own problem was resolved by changing the field names to the latest template. All I'm sure of is that something just changed in the process that creates new users...

Re: AGOL: OIDC username not consistant with SAML username

NicolasGIS — Wed, 20 Nov 2024 11:11:56 GMT

Hmm strange indeed.

My issue was mainly with OIDC on my side.

For SAML, it is documented that the organization short name is appended on AGOL :

All organization-specific usernames in ArcGIS Online have the organization short name appended to the end

https://enterprise.arcgis.com/en/portal/latest/administer/windows/configuring-a-saml-compliant-identity-provider-with-your-portal.htm#ESRI_SECTION1_1E9996AB78AD47F7BE14B7DD5598BE2F

Strangely, I was not able to find this piece of information on AGOL documentation but only in ArcGIS Enterprise stating that it is possible to do the same thank to the "defaultIDPUsernameSuffix" property.

But I wonder why it is not the case with OIDC. What is the logic behind ?

Re: AGOL: OIDC username not consistant with SAML username

RajkumarPadmanabhan — Mon, 07 Jul 2025 11:58:31 GMT

@NicolasGIS Do you just desire the userame formats to look similar or are you hoping to reuse the same account when migrating from SAML to OIDC (in order to avoid the need to transfer data\roles\etc)?

Re: AGOL: OIDC username not consistant with SAML username

NicolasGIS — Fri, 11 Jul 2025 15:38:45 GMT

Thanks for your reply @RajkumarPadmanabhan . I would like the same user format. Not an issue about migrating from SAML to OIDC. Do you see what I mean ? Did I miss anything documentation wise ? Thanks

Re: AGOL: OIDC username not consistant with SAML username

NicolasGIS — Mon, 18 Aug 2025 14:17:03 GMT

@RajkumarPadmanabhan, do you now understand the issue and the difference of behavior ? Any logical explanations to that ? We just have a fresh AGOL instance created in Europe for privacy reason and would like to start on a good foot with OIDC but we can't because of this.

User will wonder why am I `alastname7823` ? So we are considering back SAML as idp which would be a step backward. On ArcGIS Enterprise, we do not have this issue of course.

Any recommandations ? Should an Idea be created ? A support case ?

Thanks