Portal for ArcGIS Publish Exception - Could not Decrypt Token

EricMahaffey1

Has anyone had to troubleshoot an error when publishing to Portal for ArcGIS that reads: Publish exception 'Could not decrypt token.  Token may not be valid'

I see an entry on both Portal and ArcGIS Server logs when trying to publish a feature service within Portal

Any advice would be much appreciated.

EricMahaffey1

I ended up figuring out the problem.  It's a long story so I'll try to explain all that I found and resolved.  It goes back to your original question of whether or not I could validate the federated server.  Apparently the instance of ArcGIS Server was not completely federated with Portal in my case.  Even though I could validate it through the Portal Home page ( i.e. /home/organization.html and selecting the "Servers" tab). 

(Pardon the rambled dump of information that is about to follow, but I pulled it from my notes which aren’t written as a well-developed story.)  I think it stems back to some issues I was having with getting certificates loaded properly on the server.  At that time I was getting an error "Invalid SSL certificate found.  PKIX path building failed..... ".  We ended up having to enable client certificates using a NETSH command (our resident server admin took care of it so I don't know all the details).  After which federating through the Portal Home page still wasn't working, so I dug into it a bit more.  In the Portal logs there was a 403 "not accessible" error associated with a link to the ArcGIS Portal Directory (i.e. /sharing/portals/self/servers/register).  On a whim I tried navigating to that link within a browser.  I noticed that it gives all of the same options to federate a server as the Portal Home page did.  I entered the information, checked "is hosted" to true, and clicked "register".  When I went back to the Portal Home federation page the server was now federated and listed as the hosting server.  Clicking "Validate Server" verified that all appeared to be configured properly.  Well when I tried a test in portal (add a zipped shape file and publish as feature layer), another error occurred.  This time it was “Failed to publish item…….exception.  Hostname in certificate didn’t match”.  To get past this I had to export the certificate used to configure https site bindings within IIS (root certificate with the private key), then import the certificate through the ArcGIS Server Administrator Directory (Home>machines>”machine name”>sslcertificates>importexistingservercertificate).  After that I was able to finish configuring the server to use the new certificate for SSL.  This finally brings us to the error that I originally posted.  The site wouldn’t publish a feature layer (Failed to publish item….. .zip …… could not decrypt token.  Token may not be valid”.  While doing some digging I found out that it’s possible to import all services within a federated server using the ArcGIS Server Administrator Directory (Home>Services>Supported Operations>federate).  However, this wasn’t an option on my page.  This is what lead me to believe that the server wasn’t completely federated.  So I then unregistered the server federation through the ArcGIS Portal Directory (REST endpoint).  Then going back to the Portal Home page I was finally able to federate the server properly.  Testing proved that a feature layer could now be published.

Again apologies to all for the long winded info dump.  I just wanted to throw it out there in case anyone else runs into the same problem.