nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Connect to Portal with IWA

JoeHershman

I am trying to connect to a Portal that uses IWA and get an error:

Failed Kerberos authentication

I have tried both the domain accounts and the initial administrator account setup with same issue. Is it possible to login to a site with IWA? If so what am I not doing correct

target = GIS("https://pmydoamin.com/portal", "user@domain", "pwd", verify_cert=False)

Thanks

Encuentra más publicaciones etiquetadas con

Accepted answers

SupratimBanik

Hi Joe,

Can you try querying your user object after attempting to connect to your GIS:

target.properties.user.username

Does that report your username?

You're getting 'Failed Kerberos authentication' but NTLM authentication may be succeeding as you're not getting a 'Failed to authenticate using NTLM' error.

Thanks,

Rohit

All comments

Christian_Wells

Have you tried created the GIS object without the username or password?

The doc here for IWA points to not using a username or password:

Working with different authentication schemes | ArcGIS for Developers

It looks like there are some additional requirements for using IWA and the ArcGIS Python API:

"If your portal is configured to pick up your Windows credeintials using NTLM or Kerberos, you can omit passing in the username and password. The ArcGIS Python API is able to figure out when the GIS is using Windows authentication and picks the login credentials from the currently running process providing a seamless and secure login experience. Windows authentication only works on the Windows OS and requires pywin32 and kerberos-sspi python packages."

JoeHershman

Christian,

Even in that situation I get the same error:

I have the two packages installed:

PS C:\Program Files\Anaconda3> pip install kerberos-sspi
Requirement already satisfied: kerberos-sspi in c:\program files\anaconda3\lib\site-packages
Requirement already satisfied: pywin32 in c:\program files\anaconda3\lib\site-packages (from kerberos-sspi)

Using

<SPAN class="keyword token">from</SPAN> arcgis<SPAN class="punctuation token">.</SPAN>gis <SPAN class="keyword token">import</SPAN> GIS
target <SPAN class="operator token">=</SPAN> GIS<SPAN class="punctuation token">(</SPAN><SPAN class="string token"><SPAN>"</SPAN><A class="jive-link-external-small" href="https://community.esri.com/external-link.jspa?url=https%3A%2F%2Fportaldev.domain.com%2Fportal" target="_blank">https://portaldev.domain.com/portal</A><SPAN>"</SPAN></SPAN><SPAN class="punctuation token">)</SPAN>‍<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN>

Gives:

The Security configuration is the IWA from help

{ "type": "WINDOWS", "properties": { "userPassword": "OZGpymvHxMecgY67515cng==", "caseSensitive": "false", "userEmailAttribute": "mail", "user": "ram\\portal", "userFullnameAttribute": "cn", "isPasswordEncrypted": "true" } }

Logging into the Portal works as expected. We have the zone trusted at the domain level so nothing needs to be configured on individual machines and single sign on works without issue on the machine I have ArcGIS Python installed

Any other thoughts on what might be happening?

Thanks

-Joe

SupratimBanik

Hi Joe,

Can you try querying your user object after attempting to connect to your GIS:

target.properties.user.username

Does that report your username?

You're getting 'Failed Kerberos authentication' but NTLM authentication may be succeeding as you're not getting a 'Failed to authenticate using NTLM' error.

Thanks,

Rohit

JoeHershman

Why yes that does work. I never though to go any further after I received the error.

Thanks

-Joe

XiaoyiZhang1

Rohit,

Same here. run target.properties.user.username and it returns my username not the one I passed

SupratimBanik

When using IWA, you should not pass in a username and password. Login credentials will be picked up from the running process.

SupratimBanik

I agree this is confusing... we'll take care of it in the next update. Thanks for the suggestion.

XiaoyiZhang1

How can I suppress those messages below for now when using IWA using NTLM?

<class 'pywintypes.error'> Failed Kerberos authentication

JoeHershman

I have not been doing anything since the newest API was released. When trying to connect with IWA (not passing credentials I now get the following and no connection is established. I have no issue connecting to portal through my browser and IWA works as expected.

