Does serverScan.py issue SS06 make sense in a federated deployment?

Anonymous User

When running serverScan.py against ArcGIS Server in a federated environment, issue ID SS06 is raised for each service in the System folder. For context, here is the text of one of the issues:

Id	Severity	Property Tested	Scan Results
SS06	Critical	System/CachingControllers service permissions	Open to roles: esriAuthenticated Non-default permissions are applied to this service within the System folder in Server Manager. To ensure only administrators and publishers have access to the service in the System folder, no roles should be assigned to the service. More information

It seems that the role esriAuthenticated refers to users that have been authenticated by Portal in the federated ArcGIS Enterprise deployment. So, does this error even make sense in this context?

RandallWilliams

I don't see this in my reports in my federated environment, but makes sense to me. There's a difference between authenticated and authorized. Not every user that is authenticated should be authorized to this resource. Only publishers or higher should have rights to caching controllers. Otherwise an unauthorized user could potentially kick off a caching job on a service and cause resource consumption issues or fill up your disk with tiles.