Single Sign-On with Portal for ArcGIS and ArcGIS Online
Since 4.8.0
security.manager helps client applications to interact with security.manager services and Portal for ArcGIS - including ArcGIS Online - in a single sign-on manner. The goal is to let the user sign in at the Portal with her Portal identity and let her use security.manager services or protected applications without a second login required. This can be achieved by the following approach:
- security.manager Domain Cookie
-
This way of integrating Portal users with security.manager requires client applications to send a separate request to security.manager. It is used to obtain a domain cookie for the user of the Portal token as soon as in possession of a user’s Portal token. With this additional request security.manager identifies the Portal user. Subsequent requests use the domain cookie to identify the user.
Although this approach requires special client logic (the additional request), it is the only method to enable the client to make use of applications that are protected by means of security.manager domain cookie mechanism. This method is currently not supported by default Esri clients and APIs.
In this case, security.manager needs to be linked to a Portal instance (or ArcGIS Online organization). When security.manager receives a client request (either token-based or containing a domain cookie) it looks up the user details from Portal based on the information provided by the requesting client. The Portal user identity is then matched to a security.manager user account by username. It is common that security.manager and ArcGIS for Portal use the same LDAP or Active Directory as a user repository, so that user accounts are based on the same data source. You can also run security.manager with its native database user repository. Take care that all users managed by the Portal have a corresponding user account in security.manager with the same username.
Setup
1 Enable Portal integration
To activate the Portal integration, you need to specify the Portal URL in the application.properties configuration file, using the parameter security.login.portal.url.
For a detailed description of relevant configuration parameters, see Portal integration.
2 Link user accounts
Single Sign-on with Portal for ArcGIS and ArcGIS Online is based on usernames. For every user managed by the Portal there must be a corresponding user with the same username in security.manager before single sign-on works. The most consistent way to link the accounts is to make security.manager and Portal use the same LDAP or Active Directory. Otherwise you need to manually create a user account in security.manager for every users that exist in the Portal.
With Portal integration enabled, roles and policies controlling service access is still managed in security.manager. Imagine a Portal user with username a.miller. To enable single sign-on there must also be user a.miller in security.manager. To grant access to a protected service, create a role in security.manager, assign that role to a.miller, and create policies that grant access to certain service resources.
security.manager Domain Cookie
To request a domain cookie, a client is required to send a user’s Portal token to the /token/cookie endpoint of security.manager:
https://[HOST][:PORT]/administration/token/cookie?portaltoken=02YuGX3aoYxRPzcylglzIEPwcRA-2pKCErNdKXHoAzVp-B826fNrCUTTfTi9uqc...security.manager returns a response setting the domain cookie:
HTTP/1.1 200 OK
Server Apache-Coyote/1.1 is not blacklisted
Server: Apache-Coyote/1.1
Set-Cookie: ct_SSO=*|040ee5fb86c3772c46d77413c8f65474|586eeb64716ec700bab9c83ad8e4dce1141ee45f; Version=1; Comment=""; Path=/
Content-Length: 0
Date: Mon, 01 Jan 2017 00:00:01 GMT| If an error occurs, for example the Portal token is invalid or timed out, you get an HTTP response with 403 status code. |