1

I have a number of secured ArcGIS 10.2 for Server (AGS) services which a number of other companies use as well. At the moment we have created domain accounts on our domain which they need to access the services.

However, does ArcGIS 10.2 for Server allow me to setup my site as a federated resource partner so that the other companies can use their own credentials instead (Single Sign On).

I know that arcgis.com and the Portal will allow you to do it but haven't found anywhere about doing it on your own AGS installation?

Improve this question

2 Answers 2

Reset to default
1

At the time of writing, out of the box, there is not a way to allow users from more than one active directory to access your ArcGIS Server.

ArcGIS Server can hook into a single active directory. I am not a security boff, but you could investigate (stack overflow question?) the possibilities combining domains from different active directories with other products or at the domain controller end. I have heard of this being done, but cannot provide you with anything concrete.

ArcGIS.com allows you to setup Enterprise Logins, which makes use of SAML Web Single Sign On. SAML is an open standard to securely exchange authentication and authorization data between an identity provider (your organization) and a service provider (in this case, ArcGIS Online). Now, I would like to be corrected on this, but as far as I can see, whilst it is possible to consume multiple identity stores with the SAML model, ArcGIS.com only appears to allow you to point to one authentication server. Therefore, only one active directory. This might be by design, as what happens when it finds 'Adam Smith' in multiple stores?

As for Portal, this also relies on there being a singular identity store (i.e. One Active Directory).

Improve this answer
1
  • You are correct that only ADFS can be connected to ArcGISServer or Portal. However you can use the connected ADFS to act as the broker with many other ADFS (horizontally chain).
    – risail
    Commented Feb 17, 2016 at 21:31
1

Since version 10.1 there have been being a Web Adaptor that assists for integrating ArcGIS for Server into corporate infrastructure. Supporting WS-Federation boils down to adding WIF to the pipeline in case of IIS. With respect to the federation you did right: one partner - one account. It's FP's duty do claims transformation. Turning on claims authorization on the AGS's side allows you implement fine grained resource access policy.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.