Group level sharing in storymap - item not accessible to users in other organizations

[ErikEndrulat]

I run into an issue with a public storymap that contains private content (webmaps, apps, etc.) shared to a group. Viewers that are Members of the shared group, but not a member of the 'parent' organization for the webmap or app are unable to access. 

For example:

• Parent Storymap owned by organization X (Public-level sharing)
• Embedded webmap owned by organization X (Shared to 'private' group)
• Embedded webmap displays correctly for individual from org. X (member of private group) but not for individual from organization Y (also member of 'private' group) - no error displayed via the browser, just a blank screen with following error via Developer tools:
  
  

  {"error":{"code":403,"messageCode":"GWM_0003","message":"You do not have permissions to access this resource or perform this operation.","details":[]}}

I searched through GeoNet, couldn't find any reports of something similar - I'm interested if anyone has any suggestions on how to resolve this!

Thanks!

[StephenSylvia]

Can you also verify that all content, including layers within the map, are also shared to that org and not just to your organization?

[ErikEndrulat]

Thanks for the reply, Stephen. I'm not aware of any sharing property allowing for an item to be shared to any organization other than it's 'parent' organization. Is there a setting for that that i've somehow missed?

[StephenSylvia]

Every item in ArcGIS Online has 3 options for sharing:

1. To the public
2. To your organization
3. To one or more groups.

Groups are able to have members from other organizations.

Every item also has sharing permissions set independently (apps, web maps, layers, etc.) App can contain web maps and web maps can contain layers but they still maintain their individual sharing permissions. If you are sharing a web map to a group, you also have to share all the layers within that map to the same group as well to make sure everyone has access. 

[ErikEndrulat]

Yes, I can confirm that I am sharing the permissions of each of the component pieces (layers, webmaps and apps) to the same group.

I believe that the same issue that i'm facing with the storymap in question is expressed in another way that you and probably other users run into all the time, that is, when sharing an app from your organization (e.g. http://ORG-A.maps.arcgis.com/apps/TimeAware/index.html?appid=463152eb76724f7587cdb59baa7a856a ) to a user in a different organization (let's say ORG-B), the user from the organization that you are sharing the item to will be requested to sign into ORG-A (which they won't have access to). In order to access, they would have to either change the URL to http://ORG-B.maps.arcgis... or http://www.arcgis.com/..).

I think this same issue is behind the 'mixed-org' sharing problem I'm having with the storymap. 

[OwenGeo]

Hi Erik -- Have you confirmed that members of the other organization can open the web map (outside of the story map) and see all of its layers?

Do you also have the story map shared to the private group (I understand it is also shared with everyone)?

Can you share the link to your public story map here so we can take a look?

[ErikEndrulat]

Owen- 

Yes, I confirmed that the members of the other org can open the webmap; however the issue is still if the webmap (or app) URL includes the org prefix then the user is asked to sign into the 'parent' organization, so the org prefix needs to be replaced or removed.

Yes, the public story map is also shared to the private group.

Here is the item:

https://www.arcgis.com/apps/MapSeries/index.html?appid=9180084e4325488b8261facc1dc1aa3e 

An example of the private / group-shared content can be found on the 3rd tab (Phase 1: Planning), third section (Impacts, continued).

[OwenGeo]

Erik -- That's not just a web map in section 3 of your story map -- that's a self-hosted Web AppBuilder app. Since you are using multiple apps and have private content I would suggest that you contact Esri Support and they can help you troubleshoot further.

[ErikEndrulat]

Thanks Owen, yes, I can contact Esri Support on this. I realize that the first section in section 3 is a self-hosted WAB (that one comes up fine regardless of the organization you log in through. It's the third section beneath that that contains web maps which don't come up.

[OwenGeo]

Oh, I see now. As you mentioned above, I would make sure that you are using the generic www.arcgis.com URL when you embed story maps in your main story map. It looks like the story maps are embedded using the org URL.