Single sign-on (SSO) Might Impact Students More Than You Thought

[JianChen]

The single sign-on (SSO) authentication method allows users to securely authenticate with multiple applications and websites by using just one set of credentials, usually an institute-issued one. Yesterday at the ESRI User Conference, I was told by ESRI Reps that ESRI would enforce SSO beginning January 1st, 2025 and all other licensing options would be gone. This news shocked me with such a short time turnaround. I would like to express my concerns here.

Of course, SSO is convenient and safe. We don't need to remember two separate sets of credentials for My ESRI and ArcGIS Online. But the downside is also obvious: you cannot assume you always have a reliable internet connection. Our campus is located in a tornado-threaten area. Last year alone, our campus experienced severe campus-wide (sometimes city-wide) internet outages for various of reasons such as weather, accidents, equipment failure, etc. Most of those internet outages lasted several hours or even longer. More importantly, not all our students have reliable internet connection at homes. Previously, single-use license works well for our GIS major students who need to access to ArcGIS Pro frequently from their own computer. Many of our students have multiple jobs besides being a full-time students because of financial burden. They might not have reliable internet at home. I remember some of my former students drove to campus and stayed in the parking lot so that they can have reliable WIFI if they were taking an online quiz or exam during the pandemic. Aftere pandemic, they no longer need to be stucked in the parking lot, but it is prevalent among students to leverage the free internet connectivity on campus. It is probably understandable to take a quiz or exam, but it might be too much due to the SSO requirement of ArcGIS Pro. My students need to work on ArcGIS Pro several hours at least for one single assignment.

I wish single-use license option can last longer, much longer so that we can have some alternatives for students who need it or in the filed we don't have internet connection.

[BrianBaldwin]

Hey there Jian @JianChen - thanks for coming by the booth and visiting us at the UC!

So - just to clarify a little bit, it sounds like there might have been a misunderstanding or someone just stated something incorrectly or wrong.

1. Esri will not enforce SSO/SAML as the only sign-in method at any date.
   1. We are encouraging the education community to enable SSO, to the make the license administration and user experience easy, but understand that it is not appropriate for all users or use cases.
2. Esri IS removing Single-Use/Concurrent Use licensing from education licenses.
   1. Users can still use the 'built-in' named user functionality and there is no need to enable SSO for this.

With either of these options, users can 'check-out' a license of ArcGIS Pro for offline use if that capability is enabled in the organization.

Let me know if there is anything you heard anything else that sounded a bit upsetting (or good!) and we can definitely get back to you to clear it up or explain the rationale.

[JianChen]

Hey Brian,

Thanks for your reply! We all know that the experience with the named user account is not something I can be proud of. Students need to memorize their credentials for both MyESRI and ArcGIS Online. SSO is definitely more convenient in that sense. I heard to implement SSO is not very easy, and we might need to add suffix for our institution credentials when we login with SSO. Out ITS is kind of reluctant to take that route if that is the case. We scheduled a meeting next Monday with ESRI Support Services to discuss the implementation details. The head of our university's ITS will be on that call as well. Hopefully, after that meeting, we will have better idea how realistic to implement SSO for ESRI products usage.

Anyway, I heard the deadline is the end of this year, either is removing single-use/concurrent licensing, or implementing SSO. I understand that the capability of checking-out license has been there for a while but haven't been widely used on our campus yet. Is it true that this capability is still there after all the previous licensing options are gone. Is there any cap about how many "licenses" can be checked out, say after the beginning of the next year?

[BrianBaldwin]

@JianChen - Thanks for the reply - 

Couple of things - 

• We recommend that students don't have MyEsri access - this is really for license administrators, etc. The only reason to go into MyEsri is to manage the university account/etc. 
  • The confusion here might be enabling 'Esri Access' for students on their ArcGIS Online accounts - as this enables them to take training, etc. But - this is seperate from MyEsri.
• In terms of user accounts - SSO definitely helps with removing another account/PW that students need to remember - it also goes in line with the vast majority of IT best practices - to ensure that only students/staff at the university have access to your accounts/resources.
• For the SSO setup - it honestly takes about 5 minutes. The caveat with this is just thinking through some of the default settings for new users, licenses, etc. We have a number of best practices published on this to assist with these discussions:
  • https://experience.arcgis.com/experience/0792dbb9cb0243148f315edba0463282
  • Great to hear you have this conversation with IT scheduled! If you have any other questions or follow-up - just let us know!
• Yep! The license check-out process is still there and will be with the license changes to named user and SSO. If you wanted - a university could check out 50,000 licenses. Meaning to say, there is no limit.