Enterprise Security allowedProxyHost Portal Admin 10.6.1

Question

Hi all,

I have an external facing Portal (10.6.1). I'm working through and configuring the ArcGIS Enterprise security recommendations. I'm wanting to get get some clarification on what I should be entering into the Portal Admin Directory for the allowedProxyHosts.

From what I understand these should external domains that the portal can access content from? You have to add a new domain for every external server that you want to consume resources from. This protects your Portal from being used for Malicious attacks?

So for the example highlighted  "(.*).arcgis.com" if I added this to my allowdProxyHosts my Portal will be allowed to get resources from any machine with a domain ending in .arcgis.com?

If I wanted to get resources from https://xyz.com I would add this as well ?

Do the domains need prefaced with https:// ?

Any help would be appreciated.

Thanks,

Clinton

ZianChoy · Answer

Unfortunately, Portal is too clever for a simple dummy entry. I tried:

"allowedProxyHosts":""

And restarted the Portal for ArcGIS Service. Afterwards, the Security Configuration web page in the Portal Administrator Directory no longer shows the allowedProxyHosts property at all.

I'm guessing that the dummy entry should be a domain that we control. For example, the dummy entry for Randall Williams's development server might be:

"allowedProxyHosts":"nonexistentsubdomain.esri.com"

RandallWilliams · Answer

I'm pretty sure that the federated endpoints are automatically added to the allowed proxy hosts list. Requests to servers that are not allowed receive a http 403 response.

DavidHoy · Answer

Randall Williams‌

if the Server Site is federated with the Portal using an AdminURL via an internal Load Balancer - do you need to add the Load Balancer URL instead of the individual Servers' URLs?