Update Identity Store

URL:: https://<root>/security/config/updateIdentityStore
Methods:: POST
Required Capability:: Access allowed with the "Security and infrastructure" privilege
Version Introduced:: 10.9

Description

The updateIdentityStore operation updates the identity provider and role (group) store configurations for ArcGIS Enterprise on Kubernetes. The default access mode is token-based authentication and built-in groups using the built-in identity store. To configure your organization to connect to your enterprise authentication mechanism and role (group) store, it must be configured to use an enterprise identity store such as Windows Active Directory or LDAP.

Request parameters

Parameter Details

Parameter	Details
`userStoreConfig`	Specifies the user store properties. This parameter accepts as input all the properties as defined in the userStoreConfig and roleStoreConfig properties section below.
`roleStoreConfig`	Specifies the role (group) store properties. This parameter accepts as input all the properties as defined in the userStoreConfig and roleStoreConfig properties section below.
`f`	The response format. The default format is `html`. Values: `html` \| `json` \| `pjson`

userStoreConfig

Specifies the user store properties. This parameter accepts as input all the properties as defined in the userStoreConfig and roleStoreConfig properties section below.

roleStoreConfig

Specifies the role (group) store properties. This parameter accepts as input all the properties as defined in the userStoreConfig and roleStoreConfig properties section below.

f

The response format. The default format is html.

Values: html | json | pjson

userStoreConfig and roleStoreConfig properties

Parameter	Details
`userPassword`	The password for the domain account. Example Use dark colors for code blocksCopy `1 "userPassword": "secret"`
`isPasswordEncrypted`	Indicates whether the `userPassword` property is an encrypted password or plain text. If the property is `false`, the API will encrypt the password automatically. Values: `true` \| `false`
`user`	A user account with at least read permissions to look up the email addresses and usernames of users in your organization. If possible, use an account whose password does not expire. Examples Use dark colors for code blocksCopy `1 2 3 4 5 //Windows Active Directory "user": "mydomain\\winaccount" //LDAP example "user": "uid-admin,ou=system"`
`userFullnameAttribute`	The attribute in Windows Active Directory or LDAP that contains the user's full name. Example Use dark colors for code blocksCopy `1 "userFullnameAttribute": "cn"`
`ldapURLForUsers`	The URL to your LDAP that points to the user accounts. The URL to your LDAP must be provided by your LDAP administrator. Although both LDAP and LDAPS URLs are supported, LDAPS is recommended to ensure encrypted network traffic between your deployment and LDAP server. If LDAPS is not available, a LDAP URL can be used. However, traffic will be sent in clear text. This property is not applicable when configuring Windows Active Directory. Example Use dark colors for code blocksCopy `1 "ldapURLForUsers": "ldaps://bar2:10636/ou=users,ou=ags,dc=example,dc=com"`
`ldapURLForRoles`	The URL to your LDAP that points to the roles. The URL to your LDAP must be provided by your LDAP administrator. Although both LDAP and LDAPS URLs are supported, LDAPS is recommended to ensure encrypted network traffic between the portal and LDAP server. If LDAPS is not available, a LDAP URL can be used but traffic will be sent in clear text. This property is not applicable when configuring Windows Active Directory. Example Use dark colors for code blocksCopy `1 "ldapURLForRoles": "ldaps://bar2:10636/ou=roles,ou=ags,dc=example,dc=com"`
`userEmailAttribute`	The attribute in Windows Active Directory or LDAP that contains the email addresses of users. Example Use dark colors for code blocksCopy `1 "userEmailAttribute": "mail"`
`usernameAttribute`	The LDAP attribute of the user entry that is to be treated as the username. This property is not applicable when configuring Windows Active Directory. Example Use dark colors for code blocksCopy `1 "usernameAttribute": "cn"`
`userSearchAttribute`	When using LDAP and PKI, you'll need to specify the value for `userSearchAttribute`. The `userSearchAttribute` is the value of the `Subject` parameter of the PKI certificate. If your organization uses another attribute in the PKI certificate, such as `email`, you must update the `userSearchAttribute` to match the `Subject` parameter in the PKI certificate.
`caseSensitive`	If your Windows Active Directory is configured to be case sensitive, set this property to `true`. If your LDAP is configured to be case insensitive, set the parameter to `false`. Values: `true` \| `false`
`followReferrals`	This property controls whether LDAP referrals are followed when ArcGIS Enterprise on Kubernetes queries domain controllers for user or group information. By default, this is set to `true`. Values: `true` \| `false`
`domainControllerAddress`	A comma-separated list of one or more host names or IP addresses for the domain controllers to be used by ArcGIS Enterprise on Kubernetes. This property is required if the user or role (group) store `config` type is set to `WINDOWS`. Note ArcGIS Enterprise on Kubernetes always attempts to make a secure LDAPS connection to the domain controller. If the LDAP TLS certificate used by the domain controller is not trusted, or the domain name or IP address used to access it is not included as a subject alternative name in the certificate, the connection will fail and ArcGIS Enterprise on Kubernetes will attempt to use a regular LDAP connection.
`domainControllerMapping`	The host name or IP address of one or more domain controllers for specific domains. In a multidomain environment, this is needed to link domain names to specific domain controllers. Multiple domains can be listed along with multiple host names or IP addresses for each domain. This property is required if the user or role (group) store `config` type is set to `WINDOWS`. Note ArcGIS Enterprise on Kubernetes always attempts to make a secure connection to the domain controller. The TLS certificate used by the domain controller must have the host name or IP address included as a subject alternative name in the certificate for proper certificate verification. Syntax Use dark colors for code blocksCopy `1 domain1.com=hostname1, hostname2; domain2.com=hostname3, hostname4`
`refreshUserMembershipDuringLoginEnabled`	This property is only applicable when configuring the role (group) store. By default, each time an enterprise user signs in to portal, the groups are refreshed automatically. If this behavior adversely affects login performance, it can be disabled by setting the value of this parameter to `false`. The default value is `true`. Values: `true` \| `false`
`membershiprefreshIntervalHours`	This property is only applicable when configuring the role (group) store. ArcGIS Enterprise on Kubernetes periodically refreshes all user memberships. This parameter determines the interval at which the refresh repeats. The default value is 24 (hours).
`membershipRefreshStartTime`	This property is only applicable when configuring the role (group) store. This parameter determines the start time of the periodic fresh. The format is a 24-hour clock string. The default time is midnight ("00:00"). The refresh operation may be computationally expensive, so it is recommended that the refresh time not be during business hours when the portal may be busy.
`checkForMultipleUsernameFormats`	This property is only applicable when configuring the user store with Windows Active Directory and using portal-tier authentication to sign in. By default, `checkForMultipleUsernameFormats` is `false`, and any enterprise users that sign in must use the following username formats: `DOMAIN\username` or `username@DOMAIN`. If `checkForMultipleUsernameFormats` is `true`, your portal will attempt to use different username formats if the initial attempt fails (includes `username` and `username@DOMAIN.com`). Values: `true` \| `false`
`useSSLOnly`	This property applies to Windows Active Directory only. It enforces encrypted communication between ArcGIS Enterprise on Kubernetes and Active Directory. When the property is set to `true`, if encrypted communication fails, the portal does not attempt to communicate without encryption. This property is set to `false` by default. Values: `true` \| `false`
`userGivenNameAttribute`	This property applies to both Windows Active Directory and LDAP. This property can be used to return the actual first name value stored in the Windows Active Directory or LDAP identity store.
`userSuernameAttribute`	This property applies to both Windows Active Directory and LDAP. This property can be used to return the actual last name value stored in the Windows Active Directory or LDAP identity store.

