Printing Limited Usage Layers With Our Own Print Service

4800
11
Jump to solution
01-22-2016 01:51 PM
DavidBuehler
Occasional Contributor III

I am using AGO and web app builder developer 1.3 edition to create what will be an internal application.  I am using the "Limited Usage" for each layer as the services are secured, but the application is going behind our firewall.  I still need to print.  When I use the "Limited Usage" layers and try to print via our own print service it throws an error.  When I check the arcgis server logs I get a 403 error. Printing works if I remove the "Limited Usage".  It would be great to do that, but the services need to be used only in that application if they are going to be public.  Suggestions? Thoughts?

0 Kudos
1 Solution

Accepted Solutions
RebeccaStrauch__GISP
MVP Emeritus

I'm using the "older" version of the proxy, not the current one on github.  What I have in my proxy.config is

<?xml version="1.0" encoding="utf-8" ?>
<!-- Proxy config is used to set the ArcGIS Server services that the proxy will forward to.
        mustMatch: true to only proxy to sites listed, false to proxy to any site

    For Printing on a "remote" iis web machine that uses secure services on the AGS machine
        a blank Proxy folder/application needs to be located and references on the remote iis machine.
        The proxy folder/application for the secure services with required tokens should be located
        on the ArcGIS Server web adaptor IIS machine.
        mustMatch = "false"        OK, since the rest of the file is basicallyblank anyway
-->
<ProxyConfig mustMatch="false">
  <serverUrls>
    <!--  PRODUCTION  mapping -->
        <!--  nothing needed here for prining  -->
  </serverUrls>
</ProxyConfig>

( the notes are added by me) and I actually have it in my IIS   wwwroot folder in a folder I call "printProxy" for convenience.  We are typically using it with JavaScript apps, and our custom print gp service, but we have it working with are ArcGIS Online printing too (the custom GP printing).  For the JS apps, I point to this proxy for the printing.

I attached a copy of the proxy I'm using...not sure why I have a blank App_Data folder in this directory but I left it.  It was a while ago that I set this up and didn't want to mess with it.  This might not work for you but it might give you or others and different idea for a solution.

View solution in original post

11 Replies
BillFox
MVP Frequent Contributor

Hello David,

I have similar issue with the ArcGIS Online Market Place item for the nearmap hosted aerial imagery.

Is this your setup?

BUG-000090817:

Printing ArcGIS.com Marketplace Services from the Portal for ArcGIS map viewer using a print service from a federated ArcGIS for Server installation fails.

-Bill

0 Kudos
DavidBuehler
Occasional Contributor III

Hi Bill,

The print error on the widget is the same. On the ArcGIS Server side (our own) it cannot access the secured services that are secured on our ArcServers. It states it does not have permissions to get to the service.PrintIssue2.pngPrintIssue2.png

Suggestions?

0 Kudos
BillFox
MVP Frequent Contributor

I'm seeing these errors again after upgrading enterprise (Federated Server & Portal) from 10.50. to 10.7.0 and the TLS 1.2 adjustments.

0 Kudos
RebeccaStrauch__GISP
MVP Emeritus

Just to throw this out there, I know for me to be able to print secure services, especially if not on the same server as my ArcGIS Server, I had to have a proxy set up (on the web adaptor machine) just for printing.  It's basically a blank (i.e. the default) proxy file.   (sorry, I can't find my notes right now).

0 Kudos
DavidBuehler
Occasional Contributor III

Rebecca,

I am familiar with the concept of a proxy file.  What goes in the proxy file? Where does it go within the web adaptor machine?

