Update Identity Store

URL:
https://<root>/security/config/updateIdentityStore
Methods:
POST
Required Capability:
Access allowed with the "Security and infrastructure" privilege
Version Introduced:
10.9

Description

The updateIdentityStore operation updates the identity provider and role (group) store configurations for ArcGIS Enterprise on Kubernetes. The default access mode is token-based authentication and built-in groups using the built-in identity store. To configure your organization to connect to your enterprise authentication mechanism and role (group) store, it must be configured to use an enterprise identity store such as Windows Active Directory or LDAP.

Request parameters

ParameterDetails

userStoreConfig

Specifies the user store properties. This parameter accepts as input all the properties as defined in the userStoreConfig and roleStoreConfig properties section below.

roleStoreConfig

Specifies the role (group) store properties. This parameter accepts as input all the properties as defined in the userStoreConfig and roleStoreConfig properties section below.

f

The response format. The default format is html.

Values: html | json | pjson

userStoreConfig and roleStoreConfig properties

ParameterDetails

userPassword

The password for the domain account.

Example
Use dark colors for code blocksCopy
1
"userPassword": "secret"

isPasswordEncrypted

Indicates whether the userPassword property is an encrypted password or plain text. If the property is false, the API will encrypt the password automatically.

Values: true | false

user

A user account with at least read permissions to look up the email addresses and usernames of users in your organization. If possible, use an account whose password does not expire.

Examples
Use dark colors for code blocksCopy
1
2
3
4
5
//Windows Active Directory
"user": "mydomain\\winaccount"

//LDAP example
"user": "uid-admin,ou=system"

userFullnameAttribute

The attribute in Windows Active Directory or LDAP that contains the user's full name.

Example
Use dark colors for code blocksCopy
1
"userFullnameAttribute": "cn"

ldapURLForUsers

The URL to your LDAP that points to the user accounts. The URL to your LDAP must be provided by your LDAP administrator. Although both LDAP and LDAPS URLs are supported, LDAPS is recommended to ensure encrypted network traffic between your deployment and LDAP server. If LDAPS is not available, a LDAP URL can be used. However, traffic will be sent in clear text. This property is not applicable when configuring Windows Active Directory.

Example
Use dark colors for code blocksCopy
1
"ldapURLForUsers": "ldaps://bar2:10636/ou=users,ou=ags,dc=example,dc=com"

ldapURLForRoles

The URL to your LDAP that points to the roles. The URL to your LDAP must be provided by your LDAP administrator. Although both LDAP and LDAPS URLs are supported, LDAPS is recommended to ensure encrypted network traffic between the portal and LDAP server. If LDAPS is not available, a LDAP URL can be used but traffic will be sent in clear text. This property is not applicable when configuring Windows Active Directory.

Example
Use dark colors for code blocksCopy
1
"ldapURLForRoles": "ldaps://bar2:10636/ou=roles,ou=ags,dc=example,dc=com"

userEmailAttribute

The attribute in Windows Active Directory or LDAP that contains the email addresses of users.

Example
Use dark colors for code blocksCopy
1
"userEmailAttribute": "mail"

usernameAttribute

The LDAP attribute of the user entry that is to be treated as the username. This property is not applicable when configuring Windows Active Directory.

Example
Use dark colors for code blocksCopy
1
"usernameAttribute": "cn"

userSearchAttribute

When using LDAP and PKI, you'll need to specify the value for userSearchAttribute. The userSearchAttribute is the value of the Subject parameter of the PKI certificate. If your organization uses another attribute in the PKI certificate, such as email, you must update the userSearchAttribute to match the Subject parameter in the PKI certificate.

caseSensitive

If your Windows Active Directory is configured to be case sensitive, set this property to true. If your LDAP is configured to be case insensitive, set the parameter to false.

Values: true | false

followReferrals

This property controls whether LDAP referrals are followed when ArcGIS Enterprise on Kubernetes queries domain controllers for user or group information. By default, this is set to true.

Values: true | false

domainControllerAddress

A comma-separated list of one or more host names or IP addresses for the domain controllers to be used by ArcGIS Enterprise on Kubernetes. This property is required if the user or role (group) store config type is set to WINDOWS.

domainControllerMapping

The host name or IP address of one or more domain controllers for specific domains. In a multidomain environment, this is needed to link domain names to specific domain controllers. Multiple domains can be listed along with multiple host names or IP addresses for each domain. This property is required if the user or role (group) store config type is set to WINDOWS.

