Configure OpenID Connect logins

Configuring organization-specific logins, such as OpenID Connect logins, allows members of your organization to sign in to ArcGIS Enterprise using the same logins they use to access your organization's internal systems. The advantage of setting up organization-specific logins using this approach is that members do not need to create additional logins within the ArcGIS Enterprise system; instead, they can use the login that is already set up with the organization. When members sign in to ArcGIS Enterprise, they enter their organization-specific user name and password directly into your organization's login manager, also known as your organization's identity provider (IDP). Upon verification of the member's credentials, the IDP informs ArcGIS Enterprise of the verified identity for the member who is signing in.

ArcGIS Enterprise supports the OpenID Connect authentication protocol and integrates with IDPs such as Okta and Google that support OpenID Connect.

You can configure your organization's sign-in page to show only the OpenID Connect login, or show the OpenID Connect login along with ArcGIS login and SAML login (if configured).

Set up OpenID Connect logins

The process of configuring an OpenID Connect IDP with ArcGIS Enterprise is described below. Before proceeding, it is recommended that you contact the administrator of the IDP to obtain the parameters needed for configuration.

Note:

At this time, only one OpenID Connect IDP can be configured for your ArcGIS Enterprise organization. The ability to configure more than one IDP will be supported in the future.

1. Verify that you are signed in as an administrator of your organization.
2. At the top of the site, click Organization and click the Settings tab.
3. If you plan to allow members to join automatically, configure default settings for new members first. If necessary, you can change these settings for specific members after they have joined the organization.
   1. Click New member defaults on the left side of the page.
   2. Select the default user type and role for new members.
   3. Select the add-on licenses to automatically assign members when they join the organization.
   4. Select the groups to which members will be added when they join the organization.
4. Click Security on the left side of the page.
5. In the Logins section, under OpenID Connect login, click Set up OpenID Connect login.
6. In the Login button label box, type the text that you want to appear on the button that members use to sign in with their OpenID Connect login.
7. Choose how members with OpenID Connect logins will join your organization: automatically or added by an administrator. The automatic option allows members to join the organization by signing in with their OpenID Connect login. The other option allows administrators to add members to the organization. If you choose the automatic option, you can still add members directly using their OpenID Connect ID.
8. In the Registered client ID box, enter the client ID from the IDP.
9. In the Registered client secret box, enter the client secret from the IDP.
10. In the Provider scopes/permissions box, enter the scopes to send along with the request to the authorization endpoint.

    Note:

    ArcGIS Enterprise supports scopes corresponding to the OpenID Connect identifier, email, and user profile attributes. You may use the standard value of openid profile email for scopes if it is supported by your OpenID Connect provider. Please check your OpenID Connect provider's documentation for the supported scopes.

11. In the Provider issuer ID box, enter the identifier for the OpenID Connect provider.
12. Fill in the OpenID Connect IDP URLs as follows:

    Tip:

    Refer to the well-known configuration document for the IDP—for example, in https:/[IdPdomain]/.well-known/openid-configuration—for assistance with filling in the information below.

    1. For OAuth 2.0 authorization endpoint URL, enter the URL of the IDP's OAuth 2.0 authorization endpoint.
    2. For Token endpoint URL, enter the URL of the IDP's token endpoint for obtaining access and ID tokens.
    3. For JSON web key set (JWKS) URL, optionally enter the URL of the IDP's JSON Web Key Set document. This document contains signing keys that are used to validate the signatures from the provider. This URL is only used if the User profile endpoint URL (recommended) is not configured.
    4. For User profile endpoint URL (recommended), enter the endpoint for getting identity information about the user. If you do not specify this URL, the JSON web key set (JWKS) URL is used instead.
    5. For Logout endpoint URL (optional), optionally enter the URL of the authorization server's logout endpoint. This is used to sign out the member from the IDP when the member signs out from ArcGIS.
13. Turn on the Send access token in header toggle button if you want to have the token sent in a header instead of a query string.
14. To complete the configuration process, copy the generated Login Redirect URI and Logout Redirect URI (if applicable), and add them to the list of allowed callback URLs for the OpenID Connect IDP.
15. When you're finished, click Save.

Modify or remove the OpenID Connect IDP

When you've set up an OpenID Connect IDP, you can update the settings for it by clicking the Edit button next to the currently registered IDP. Update your settings in the Edit OpenID Connect login window.

To remove the currently registered IDP, click the Edit button next to the IDP and click Delete login in the Edit OpenID Connect login window.