0 Kudos
RebeccaStrauch__GISP
MVP Emeritus

I'm using the "older" version of the proxy, not the current one on github.  What I have in my proxy.config is

<?xml version="1.0" encoding="utf-8" ?>
<!-- Proxy config is used to set the ArcGIS Server services that the proxy will forward to.
        mustMatch: true to only proxy to sites listed, false to proxy to any site

    For Printing on a "remote" iis web machine that uses secure services on the AGS machine
        a blank Proxy folder/application needs to be located and references on the remote iis machine.
        The proxy folder/application for the secure services with required tokens should be located
        on the ArcGIS Server web adaptor IIS machine.
        mustMatch = "false"        OK, since the rest of the file is basicallyblank anyway
-->
<ProxyConfig mustMatch="false">
  <serverUrls>
    <!--  PRODUCTION  mapping -->
        <!--  nothing needed here for prining  -->
  </serverUrls>
</ProxyConfig>

( the notes are added by me) and I actually have it in my IIS   wwwroot folder in a folder I call "printProxy" for convenience.  We are typically using it with JavaScript apps, and our custom print gp service, but we have it working with are ArcGIS Online printing too (the custom GP printing).  For the JS apps, I point to this proxy for the printing.

I attached a copy of the proxy I'm using...not sure why I have a blank App_Data folder in this directory but I left it.  It was a while ago that I set this up and didn't want to mess with it.  This might not work for you but it might give you or others and different idea for a solution.

GertConradie
New Contributor III

Hi Rebecca, I have the same problem:

  • An AGOL layer that has limited access (to certain referers) is used by an AGOL web map.
  • I use that AGOL web map in a Web App Builder (developer version) - no problem here because the AGOL account url that host the web as well as the loclhost and planned host server is listed as referers.
  • The WAB app use the print widget that use a print service url (i.e. ~/GPServer/Export%20Web%20Map%20Task)  - here is the problem... I see the exact same errors in the ArcGIS server logs.

What I tried:

  • Followed the proxy route (the latest version that one can get from GitHub)
  • Configure a server item rule  - that with the 'tokenreferer' setting add a referer to the request to the AGOL layer that has limited useage.
  • Add a proxy rule in the config.json file for the WAB app so that the proxy is used for that layer.

This work as before and by playing with the limited useage refrere list and the proxy server configuration can make my web app builder app work (or not if I want to proof that the settings is being used)

But the problem is still that the request parameteres that is supplied print service ignored any of these proxy rulel configurations. The results is that in the ArcGIS server logs i can still see that the print service try to access the AGOL layer directly - not via the proxy (and not adding a referer as one would expected)

How would one allow the print service to access the AGOL layer? - I might not understand your "For the JS apps, I point to this proxy for the printing" statement?

0 Kudos
GertConradie
New Contributor III


Hallo David / Rebecca

Apologies for coming back on this. I see the answer is marked as correct and I have a fair understanding about configuring proxy rules on the WAB side for certain services (e.g. my custom print service)

Unfortunately I still have the exact same error as per David's screenshots. David, if you were able to resolve this with the use of the 'empty' proxy - where did you configure the proxy rule so that the custom print services that accessing the AGOL service (with limited usage) from the ArcGIS server use a proxy?

I was also upgrading 10 10.4.1 as well to see if that was my problem. ESRI had a bug fix - BUG-000083610 - "Printing an external secure service with limit usage referrers fails in an ArcGIS Online web application." that was resolved in 10.4 - http://downloads.esri.com/support/downloads/other_/104-IssuesAddressedList.pdf

The culprit: (It print if I remove the limited usage)

https://utility.arcgis.com/usrsvcs/servers/e97e0048d61d4e648c3d326d7db0831f/rest/services/ITM/basema...

0 Kudos
GertConradie
New Contributor III

I got a feedback via a support call to ESRI:

"This bug that was originally described as being resolved has become apparent again and has been logged as a new bug #BUG-000096914   [Enhancement] Printing an external secure service with a limit usage on referrer URLs fails in the ArcGIS Online map viewer or application.

This is currently been worked on by the development team in Esri and I will update you as soon as we have a resolution. There was a hotfix deployed recently for users who had 10.3.1 but the fix malfunctioned and was not successful."