Automatically Assign Users to Groups

[ZachBodenner]

Hello,

I need some help understanding my Enterprise Portal identity store. I have manually set up groups in Enterprise Portal (10.8.1) that roughly correspond to the Active Directory user groups within the organization (Parks, Police, Fire, Assessing, Engineering etc). The Portal is configured for single sign-on where users are simply presented with the blue ESRI sign in button and their AD credentials are passed to the Portal. Additionally, the Portal is configured to automatically create user account if they have not yet signed in. This is the thing I want to work on.

 My goal is to automatically place new users into Portal groups based on AD groups they are a part of, but this is where I get a little confused (I wasn’t primarily responsible for setting this up when we initially rolled out our Portal). So clearly there is some relationship between our Portal sign in configuration and our Windows AD. In the organization’s security settings, the login redirect hits our AD server, I can download the metadata xml, all that. But when I looking at the Identity Store config in the PortalAdmin directory, it shows that the Portal is configured with the type BUILTIN. I must not understand completely because it doesn’t seem to make sense that user store configuration would be built in if there is such a relationship with the actual AD.

How do I appropriately configure the Portal to allow for automatic group placement when a new member signs in for the first time (without removing any currently existing Portal users in the process, if at all possible)? I’m not sure if I’ve provided enough/the right info for anyone to help out, so let me know if there’s anything else I can provide.

Thanks!

[ZachBodenner]

I believe he has. I sent you a DM that contains a snapshot of the relay and to my untrained eye it appears that group forwarding should be working.

[ZachBodenner]

So my network admin thinks that we should be able to implement this feature, but is looking for some examples of other organizations that have made it work. Are there any viewers of this thread that have successfully implemented automatic group assignation and would be willing to share their experiences?

[Scott_Tansley]

I look after about 30 clients, mostly Local Government and Utilities.  Your network admin can reach out to me via direct message on my profile or LinkedIn.  

This whole subject is pretty BAU now.  I would say it's tried and trusted if that's the issue?

[GrantSmith122]

Hi! I have a bit of a follow up question on this thread. Our org has set up a SSO SAML login that passes a memberOf attribute through each login request. Using SAML Tracer, we see that the memberOf information comes through like this:

>CN=[value1],OU=[value2],dc=[value3],dc=[value4],dc=[value5]</saml:AttributeValue>

When we are in our Portal setting up groups, how exactly do we need to specify the Group Name setting under "Being a member of a SAML group"? Is it just the [value1] item in the example above? Do we need to somehow concatenate all the values together? Do we need quotes? Any help will be appreciated!