---------------------------------------------------------------------------

ValueError Traceback <SPAN class="punctuation token">(</SPAN>most recent call last<SPAN class="punctuation token">)</SPAN>
<SPAN class="operator token"><</SPAN>ipython<SPAN class="operator token">-</SPAN>input<SPAN class="number token">-13</SPAN><SPAN class="operator token">-</SPAN><SPAN class="number token">740700131cc8</SPAN><SPAN class="operator token">></SPAN> <SPAN class="keyword token">in</SPAN> <SPAN class="operator token"><</SPAN>module<SPAN class="operator token">></SPAN><SPAN class="punctuation token">(</SPAN><SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">2</SPAN>
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">4</SPAN> portal <SPAN class="operator token">=</SPAN> GIS<SPAN class="punctuation token">(</SPAN><SPAN class="string token"><SPAN>"</SPAN><A class="jive-link-external-small" href="https://community.esri.com/external-link.jspa?url=https%3A%2F%2Fportaldev.ramtech-gis.com%2Fportal" target="_blank">https://portaldev.ramtech-gis.com/portal</A><SPAN>"</SPAN></SPAN><SPAN class="punctuation token">,</SPAN> verify_cert<SPAN class="operator token">=</SPAN><SPAN class="token boolean">False</SPAN><SPAN class="punctuation token">)</SPAN>
C<SPAN class="punctuation token">:</SPAN>\ArcGISPython\Anaconda\lib\site<SPAN class="operator token">-</SPAN>packages\arcgis\gis<SPAN class="punctuation token">.</SPAN>py <SPAN class="keyword token">in</SPAN> __init__<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">,</SPAN> url<SPAN class="punctuation token">,</SPAN> username<SPAN class="punctuation token">,</SPAN> password<SPAN class="punctuation token">,</SPAN> key_file<SPAN class="punctuation token">,</SPAN> cert_file<SPAN class="punctuation token">,</SPAN> verify_cert<SPAN class="punctuation token">,</SPAN> set_active<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">91</SPAN> self<SPAN class="punctuation token">.</SPAN>_datastores_list <SPAN class="operator token">=</SPAN> None
 <SPAN class="number token">92</SPAN> self<SPAN class="punctuation token">.</SPAN>_portal <SPAN class="operator token">=</SPAN> portalpy<SPAN class="punctuation token">.</SPAN>Portal<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">.</SPAN>_url<SPAN class="punctuation token">,</SPAN> self<SPAN class="punctuation token">.</SPAN>_username<SPAN class="punctuation token">,</SPAN> self<SPAN class="punctuation token">.</SPAN>_password<SPAN class="punctuation token">,</SPAN> self<SPAN class="punctuation token">.</SPAN>_key_file<SPAN class="punctuation token">,</SPAN> self<SPAN class="punctuation token">.</SPAN>_cert_file<SPAN class="punctuation token">,</SPAN>
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">93</SPAN> verify_cert<SPAN class="operator token">=</SPAN>self<SPAN class="punctuation token">.</SPAN>_verify_cert<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">94</SPAN> 
 <SPAN class="number token">95</SPAN> <SPAN class="keyword token">if</SPAN> self<SPAN class="punctuation token">.</SPAN>_url<SPAN class="punctuation token">.</SPAN>lower<SPAN class="punctuation token">(</SPAN><SPAN class="punctuation token">)</SPAN> <SPAN class="operator token">==</SPAN> <SPAN class="string token">"pro"</SPAN><SPAN class="punctuation token">:</SPAN>
C<SPAN class="punctuation token">:</SPAN>\ArcGISPython\Anaconda\lib\site<SPAN class="operator token">-</SPAN>packages\arcgis\_impl\portalpy<SPAN class="punctuation token">.</SPAN>py <SPAN class="keyword token">in</SPAN> __init__<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">,</SPAN> url<SPAN class="punctuation token">,</SPAN> username<SPAN class="punctuation token">,</SPAN> password<SPAN class="punctuation token">,</SPAN> key_file<SPAN class="punctuation token">,</SPAN> cert_file<SPAN class="punctuation token">,</SPAN> expiration<SPAN class="punctuation token">,</SPAN> referer<SPAN class="punctuation token">,</SPAN> proxy_host<SPAN class="punctuation token">,</SPAN> proxy_port<SPAN class="punctuation token">,</SPAN> connection<SPAN class="punctuation token">,</SPAN> workdir<SPAN class="punctuation token">,</SPAN> tokenurl<SPAN class="punctuation token">,</SPAN> verify_cert<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">159</SPAN> verify_cert<SPAN class="operator token">=</SPAN>verify_cert<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">160</SPAN> <SPAN class="comment token">#self.get_version(True)</SPAN>