Example usage

The following is a sample POST request for the updateIdentityStore operation:

Use dark colors for code blocksCopy
POST /context/admin/security/config/updateIdentityStore HTTP/1.1
Host: organization.domain.com
Content-Type: application/x-www-form-urlencoded
Content-Length: []

userStoreConfig={
  "type": "WINDOWS",
  "properties": {
    "userPassword": "secret",
    "isPasswordEncrypted": "false",
    "user": "mydomain\\winaccount",
    "userFullnameAttribute": "displayName",
    "userEmailAttribute": "mail",
    "userGivenNameAttribute": "givenName",
    "userSurnameAttribute": "sn",
    "caseSensitive": "false",
    "domainControllerAddress": "10.50.4.36, 10.48.4.1",
    "domainControllerMapping": "uc.esri.com=10.50.4.134, 10.50.4.133; esri.com=10.50.4.36, 10.48.4.1"
  }
}&roleStoreConfig={
  "type": "WINDOWS",
  "properties": {
    "isPasswordEncrypted": "true",
    "userPassword": "xxx",
    "user": "mydomain\\winaccount",
    "domainControllerAddress": "10.50.4.36, 10.48.4.1",
    "domainControllerMaping": "uc.esri.com=10.50.4.134, 10.50.4.133; esri.com=10.50.4.36, 10.48.4.1"
  }
}&f=pjson&token=Mb0ORrkLObNO2Q8FZoUCHHzSMzZi0CbhLHNRYMqqa6URG_ojQJF3rNsJAfRB23MyCrLwSmuaHPUo4AEIrUuoH1-4Ot5xh4565FtlQahXAhK2C7Sy0oydZhBwD8KdFSnVlnLr-e9uI5ovSWZ2lGNn9SwoV2MPMzeAh_5r-q-wgwF8DTT_nhuCXJGkMRy-48jjGS2aN5FI18STHZ8RAuKxGasH90SI3C7njZzlGCUrY5m6BDhCMsdpZA14GwNX8Cis

JSON Response example

Use dark colors for code blocksCopy
{"status": "success"}