Is there a known bug that allows anonymous access to ArcGIS Enterprise Services even when it's federated to a Portal that DOES NOT allow anonymous access?

Question

Good afternoon folks!

We have an old ArcGIS Enterprise 10.9.1 deployment that we're intending to upgrade to 11.5 soon.  The ArcGIS Servers are federated with the Portal and anonymous access is turned off.  When investigating user access while planning the upgrade, we noticed that our ArcGIS Servers allow us to access services and load them from other sites without us needing to log in.  If we log into the ArcGIS Portal first, though, then we can clearly see our username when viewing the service, so it clearly is federated with the Portal.  Additionally, we are using the ArcGIS WebAdaptors.  We have noticed this occur in several environments that we use for testing, implying that it is either a common issue or something unique to our configurations that have propagated to every environment.  Just looking for a lead.

Thanks!

DominicF · Answer

Hi @NickHallal1, would also be interested in George's question from above. The anonymous access setting in Portal only controls access to the Portal web site itself.

Disable anonymous access -

https://doc.esri.com/en/arcgis-enterprise/latest/administer/disabling-anonymous-access.html?pivots=os-windows

* "The portal's anonymous access option controls access to the portal website. The sharing options chosen for individual items in the portal control access to the underlying services, such as hosted feature services and all types of other services, including map services, image services, and so on."

George_Thompson · Answer

How are those items shared: Private (Owner)/ Groups / Organization / Everyone (Public)?