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">161</SPAN> self<SPAN class="punctuation token">.</SPAN>get_properties<SPAN class="punctuation token">(</SPAN><SPAN class="token boolean">True</SPAN><SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">162</SPAN> 
 <SPAN class="number token">163</SPAN>
C<SPAN class="punctuation token">:</SPAN>\ArcGISPython\Anaconda\lib\site<SPAN class="operator token">-</SPAN>packages\arcgis\_impl\portalpy<SPAN class="punctuation token">.</SPAN>py <SPAN class="keyword token">in</SPAN> get_properties<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">,</SPAN> force<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">973</SPAN> <SPAN class="keyword token">if</SPAN> <SPAN class="operator token">not</SPAN> self<SPAN class="punctuation token">.</SPAN>_properties <SPAN class="operator token">or</SPAN> force<SPAN class="punctuation token">:</SPAN>
 <SPAN class="number token">974</SPAN> path <SPAN class="operator token">=</SPAN> <SPAN class="string token">'accounts/self'</SPAN> <SPAN class="keyword token">if</SPAN> self<SPAN class="punctuation token">.</SPAN>_is_pre_162 <SPAN class="keyword token">else</SPAN> <SPAN class="string token">'portals/self'</SPAN>
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">975</SPAN> resp <SPAN class="operator token">=</SPAN> self<SPAN class="punctuation token">.</SPAN>con<SPAN class="punctuation token">.</SPAN>post<SPAN class="punctuation token">(</SPAN>path<SPAN class="punctuation token">,</SPAN> self<SPAN class="punctuation token">.</SPAN>_postdata<SPAN class="punctuation token">(</SPAN><SPAN class="punctuation token">)</SPAN><SPAN class="punctuation token">,</SPAN> ssl<SPAN class="operator token">=</SPAN><SPAN class="token boolean">True</SPAN><SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">976</SPAN> <SPAN class="keyword token">if</SPAN> resp<SPAN class="punctuation token">:</SPAN>
 <SPAN class="number token">977</SPAN> self<SPAN class="punctuation token">.</SPAN>_properties <SPAN class="operator token">=</SPAN> resp
C<SPAN class="punctuation token">:</SPAN>\ArcGISPython\Anaconda\lib\site<SPAN class="operator token">-</SPAN>packages\arcgis\_impl\connection<SPAN class="punctuation token">.</SPAN>py <SPAN class="keyword token">in</SPAN> post<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">,</SPAN> path<SPAN class="punctuation token">,</SPAN> postdata<SPAN class="punctuation token">,</SPAN> files<SPAN class="punctuation token">,</SPAN> ssl<SPAN class="punctuation token">,</SPAN> compress<SPAN class="punctuation token">,</SPAN> is_retry<SPAN class="punctuation token">,</SPAN> use_ordered_dict<SPAN class="punctuation token">,</SPAN> add_token<SPAN class="punctuation token">,</SPAN> verify_cert<SPAN class="punctuation token">,</SPAN> token<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">912</SPAN> headers<SPAN class="punctuation token">.</SPAN>append<SPAN class="punctuation token">(</SPAN><SPAN class="punctuation token">(</SPAN><SPAN class="string token">'Accept-encoding'</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">'gzip'</SPAN><SPAN class="punctuation token">)</SPAN><SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">913</SPAN> 
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">914</SPAN> handlers <SPAN class="operator token">=</SPAN> self<SPAN class="punctuation token">.</SPAN>get_handlers<SPAN class="punctuation token">(</SPAN>verify_cert<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">915</SPAN> opener <SPAN class="operator token">=</SPAN> request<SPAN class="punctuation token">.</SPAN>build_opener<SPAN class="punctuation token">(</SPAN><SPAN class="operator token">*</SPAN>handlers<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">916</SPAN>
C<SPAN class="punctuation token">:</SPAN>\ArcGISPython\Anaconda\lib\site<SPAN class="operator token">-</SPAN>packages\arcgis\_impl\connection<SPAN class="punctuation token">.</SPAN>py <SPAN class="keyword token">in</SPAN> get_handlers<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">,</SPAN> verify_cert<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">810</SPAN> <SPAN class="keyword token">from</SPAN> <SPAN class="punctuation token">.</SPAN>common<SPAN class="punctuation token">.</SPAN>_iwa <SPAN class="keyword token">import</SPAN> NtlmSspiAuthHandler<SPAN class="punctuation token">,</SPAN> KerberosSspiAuthHandler
 <SPAN class="number token">811</SPAN> 
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">812</SPAN> auth_NTLM <SPAN class="operator token">=</SPAN> NtlmSspiAuthHandler<SPAN class="punctuation token">(</SPAN><SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">813</SPAN> auth_krb <SPAN class="operator token">=</SPAN> KerberosSspiAuthHandler<SPAN class="punctuation token">(</SPAN><SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">814</SPAN>
