Authorization using Windows groups

When Kerberos delegation between the Integrator and Portal for ArcGIS is not enabled, end users are authorized to access data in time-enabled feature layers via the PI Geo Admins and PI Geo Users Windows groups. The Integrator verifies that the identity of the user requesting access to a layer is a member of one of these Windows groups and authorizes access to the data if the user is confirmed as a group member. In this scenario, Portal for ArcGIS handles authentication to the portal item but not to the underlying data in the feature layer.

Follow these instructions to enable time-enabled feature layer authorization using Windows groups.

1. Add the Windows accounts of end users that require access to time-enabled feature layers to either the PI Geo Admins or PI Geo Users group. See Configure a user.

2. Modify the PI Integrator for Esri ArcGIS configuration file to set the useiwamode parameter to 2. See useiwamode configuration parameter.