Syntax
Use dark colors for code blocksCopy
1
domain1.com=hostname1, hostname2; domain2.com=hostname3, hostname4

refreshUserMembershipDuringLoginEnabled

This property is only applicable when configuring the role (group) store. By default, each time an enterprise user signs in to portal, the groups are refreshed automatically. If this behavior adversely affects login performance, it can be disabled by setting the value of this parameter to false. The default value is true.

Values: true | false

membershiprefreshIntervalHours

This property is only applicable when configuring the role (group) store. ArcGIS Enterprise on Kubernetes periodically refreshes all user memberships. This parameter determines the interval at which the refresh repeats. The default value is 24 (hours).

membershipRefreshStartTime

This property is only applicable when configuring the role (group) store. This parameter determines the start time of the periodic fresh. The format is a 24-hour clock string. The default time is midnight ("00:00"). The refresh operation may be computationally expensive, so it is recommended that the refresh time not be during business hours when the portal may be busy.

checkForMultipleUsernameFormats

This property is only applicable when configuring the user store with Windows Active Directory and using portal-tier authentication to sign in. By default, checkForMultipleUsernameFormats is false, and any enterprise users that sign in must use the following username formats: DOMAIN\username or username@DOMAIN. If checkForMultipleUsernameFormats is true, your portal will attempt to use different username formats if the initial attempt fails (includes username and username@DOMAIN.com).

Values: true | false

useSSLOnly

This property applies to Windows Active Directory only. It enforces encrypted communication between ArcGIS Enterprise on Kubernetes and Active Directory. When the property is set to true, if encrypted communication fails, the portal does not attempt to communicate without encryption. This property is set to false by default.

Values: true | false

userGivenNameAttribute

This property applies to both Windows Active Directory and LDAP. This property can be used to return the actual first name value stored in the Windows Active Directory or LDAP identity store.

userSuernameAttribute

This property applies to both Windows Active Directory and LDAP. This property can be used to return the actual last name value stored in the Windows Active Directory or LDAP identity store.

Example usage

The following is a sample POST request for the updateIdentityStore operation:

Use dark colors for code blocksCopy
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
POST /context/admin/security/config/updateIdentityStore HTTP/1.1
Host: organization.domain.com
Content-Type: application/x-www-form-urlencoded
Content-Length: []

userStoreConfig={
  "type": "WINDOWS",
  "properties": {
    "userPassword": "secret",
    "isPasswordEncrypted": "false",
    "user": "mydomain\\winaccount",
    "userFullnameAttribute": "displayName",
    "userEmailAttribute": "mail",
    "userGivenNameAttribute": "givenName",
    "userSurnameAttribute": "sn",
    "caseSensitive": "false",
    "domainControllerAddress": "10.50.4.36, 10.48.4.1",
    "domainControllerMapping": "uc.esri.com=10.50.4.134, 10.50.4.133; esri.com=10.50.4.36, 10.48.4.1"
  }
}&roleStoreConfig={
  "type": "WINDOWS",
  "properties": {
    "isPasswordEncrypted": "true",
    "userPassword": "xxx",
    "user": "mydomain\\winaccount",
    "domainControllerAddress": "10.50.4.36, 10.48.4.1",
    "domainControllerMaping": "uc.esri.com=10.50.4.134, 10.50.4.133; esri.com=10.50.4.36, 10.48.4.1"
  }
}&f=pjson&token=Mb0ORrkLObNO2Q8FZoUCHHzSMzZi0CbhLHNRYMqqa6URG_ojQJF3rNsJAfRB23MyCrLwSmuaHPUo4AEIrUuoH1-4Ot5xh4565FtlQahXAhK2C7Sy0oydZhBwD8KdFSnVlnLr-e9uI5ovSWZ2lGNn9SwoV2MPMzeAh_5r-q-wgwF8DTT_nhuCXJGkMRy-48jjGS2aN5FI18STHZ8RAuKxGasH90SI3C7njZzlGCUrY5m6BDhCMsdpZA14GwNX8Cis

JSON Response example

Use dark colors for code blocksCopy
1
{"status": "success"}

Your browser is no longer supported. Please upgrade your browser for the best experience. See our browser deprecation post for more details.