C<SPAN class="punctuation token">:</SPAN>\ArcGISPython\Anaconda\lib\site<SPAN class="operator token">-</SPAN>packages\arcgis\_impl\common\_iwa<SPAN class="punctuation token">.</SPAN>py <SPAN class="keyword token">in</SPAN> __init__<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">53</SPAN> 
 <SPAN class="number token">54</SPAN> <SPAN class="keyword token">def</SPAN> <SPAN class="token function">__init__</SPAN><SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">)</SPAN><SPAN class="punctuation token">:</SPAN>
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">55</SPAN> self<SPAN class="punctuation token">.</SPAN>sspiauth <SPAN class="operator token">=</SPAN> SSPINTLMAuth<SPAN class="punctuation token">(</SPAN><SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">56</SPAN> 
 <SPAN class="number token">57</SPAN> <SPAN class="keyword token">def</SPAN> <SPAN class="token function">http_error_401</SPAN><SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">,</SPAN> req<SPAN class="punctuation token">,</SPAN> fp<SPAN class="punctuation token">,</SPAN> code<SPAN class="punctuation token">,</SPAN> msg<SPAN class="punctuation token">,</SPAN> headers<SPAN class="punctuation token">)</SPAN><SPAN class="punctuation token">:</SPAN>
C<SPAN class="punctuation token">:</SPAN>\ArcGISPython\Anaconda\lib\site<SPAN class="operator token">-</SPAN>packages\arcgis\_impl\common\_iwa<SPAN class="punctuation token">.</SPAN>py <SPAN class="keyword token">in</SPAN> __init__<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">,</SPAN> user<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">17</SPAN> <SPAN class="keyword token">if</SPAN> <SPAN class="operator token">not</SPAN> user<SPAN class="punctuation token">:</SPAN>
 <SPAN class="number token">18</SPAN> user <SPAN class="operator token">=</SPAN> win32api<SPAN class="punctuation token">.</SPAN>GetUserName<SPAN class="punctuation token">(</SPAN><SPAN class="punctuation token">)</SPAN>
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">19</SPAN> self<SPAN class="punctuation token">.</SPAN>sspi_client <SPAN class="operator token">=</SPAN> sspi<SPAN class="punctuation token">.</SPAN>ClientAuth<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"NTLM"</SPAN><SPAN class="punctuation token">,</SPAN>user<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">20</SPAN> 
 <SPAN class="number token">21</SPAN>
C<SPAN class="punctuation token">:</SPAN>\ArcGISPython\Anaconda\lib\site<SPAN class="operator token">-</SPAN>packages\win32\lib\sspi<SPAN class="punctuation token">.</SPAN>py <SPAN class="keyword token">in</SPAN> __init__<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">,</SPAN> pkg_name<SPAN class="punctuation token">,</SPAN> client_name<SPAN class="punctuation token">,</SPAN> auth_info<SPAN class="punctuation token">,</SPAN> targetspn<SPAN class="punctuation token">,</SPAN> scflags<SPAN class="punctuation token">,</SPAN> datarep<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">109</SPAN> client_name<SPAN class="punctuation token">,</SPAN> self<SPAN class="punctuation token">.</SPAN>pkg_info<SPAN class="punctuation token">[</SPAN><SPAN class="string token">'Name'</SPAN><SPAN class="punctuation token">]</SPAN><SPAN class="punctuation token">,</SPAN>
 <SPAN class="number token">110</SPAN> sspicon<SPAN class="punctuation token">.</SPAN>SECPKG_CRED_OUTBOUND<SPAN class="punctuation token">,</SPAN>
<SPAN class="operator token">-</SPAN><SPAN class="operator token">-</SPAN><SPAN class="operator token">></SPAN> <SPAN class="number token">111</SPAN> None<SPAN class="punctuation token">,</SPAN> auth_info<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">112</SPAN> _BaseAuth<SPAN class="punctuation token">.</SPAN>__init__<SPAN class="punctuation token">(</SPAN>self<SPAN class="punctuation token">)</SPAN>
 <SPAN class="number token">113</SPAN>
ValueError<SPAN class="punctuation token">:</SPAN> year <SPAN class="number token">30828</SPAN> <SPAN class="keyword token">is</SPAN> out of range<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN>

simoxu

FYI

Python for Windows Extensions / Bugs / #748 pywin32 issue(s) under Python 3.6.1

Try Python 3.5.4, it works for me.

Únete a la Conversación

Los miembros registrados pueden publicar, seguir actualizaciones y más. ¿Nuevo aquí? Regístrate gratis.

Enlaces Rápidos

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.