nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

IWA with a Federated ArcGIS Server

NathanHeickLACSD

If you set up your portal with IWA and then federate a GIS server with it, does windows authentication automatically work without toggling the authentication method in IIS? It seems to be working through both the web adaptor and port 6443 immediately after federating without enabling Windows authentication in IIS or disabling anonymous authentication. How does that work?

Najděte více příspěvků označených jako

Accepted answers

HenryLindemann

Hi @NathanHeickLACSD,

When you federate the portal takes over security, it does this by writing your portal dns e.g. https://dns.com/portal in your security configs, so when you hit https://dns.com/server/manager or https://dns.com:6443/argis/manager this then authenticates against the https://dns.com/portal DNS which is setup to use IWA, you will see that for https://dns.com:6443/argis/admin you do not get clanged, as this does not authenticate through portal.

Regards

Henry

All comments

HenryLindemann

Hi @NathanHeickLACSD,

Regards

Henry

NathanHeickLACSD

Thanks, @hlindemann. I really appreciate your knowledge. To take it further, does this mean that if you disable the PSA, the only way to access the server admin URL is to generate a token through the portal. I tried that mechanism and I was successful. Finally, is there any benefit or harm in turning on Windows authentication for the server web adaptor?

Thanks,
Nathan

HenryLindemann

Hi @NathanHeickLACSD , on the PSA yes that is correct,

On the IWA the benefit would be that once you configure internet option for your users, they will be auto logged in, if you setup auto account creation then this can be quite useful in a large organization, because you can just hit the URL and create the account.

Downside,

The downside comes in when you have public apps the general public will not be able to access these Apps because they get the IWA challenge, in this case it would be more beneficial to setup something like SAML, you can have the benefit of SSO and the flexibility of being able to share apps public, and if you have office365 you already have the capability to setup SAML.

Regards

Henry

Připojte se ke konverzaci

Přihlášení členové mohou přispívat, sledovat aktualizace a další. Jste tu noví? Zaregistrujte si bezplatný účet.

Rychlé odkazy

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.