Security, Authentication, and Access Control
What this domain tests
Expect questions on identity stores, how user types, roles and sharing combine, and where each authentication mechanism is actually configured.
Identity stores
A portal uses either built-in accounts or an enterprise identity store: LDAP/Active Directory, SAML 2.0, OpenID Connect, PKI, or Windows authentication configured at the Web Adaptor. Windows authentication is a web-tier setting on the Web Adaptor, not a portal setting; the portal trusts the web tier and creates enterprise accounts at first sign-in. SAML requires IdP metadata, the portal acting as service provider, and attribute assertions for username plus optional group and role attributes.
Three layers of access control
- User type: the license, defining what the member may do at all.
- Role: the privilege set. Default roles are Viewer, Editor, Publisher, User and Administrator; custom roles are built from individual privileges and cannot exceed the user type.
- Sharing and groups: items are private, shared to groups, shared to the organization, or public; group membership and item sharing decide visibility.
Tokens and hardening
Portal issues OAuth2 tokens, and after federation ArcGIS Server accepts them. Token lifetime is configurable, so very long lifetimes are a finding. Harden by enforcing HTTPS with CA-signed certificates, disabling plain HTTP, restricting administrative endpoints to internal networks, and running services under a least-privilege account.
Worked example
The AD group GIS_Publishers must sign in with single sign-on and receive the Publisher role. Reasoning: configure SAML, or Windows authentication at the Web Adaptor if domain SSO inside the LAN is acceptable; map the IdP group claim to the AD group, link that group to a portal group, and set the default role for the mapped group to Publisher. The role attaches to the mapped group, not to each account. Removing someone from AD blocks future sign-in but leaves their content behind, so plan an ownership transfer.
Traps
Searching the portal interface for the Windows authentication checkbox, which lives on the Web Adaptor; assuming a deleted identity-store account deletes its content; granting publishing privileges to a Viewer user type; confusing group membership with role; assuming public sharing works when anonymous access is disabled.