One of the key aspects of planning a deployment of ArcGIS Enterprise is deciding how to manage accounts that will access your portal and what privileges are granted to the accounts. Determining how accounts will be managed is a matter of choosing an identity store.
Understanding identity stores
The identity store for your portal defines where the credentials of your portal accounts are stored, how authentication occurs, and how group membership is managed. The ArcGIS Enterprise portal supports two types of identity stores: built-in and enterprise.
Built-in identity store
The ArcGIS Enterprise portal is preconfigured so you can easily create accounts and groups in your portal. You can use the Create an account link on the portal website home page to add a built-in account to your portal and start contributing content to the organization or access resources created by other members. You can also click the Groups tab on the portal website home page and create a group to manage items. When you create accounts and groups in your portal this way, you are leveraging the built-in identity store, which performs authentication and stores portal account user names, passwords, roles, and group membership.
You must use the built-in identity store to create the initial administrator account for your portal, but you can later switch to an enterprise identity store. The built-in identity store is useful to get your portal up and running, and also for development and testing. However, production environments typically leverage an enterprise identity store.
Enterprise identity store
The ArcGIS Enterprise portal is designed so you can use enterprise accounts and groups to control access to your ArcGIS organization. For example, you can control access to the portal by using credentials from your Lightweight Directory Access Protocol (LDAP) server, Active Directory server, and identity providers that support Security Assertion Markup Language (SAML) 2.0 Web Single Sign On. This process is described throughout the documentation as setting up enterprise logins.
The advantage of this approach is that you do not need to create additional accounts within the portal. Members use the login that is already set up within the enterprise identity store. The management of account credentials is completely external to the portal. This enables a single sign-on experience so users will not need to reenter their credentials.
Similarly, you can also create groups in the portal that leverage the existing enterprise groups in your identity store. Also, enterprise accounts can be added in bulk from the enterprise groups in your organization. When members log in to the portal, access to content, items, and data are controlled by the membership rules defined in the enterprise group. The management of group membership is completely external to the portal.
For example, a recommended practice is to disable anonymous access to your portal, connect your portal to the desired enterprise groups in your organization, and add the enterprise accounts based on those groups. In this manner, you restrict access to the portal based on specific enterprise groups within your organization.
Use an enterprise identity store if your organization wants to set policies for password expiration and complexity, control access using existing enterprise groups, or leverage authentication over Integrated Windows Authentication (IWA) or Public Key Infrastructure (PKI). Authentication can be handled at the web-tier (using web-tier authentication), at the portal-tier (using portal-tier authentication), or through an external identity provider (using SAML).
Supporting multiple identity stores
Using SAML 2.0, you can allow access to your portal using multiple identity stores. Users can sign in with built-in accounts and accounts managed in multiple SAML-compliant identity providers configured to trust one another. This is a good way to manage users that may reside within or outside your organization. For full details, see Configuring a SAML-compliant identity provider with your portal.
Understanding access privileges
Once you've decided how accounts will be managed in ArcGIS Enterprise, you need to decide what privileges you want users that access your ArcGIS organization to have. Privileges are defined by whether or not the user accessing your portal is part of the ArcGIS organization.
Users that access the portal without an ArcGIS organizational account can only search for and use public items. For example, if a public web map is embedded into a website, users looking at the map will be accessing an item of your portal, even though they do not have an account. It is up to you to enable this type of access. You can always disable access to persons that do not already belong to the ArcGIS organization. To learn how to do this, see Disabling anonymous access.
Users can access your portal with elevated privileges if they are members of your ArcGIS organization. Members of your ArcGIS organization are listed on the Organization page of the portal website. Members of an organization are organized by membership levels which correspond to various roles with different privileges. To learn more about the different levels of privileges, see organization roles.
When a new ArcGIS organizational account is added to your portal, it will be granted the user role by default. However, the portal administrator can change the role at any time.
Managing ArcGIS organizational accounts
An ArcGIS organizational account is a user account that has been added to the organization panel of your portal website. Throughout the documentation and user experience in the portal website, these users are typically referred to as members of the organization.
As an administrator, it is important that you fully control not only the privileges granted to each member of your ArcGIS organization but also who is allowed to be a member of it.
The maximum number of ArcGIS organizational accounts in your portal is defined by the authorization file you used to activate the software. At any point in time, you can compare the total number of members in your organization and the maximum allowed from the Organization page in the portal website. Under Total Membership, Current Count lists the current number of portal members and Maximum Allowed shows the total number of members for which the portal is authorized.
Managing accounts when using the built-in store
When using the built-in store, the portal website will, by default, show a link that any user can use to join the ArcGIS organization. This makes it easy for people to join your organization, but you can't really restrict who joins; anyone with access to your portal can create an account. If you want more control, you can disable this self-serve experience and provision in bulk your portal with a predefined number of accounts. To learn more about creating ArcGIS organizational accounts in bulk, see Adding members to your portal. You can also remove members from your portal website or change their privileges at any time.
Managing accounts when using an enterprise identity store
The ArcGIS Enterprise portal will not allow you to delete, edit, or create new accounts in your enterprise store, but you can register existing enterprise accounts in your organization. For this reason, the sign-up page in the portal website will not be available when you configure your portal with an enterprise identity store.
As an administrator, you will typically select enterprise logins you want to add into the organization and add them in bulk. To learn more about creating ArcGIS organizational accounts in bulk, see Adding members to your portal. You can also remove members from your portal website or change their privileges at any time.
Alternatively, you can add any enterprise account that connects to your portal or any of its items automatically. To learn more, see Automatic registration of enterprise accounts.
It's important to understand that when the portal is configured with an enterprise identity store, anonymous access to the ArcGIS organization is disabled; that is, any user accessing your portal must authenticate against your enterprise store first. Once authenticated, the privileges of the user will be determined by whether or not they have an ArcGIS organizational account.
Legacy:
At Portal for ArcGIS 10.2, enterprise accounts were automatically registered as members of the organization. This means that your organization may have unintentionally exceeded the maximum number of members. When you upgrade Portal for ArcGIS 10.2 to a later version, the legacy behavior persists; accounts are still automatically registered by default. Conversely, new installations of Portal for ArcGIS do not allow automatic account creation. If you upgraded your portal from 10.2 to a later version, you may want to consider turning this behavior off to have more control over which users are added as members in your organization. For full instructions, see Automatic registration of enterprise accounts.
Account lockout policy
Software systems often enforce an account lockout policy to protect against mass automated attempts to guess a user's password. If a user makes a certain number of failed login attempts within a particular time interval, they may be denied further attempts for a designated time period. These policies are balanced against the reality that sometimes users will forget their names and passwords and fail to log in successfully.
The lockout policy enforced by Portal for ArcGIS depends on which type of identity store you're using:
Built-in identity store
The built-in identity store locks out a user after ten consecutive invalid attempts. The lockout lasts for ten minutes. This policy applies to all accounts in the identity store, including the initial administrator account. This policy cannot be modified or replaced.
Enterprise identity store
When you're using an enterprise identity store, the account lockout policy is inherited from the store. You may be able to modify the account lockout policy for the store. Consult the documentation specific to the store type to learn how to change the account lockout policy.