Configure Azure Active Directory

Microsoft Azure Active Directory (AD) is a Security Assertion Markup Language (SAML)-compliant identity provider (IDP). You can configure it as your IDP for SAML logins in Portal for ArcGIS on-premises and in the cloud. The configuration process involves two main steps: registering Azure AD in your ArcGIS Enterprise portal and registering Portal for ArcGIS in your Azure AD portal.

Note:

To ensure that your SAML logins are configured securely, review the best practices for SAML security.

To configure Azure AD with ArcGIS Enterprise, you need a premium Azure AD subscription.

Required information

Portal for ArcGIS requires certain attribute information to be received from the IDP when a user signs in using SAML logins. The NameID attribute is mandatory and must be sent by your IDP in the SAML response to make the federation with Portal for ArcGIS work. Since Portal for ArcGIS uses the value of NameID to uniquely identify a named user, it is recommended that you use a constant value that uniquely identifies the user. When a user from the IDP signs in, a new user with the user name NameID will be created by Portal for ArcGIS in its user store. The allowed characters for the value sent by NameID are alphanumeric, _ (underscore), . (dot), and @ (at sign). Any other characters will be escaped to contain underscores in the user name created by Portal for ArcGIS.

Portal for ArcGIS supports the inflow of a user's email address, group memberships, given name, and surname from the SAML identity provider.

Register Azure AD as the SAML IDP for your portal

1. Verify that you are signed in as an administrator of your organization.
2. At the top of the site, click Organization and click the Settings tab.
3. Click Security on the left side of the page.
4. In the Logins section, click the New SAML login button, and select the One identity provider option. On the Specify properties page, type your organization's name (for example, City of Redlands). When users access the portal website, this text displays as part of the SAML sign-in option (for example, Using your City of Redlands account).

   Note:

   You can only register one SAML IDP, or one federation of IDPs, for your portal.

5. Choose Automatically or Upon invitation from an administrator to specify how users can join the organization. Selecting the first option allows users to sign in to the organization with their SAML login without any intervention from an administrator. Their account is registered with the organization automatically the first time they sign in. The second option requires the administrator to register the necessary accounts with the organization using a command line utility or sample Python script. Once the accounts have been registered, users can sign in to the organization.

   Tip:

   It's recommended that you designate at least one enterprise account as an administrator of your portal and demote or delete the initial administrator account. It is also recommended that you disable the Create an account button in the portal website so people cannot create their own accounts. For full instructions, see Configure a SAML-compliant identity provider with your portal.

6. Provide metadata information for the IDP using one of the options below:
   • File—Download the Azure AD metadata file and upload the file to Portal for ArcGIS using the File option.

     Note:

     If this is the first time you're registering a service provider with Azure AD, you need to get the metadata file after registering Portal for ArcGIS with Azure AD.
   • Parameters—Choose this option if the URL or federation metadata file is not accessible. Enter the values manually and supply the requested parameters: the login URL and the certificate, encoded in the BASE 64 format. Contact your Azure AD administrator to obtain these.
7. Configure the following advanced settings as applicable:
   • Encrypt Assertion—Enable this option to encrypt the Azure AD SAML assertion responses.
   • Enable signed request—Enable this option to have Portal for ArcGIS sign the SAML authentication request sent to Azure AD.
   • Propagate logout to Identity Provider—Enable this option to have Portal for ArcGIS use a logout URL to sign out the user from Azure AD. Enter the URL to use in the Logout URL setting. If the IDP requires the logout URL to be signed, check Enable Signed Request.
   • Update profiles on sign in—Enable this option to have Portal for ArcGIS update users' givenName and email address attributes if they've changed since they last signed in.
   • Enable SAML based group membership—Enable this option to allow organization members to link specified SAML-based enterprise groups to Portal for ArcGIS groups during the group creation process.
   • Logout URL—The IDP URL is used to sign out the currently signed in user.
   • Entity ID—Update this value to use a new entity ID to uniquely identify your portal to Azure AD.

   The Encrypt Assertion and Enable signed request settings use the certificate samlcert in the portal keystore. To use a new certificate, delete the samlcert certificate, create a new certificate with the same alias (samlcert) following the steps in Import a certificate into the portal, and restart the portal.

8. When finished, click Update Identity Provider.
9. Click Download service provider metadata to download the portal's metadata file. Information in this file will be used to register the portal as the trusted service provider with Azure AD.

Register Portal for ArcGIS as the trusted service provider with Azure AD

1. Log in to your Azure portal as a member with administrative privileges.
2. Following the steps in Azure documentation, add Portal for ArcGIS as a non-gallery application to your Azure AD and configure Single sign-on. You will need to provide the Metadata.xml file downloaded from Portal for ArcGIS.

   Portal for ArcGIS appears in the Enterprise Applications list in Azure AD.

3. Add and assign users to the application as needed.
4. Optionally configure and customize the SAML claims passed to ArcGIS Enterprise. The attributes of interest in the SAML response are givenName and emailaddress.