Start/Stop Secure Services in 10.6.1

[AmyRoust]

Prior to 10.6.1, I was using the ArcGIS Server Admin Toolkit to stop and start services in bulk. That toolkit has depreciated and does not appear to work in 10.6.1. (It could be that I'm making an error with the parameters, but I don't think I am) Then I found this:

Example: Stop or start all services in a folder—ArcGIS Server Administration (Windows) | ArcGIS Ente... 

The above script assumes that you are using port 6080, but ours are on 6443. I tried to change the parameter in the same script from 6080 to 6443, but that did not work. Again, I'm not ruling out the possibility that I'm entering the wrong variables, but the error message says that the server is forcibly closing the connection to port 6443 when I run it.

In scouring the forums, I've seen comments that suggest that A) you cannot start/stop services using Python if said services are secured (https), and B) the Esri is intentionally not maintaining or developing tools to allow you to batch start/stop services anymore because they want you to do it through Server Manager/Portal/ArcCatalog. I know you can't start/stop services in Pro yet, but that it might be coming in a future version.

Can anyone help me fill in the gaps? My ultimate need is to be able to stop all web services at once and then restart them in bulk. I'm using Enterprise 10.6.1, including Portal. I published all of my services to Server using ArcMap 10.6.1.

[JonathanQuinn]

Hm, openURL isn't return JSON or a dictionary, but a string or array of some sort. It's probably not a good idea for the token request to assume the response will have the token in it, so in my original example, line 46 should be something like:

resp = openURL(tokenURL,params)
if "token" in resp:
  return resp['token']
else:
  raise Exception("Can't get token: {}".format(resp))
‍‍‍‍‍‍‍‍‍‍‍‍

If you check whether the response as the token property in it, then you can get the token from the response. Otherwise, the script needs to let you know there was an issue with the token request.

[GavinMcDade]

Ok, thanks - I'll give this a try. One question, though: I'm assuming that the return resp['token'] line will simply pass the value just the same as the original return token (even though it's setting/using a different variable name)? In other words, the token = createToken(baseURL,username,password) line simply receives the returned value from the function regardless of what it's called? 

Gavin

[JonathanQuinn]

Right, they're functionally the same. You're getting a dictionary back, ({"token":XXXXX","expires":"YYYY"}), so you just need to extract the "token" variable, however you want to do that.

[KDCGIS]

Looking into this I have the same problem as Amy Roust‌ has.  I am looking to bulk stop my services to free up my webmap SDE, or I can just stop the AGS windows service or as Amy mentions kick people out of the SDE, but I'd like the ability to shut down a folder's worth of services or all services in AGS via python as I feel it's the more elegant way to do it (could be wrong!).  We have a federated server/portal and are running on https for the whole setup.  Trying a http URL for the generateToken request site manually results in a TLS error message, whereas trying with https gets me there.

After discussion with my network/server IT admin he is not keen to disable certificate verification and we both agree the solution should not involve that.  I see above that you have mentioned configuring to get python to trust your certificates and am not presently sure if I need to, i.e. if python trusts our certificate(s).  It looks pretty involved as SSL always does.  Is it possible to post example start/stop code with certificate verification? It looks like Michael Volz‌ was working on that.

My services are all published via ArcGIS Pro 2.3 at present, but we are still running on python 2.7 and have not yet ported to python 3. 

[MichaelVolz]

You do not need to disable certificate verification as you can comment out the line of code that ignores the certificate and it will run if you have a legit certificate in place.

Just comment out line 27

sslContext = ssl._create_unverified_context()

The code was reformatted at my org for more granular stopping and starting of individual services (mostly geocode services that need to be stopped to rebuild address locators), but I think the original code provided by Jonathan Quinn should allow you to stop all services.  I also do not have a federated server/portal so I'm not sure if that would impact whether the above code from Jonathan would work.

[JonathanQuinn]

When you're working with certificates and Python, I think there are three options:

1) Use a certificate from a trusted root certificate authority, (Digicert, Verisign, etc), that Python trusts by default

2) Configure Python to trust your certificates

3) Disable certificate verification

If you don't want to disable certificate verification, then you need to make sure you're following either 1 or 2, and then as Michael Volz‌ suggested, comment line 20 and 27 but also be sure to remove context=sslContext from lines 22 and 29.

[KDCGIS]

Thanks guys, I pretty much arrived at the conclusion after reading all of this that #1 or #2 from your list Jonathan are the ways to go.  #3 you have already mentioned is risky.  So it seems configuring the certificate side of it is necessary, it adds a chunk of work to the scripting process but should just be a one-time job.  I'll look into #1 or #2 with my IT admin.

[MichaelVolz]

Jonathan:

Would this script need some major changes when run with python 3.x that is bundled with Pro as opposed to the current script that is run with python 2.7 that is bundled with ArcMap?

It appears that modules have been renamed and after renaming the modules, it seems like functions from the renamed modules have also been renamed but the documentation I have found on the renamed modules has not specified the function names that can be called.

[JonathanQuinn]

Yes, the urllib libraries have changed between versions. You can write your script to support both:

if sys.version_info.major >=3:
    import urllib.request, urllib.error, urllib.parse
    urlEncode = urllib.parse.urlencode
    urlParse = urllib.parse.urlparse
    urlRequest = urllib.request.Request
    urlOpen = urllib.request.urlopen
    httpError = urllib.error.HTTPError
    urlError = urllib.error.URLError
else:
    import urllib, urllib2, shlex, urlparse
    urlEncode = urllib.urlencode
    urlRequest = urllib2.Request
    urlOpen = urllib2.urlopen
    httpError = urllib2.HTTPError
    urlError = urllib2.URLError
    urlParse = urlparse.urlparse‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Then, replace all occurrences of each function with the respective variables. You'd then be able to use the script with Python 3.x or 2.x.

[jorisfrenkel]

Nice to know. I just rewrote my own stop/start scripts from Python 2 to Python 3 and then bumped into this thread 😄