Latest Contributions by NicolasGIS

Thanks for your reply. Unfortunately, we did not configure any store and they are currently configured as built-in: Thanks ... View more

Is it an unsupported worklow ? I can provide full script and data to reproduce the issue if anyone interested  ... View more

Hello,  In fact it has nothing to do with the old accounts nor the upgrade as I am able to reproduce the issue on brand new 10.8 environment. I was misguided because group membership is correctly computed at account initialization but not afterward so the test was different. Following your recommandation, I enabled logging to debug mode and created to 2 groups 'TEST-SAML' and 'TEST-SAML2' configured as member of the organization group 'gis-esriportal' and tried to log in with an account not initialized on ArcGIS Enterprise and member of the group 'gis-esriportal':   As you can see the user 'foobar' is correctly added to the groups 'TEST-SAML' and 'TEST-SAML2' as it is a member of 'gis-esriportal'. Then, I created a third group 'TEST-SAML3' configured membership to the very same enterprise group 'gis-esriportal'. If I try to log in once again with the test account (after signing out, clearing cookie and incognito mode), the following is logged: So it seems like it does test for membership but according to ArcGIS Enterprise, it is not member of 'gis-esriportal' group. Then I delete the account on 'ArcGIS Enterprise' and tried to log in again: User is added to 'TEST-SAML3' group this time. Any idea what could be the issue ? Thanks ... View more

Thanks for your quick reply Jonathan Quinn‌ ! It is much appreciated ... View more

Thanks for your reply Jeff Smith. I am still investigating and I found out why it was working on one deployment and not the other: it was because I tested  with a newly created account ! I deleted an account on production as it was only a 'viewer' and did not have any item, asked him to login again, and after initial login it worked ! User could access the group he could not see before because his account had been created again in Portal. It means that group membership is computed at account creation but not computed for new groups. Does that help to identify the possible issue ? BTW, I don't think it is BUG-000121049 as I am member of that of the group in the SAML response and creator of the group. Thanks ! ... View more

Many thanks Jonathan Quinn‌ for your detailed reply ! Just wondering, is it possible to register more than 2 "Portal for ArcGIS" ? Thanks ... View more

OK, so I run additional tests on our UAT environment on 10.8 and it's working fine... but not in production with the very same SAML configuration on Portal. The only difference I could think of about those 2 environments is that the production was upgraded from 10.7.1 while the UAT while in the meantime reconfigured from scratch... On production, I removed SAML configuration and configured it again just like on UAT environment: same results, still not working ... View more

Hello, We just discovered the same issue on ArcGIS Enterprise 10.8 ! When configuring a group viewable and joinable by only "Members of an Enterprise Group", users can't see them even when they are in the group. It used to work ! The funny thing is that they can see old groups created with older version of Portal for ArcGIS that are configured the exact same way !!! I decoded the reply from SAML when logging in: And of course when trying to access webmap from that group, I get 403 error. This is a big issue for us !!   ... View more

Just wanted to add that I read the following thread that could seems similar: PORTAL HA  But the requirement would be to have HA deployment for one network and HA deployment for the other one (ie: we do not want one network to fall back on the other network when portal is down). So it implies 4 "Portal for ArcGIS" basically. But nowhere it is mention that you can multiply "Portal for ArcGIS" component just like you can with "ArcGIS Server". Thanks !  ... View more

No, credentials are not embedded. They are prompted when opening the map in Collector. Just wanted to add that we recently upgraded from SDE Oracle 10.3.1 to 10.8, might be related ? ... View more

Thanks for your reply Doug Morgenthaler ! - The affected table is part of a feature layer from SDE 10.8 (Oracle) published to an ArcGIS Server 10.8 with token based security - Mobile plateform is IOS (not tested on android) ... View more

Thanks for your reply ! ... View more