Walk-through of Azure Active Directory integration with ArcGIS Portal

[Anonymous User]

1. Some of our clients might require the integration of ArcGIS Portal with Azure, here i have summarized steps on how to setup Azure with ArcGIS portal just in case you might need in the future. 
2. Sigh up Azure. Azure portal is free for 12 months. As Active Directory configuration requires to sign in as a Global Administrator, I would recommend use your personal email account to sign up instead of the Esri email address. 
3. Login in with your account. 

 

1. Select the Azure Active Directory item and then click Enterprise Applications from the Azure Active Directory left-hand navigation menu.

        

1. Click New Application on the Enterprise Applications pane.

         

1. Click Non-gallery application in the Add your own app section.
2. Enter the name of the application in the Name textbox and then click Add. 

          

1. Once the application loads, click the Set up single sing on tab and then select SAML. 

           

1. Login into your ArcGIS portal with admin, go to Organization - Settings - Security, click Get Service Provider and then save Metadata.xml file 

           

1. Back to the Azure Portal page, click 'Upload Metadata file' at the top of the banner, and then upload your Metadata.xml

          

1. Go to SAML Signing Certificate, download 'Federation Metadata Xml'.

          

1. Go to ArcGIS port Portal, Organization - Settings - Security, click Enterprise Logins visa SAML, upload your Azure metadata to portal and save changes. 
2. Go to Azure Portal, you now should be able to Test your configurations. 

        

1. Log off from your Portal and then click Enterprise login with your AD account.

[JimmyWang]

This is very helpful to me.

Thanks

Liran

[JonEmch]

Excellent read, thank you.

[DennyWalters]

Nice intro, thanks

[A_Wyn_Jones]

Great post Anon 🙂 just to bolster this slightly, here are the relevant documentation links which constitute the above post:

https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/arcgisenterprise-tutorial

https://enterprise.arcgis.com/en/portal/latest/administer/windows/configuring-a-saml-compliant-ident...

One extra thing, 11.1 security scans now check for SAML encryption assertion - it is recommended this is enabled.

[HeathAnderson]

This is a great article. 

@A_Wyn_Jones. Our IT is switching the userprincipalname and I am wondering if I can switch the Required claim to user.objectid rather than the userprincipalname.  If I can make the change, would this circumnavigate user access issues when IT switches the userprincipalname?  Thanks.

[A_Wyn_Jones]

Hi @HeathAnderson,

If your query is regarding your IT changing the IDP claims, please make sure they're compatible with the User Profile Mappings found here:

https://enterprise.arcgis.com/en/portal/latest/administer/windows/configuring-a-saml-compliant-ident...

Even more information can be found here:

https://github.com/Esri/idp

Hope this helps!

A

[zainabzia]

I Don't have the subscription of SMAL on my azure portal what I have to do for the azure authentication on ArcGIS portal any alternative??

[HeathAnderson]

@zainabzia 

What version of Portal are you running?

Would using Web-tier authentication be an option for you?  This method is available from 10.8 - current release (11.3)

https://enterprise.arcgis.com/en/portal/11.3/administer/windows/about-configuring-portal-authenticat...