Allow SAML enterprise logins to be used within ArcGIS GeoEvent Server data store connections

618
1
12-23-2019 07:05 AM
Status: Open
StevePoladian
New Contributor II

We have our ArcGIS Enterprise configured to allow SAML authenticated user, while that is the case we have found that we are unable to establish a connection with our main publishing user account as it is a SAML user, we are forced to utilize the PSA user or a builtin account.  we would like to use our main publishing user account to simplify and organize content published and created in our Geo Event environment so it is easy to find by any administrator of the system.  This will also allow for a more secure log in over a built in account as our organization enforces password changes through our Active directory on a regular basis where a built in account is not forced to change passwords on a scheduled basis.

 What is the problem trying to be solved?

Many users already commit to enterprise logins when using Portal. The ArcGIS GeoEvent Server is a client program that interacts with the ArcGIS GIS Server and Portal for ArcGIS and the expected authentication mechanisms should match that of other Esri client programs such as Collector for ArcGIS

What are the benefits or changes that would result from the enhancement?

Since customers are already utilizing enterprise SAML logins for their Portal and ArcGIS Online installations, this enhancement would enable more streamlined workflows by all users. Currently in the Enterprise, users would need to create 1 built in user account to be owned by the ArcGIS GeoEvent Server.

1 Comment
DeanMoiler

Still a great suggestion @StevePoladian . There is PKI capability which might work in some instances, but won't for many for SAML, making the PSA the only option. 

The problem for me comes when you wish to share content to a group linked to enterprise SAML group. The only non-SAML user that can be in this group (after latest round of updates 10.9.1 to 11.1) is the owner. This may change with future security patches, which would mean we would not be able to share content to SAML enabled groups. With 4k+ users this is essential for us to be able to share restricted content appropriately to users.