JSON that specifies the properties being changed for the Enterprise portal identity provider and group store.

The response format. The default is html.

Values: html | json | pjson

The password for the domain account.

"userPassword": "secret"

Indicates if the userPassword property is an encrypted password or plain text. If the property is false, the API will encrypt the password automatically.

Values: true | false

"isPasswordEncrypted": "false"

A user account with at least read permissions to look up the email addresses and user names of users in your organization. If possible, use an account whose password does not expire.

//Windows Active Directory
"user": "mydomain\\winaccount"

//LDAP example
"user": "uid=admin,ou=system"

The attribute in Windows Active Directory or LDAP that contains the full name of the users.

"userFullnameAttribute": "cn"

The URL to your LDAP that points to the user accounts. The URL to your LDAP will need to be provided by your LDAP administrator. Although both LDAP and LDAPS URLs are supported, LDAPS is highly recommended to ensure encrypted network traffic between Enterprise portal and LDAP servers. If LDAPS is not available, an LDAP URL can be used but traffic will be sent in clear-text. This property is not applicable when configuring Windows Active Directory.

"ldapURLForUsers": "ldaps://bar2:10636/ou=users,ou=ags,dc=example,dc=com"

The URL to your LDAP that points to the roles. The URL to your LDAP will need to be provided by your LDAP administrator. Although both LDAP and LDAPS URLs are supported, LDAPS is highly recommended to ensure encrypted network traffic between Enterprise portal and LDAP servers. If LDAPS is not available, an LDAP URL can be used but traffic will be sent in clear-text. This property is not applicable when configuring Windows Active Directory.

"ldapURLForRoles": "ldaps://bar2:10636/ou=roles,ou=ags,dc=example,dc=com"

The attribute in Windows Active Directory or LDAP that contains the email addresses of the users.

"userEmailAttribute": "mail"

The LDAP attribute of the user entry that is to be treated as the user name. This property is not applicable when configuring Windows Active Directory.

"usernameAttribute": "cn"

When using LDAP and PKI to secure access to Enterprise portal, you'll need to specify the value for userSearchAttribute. The userSearchAttribute is the value of the Subject parameter of the PKI certificate. If your organization uses another attribute in the PKI certificate, such as email, you must update the userSearchAttribute to match the Subject parameter in the PKI certificate.

In the rare case where your Windows Active Directory is configured to be case sensitive, set this property to true. If your LDAP is configured to be case insensitive, set parameter to false.

"caseSensitive": "true"

Introduced at 10.6. This property controls whether LDAP referrals are followed when Enterprise portal queries domain controllers for user or group information. By default, this is set to true.

"followReferrals": "true"

The IP address of the domain controller to be used by Enterprise portal. You'll need to specify the domain controller if your Active Directory deployment includes multiple domain controllers, but not all domain controllers are configured as global catalog servers. Starting in 10.6, multiple IP addresses can be listed, and IPv6 addresses are supported.

Introduced at 10.6. The IP address of the domain controller for specific domains. Multiple domains can be listed along with multiple IP addresses for each domain. The syntax is as follows: domain_name=ip_address, ip_address; domain_name=ip_address, ip_address. The IP addresses can be either IPv4 or IPv6.

This property is only applicable when configuring the group store. By default, each time an enterprise user signs in to Enterprise portal, the groups are refreshed automatically. If this behavior adversely affects login performance, it can be disabled by setting the value of this parameter to false. The default value of this parameter is true.

"refreshUserMembershipDuringLoginEnabled": "true"

This property is only applicable when configuring the group store. Enterprise portal periodically refreshes all user memberships. This parameter determines the interval at which the refresh repeats. The default value is 24 hours.

This property is only applicable when configuring the group store. This parameter determines the start time of the periodic refresh. The format is a 24 hour clock string. The default start time is midnight ("00:00"). The refresh operation may be computationally expensive, so it is recommended that the refresh time not be during business hours when Enterprise portal may be busy.

This property is only applicable when configuring the user store with Windows Active Directory and using portal-tier authentication to sign in. By default, checkForMultipleUsernameFormats is false and any enterprise user that signs into Enterprise portal will need to use the following username formats: DOMAIN\username or username@DOMAIN. If checkForMultipleUsernameFormats is true, Enterprise portal will attempt to use different username formats if the initial attempt fails (includes username and username@DOMAIN.com).

"checkForMultipleUsernameFormats": "true"

This property applies to the Windows Active Directory only. It enforces encrypted communication between Enterprise portal and Active Directory. When the property is set to true, if encrypted communication fails, Enterprise portal does not attempt to communicate without encryption. This property is set to false by default.

"useSSLOnly": "false"

Introduced at 10.8, this property applies to both Windows Active Directory and LDAP. This property can be used to return the actual first name value stored in the Windows Active Directory or LDAP identity store.

Introduced at 10.8, this property applies to both Windows Active Directory and LDAP. This property can be used to return the actual last name value stored in the Windows Active Directory or LDAP identity store.

Introduced at 10.9. Defines the SASL authentication scheme used by Portal for ArcGIS to connect to the domain controllers via LDAP. In 10.9, the only SASL authentication scheme that is supported is GSSAPI.

"saslAuthenticationScheme": "GSSAPI"

Introduced at 10.9. Defines the path to the Kerberos configuration text file that is needed when utilizing the GSSAPI SASL authentication scheme. This file needs to reside in a location that the Portal for ArcGIS service account has read-access to.

"krb5ConfigFilePath": "C:\\arcgisportal\\krb5.conf"

"krb5ConfigFilePath": "/data/arcgis/krb5.conf"

This configuration file is standard for Kerberos and should include default configuration settings and information on one or more Kerberos domain controllers for each Kerberos realm. An example is shown below:

[libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    default_ccache_name = KEYRING:persistent:%{uid}
    dns_lookup_kdc = true
    default_realm = EXAMPLE.COM
    default_checksum = rsa-md5

[realms]

EXAMPLE.COM = {
    kdc = domaincontroller.example.com
    admin_server = domaincontroller.example.com
}

[domain_realm]
    example.com = EXAMPLE.COM
    .example.com = EXAMPLE.COM