SAML identity providers integrated with ArcGIS Enterprise can support group membership. Similarly, it would be great to support OIDC backed group membership through calls to a groups or memberOf (etc) property.
Even this is NOT a part nor compliance with current OIDC standard scopes / claims, this is feature that has been asked from several ArcGIS clients. Adding support for custom or enhanced scopes / claims like groups would be very helpful.
As it is does not seem to be standard to OIDC protocol (correct me if I am wrong, not an expert !), a configurable claim (aka not hardcoded) would be very useful to retrieve groups membership experience of SAML !
Voicing my support for this feature too! This would be tremendously helpful as we do this with a lot of other vendors already. It allows our cloud SA's to manage groups in our Azure tenant which will map them all to the appropriate group in the ESRI world.
Optionally, toggle the Enable OpenID Connect login based group membership button to allow members to link specified OpenID Connect-based groups to ArcGIS Online groups during the group creation process.
This step is missing from ArcGIS Enterprise 11.3 documentation:
From my first testing, I faced an issue with header size since I activated it. I don't know why, but Portal for ArcGIS is setting this "oidcRelayState" cookie on "signin" last operation:
`sharing/rest/oauth2/oidc/xyz/signin`
and in my case, after having turn this OIDC group membership, it turns out that this cookie is massive and my header is greater than 40 KB afterward and got rejected by HAProxy. I increased the header size limit and it now works but it seems to me that my groups are stored in this cookie which is not a good practice according to my IT team. Any idea why are the groups stored in this cookie at the end of the auth process ? It seems to me this cookie is much more than a 'classic' relayState and also there is no state to manage at this stage as interaction with IDP is over 🤔
Might open a dedicated thread rather than polluting this implemented idea !
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
