nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Open Flex site to public

ChrisOwen

I spke too soon, I was not able to access the flex site outside of the network. I will add the cross domain code in the next thread...

My flex site is ready for public consumption.
Does anyone have guidance or hints on how to make the flex site consumable from a public facing IIS server?
I have the bin-release folder ready to go, I just don't know what is needed from the outward facing IIS server. Do I need to create a crossdomain.xml?
I can provide more info if needed...
Thanks!
Chris

Vind meer berichten getagd met

Accepted answers

All comments

ChrisOwen

Well, the site is finally working on line. Thanks for all that helped us get there, especially Robert. Patience is a virtue.

Anyway, I promised to sum my findings; hopefully others won't have to go through the various trial and error scenarios I did.

The following are what I think are the key components:

1. ESRI TECHNICAL ARTICLE 35948
Follow the ESRI technical article 35948 to set up ArcGIS server:
http://resources.arcgis.com/content/kbase?fa=articleShow&d=35948
-this will provide the guidance to configure the ArcGIS server and Apache

2. HTTPD.CONF file
A. Use the internal server IP in the httpd.conf file
B. Add both to the httpd.conf (these are from the ESI tech article):
      -ProxyPass and ProxyPassReverse
      -ProxyPassMatch and ProxyPassReverse
C. Add this line in the httpd.conf, not referenced in the ESRI tech article:
      -ProxyPass / http://internal server IP/

3. CROSSDOMAIN:
Place the crossdomain.xml in the wwroot folder of the internal server (the ArcGGIS Server) and in the external server (reverse proxy) program files -> Apache folder -> htdocs folder.

4. FLEX XML FILESThe config.xml file (and any other xml file referencing rest end points) must use the qualified domain name, plus port to access the rest end points. For example: http://qualified domain name:80/ArcGIS/rest/services/etc.....

5. IT SUPPORT
Help your IT support fully understand the flex architecture. For example, the flex data will not be visible inside the firewall, because the rest points are being routed by the reverse proxy IP - back to the internal server. This can only be tested from a browser outside the firewall. Alos, ensure Apache is installed correctly, this was one of our first road blocks. Test using ESRI's tech article example.

I hope this helps anyone trying to deploy a flex site on the internet. Any questions, don't hesitate to email me. I am not an expert, but I may know the proper steps to problem solve.

RobertScheitlin__GISP

Chris,

It is not normal to use IP addresses you should be using the fully qualified machine name in the config.xml like:

http://gis.calhouncounty.org/ArcGIS/rest/services/Highway/MapServer.

The host table on the reverse proxy server in the DMZ may need to have the internal GIS web servers name and IP address added to it i.e.

found here
C:\Windows\System32\drivers\etc

102.54.94.97     rhino.acme.com

From outside the firewall http://gisrp.ci.walla-walla.wa.us needs to resolve to the reverse proxy servers IP.

ChrisOwen

OK, I am going off of the httpd.conf subject for a moment...
Back to the config.xml - although this may have been answered already - please forgive me if it has, but I need to verify.

Does the rest end point need to have the proxy server in is http path?

http://proxy server IP/ArcGIS/rest/services/GISBaseMap_web_city/MapServer

If yes, should it be the INTERNAL or EXTERNAL IP address of the proxy server?

RobertScheitlin__GISP

Chris,

OK. it is actually never getting past the first entry then.

ProxyRequests Off

#ProxyPass / http://Internal IP/crossdomain.xml

ProxyPass / http://Internal IP/PublicWEBGIS/
ProxyPassReverse / http://Internal IP/PublicWEBGIS/

ProxyPass /ArcGIS/services http://Internal IP/ArcGIS/services

ProxyPassReverse /ArcGIS/services http://Internal IP/ArcGIS/services


ProxyPass /ArcGIS/rest http://Internal IP/ArcGIS/rest

ProxyPassReverse /ArcGIS/rest http://Internal IP/ArcGIS/rest


ProxyPass /ArcGIS/sdk/rest http://Internal IP/ArcGIS/sdk/rest

ProxyPassReverse /ArcGIS/sdk/rest http://Internal IP/ArcGIS/sdk/rest


ProxyPass /aspnet_client/ http://Internal IP/aspnet_client/

ProxyPassReverse /aspnet_client/ http://Internal IP/aspnet_client/


ProxyPass /ArcGIS/tokens http://Internal IP/ArcGIS/tokens

ProxyPassReverse /ArcGIS/tokens http://Internal IP/ArcGIS/tokens


ProxyPass /proxyoutput/ http://Internal IP/proxyoutput/

ProxyPassReverse /proxyoutput/ http://Internal IP/proxyoutput/


ProxyPass /proxyjobs/ http://Internal IP/proxyjobs/

ProxyPassReverse /proxyjobs/ http://Internal IP/proxyjobs/


ProxyPass /proxycache/ http://Internal IP/proxycache/

ProxyPassReverse /proxycache/ http://Internal IP/proxycache/


ProxyPassMatch (?i)^/ArcGIS/services(.*)$ http://Internal IP/arcgis/services$1

ProxyPassReverse /arcgis/services http://Internal IP/arcgis/services



ProxyPassMatch (?i)^/ArcGIS/rest(.*)$ http://Internal IP/arcgis/rest$1

ProxyPassReverse /arcgis/rest http://Internal IP/arcgis/rest



ProxyPassMatch (?i)^/ArcGIS/SDK/REST(.*)$ http://Internal IP/arcgis/sdk/rest$1

ProxyPassReverse /arcgis/sdk/rest http://Internal IP/arcgis/sdk/rest



ProxyPassMatch (?i)^/aspnet_client/(.*)$ http://Internal IP/aspnet_client/$1

ProxyPassReverse /aspnet_client/ http://Internal IP/aspnet_client/



ProxyPassMatch (?i)^/ArcGIS/tokens(.*)$ http://Internal IP/arcgis/tokens$1

ProxyPassReverse /arcgis/tokens http://Internal IP/arcgis/tokens



ProxyPassMatch (?i)^/proxyoutput/(.*)$ http://Internal IP/proxyoutput/$1

ProxyPassReverse /proxyoutput/ http://Internal IP/proxyoutput/



ProxyPassMatch (?i)^/proxycache/(.*)$ http://Internal IP/proxycache/$1

ProxyPassReverse /proxycache/ http://Internal IP/proxycache/



ProxyPassMatch (?i)^/proxyjobs/(.*)$ http://Internal IP/proxyjobs/$1

ProxyPassReverse /proxyjobs/ http://Internal IP/proxyjobs/

ProxyPassMatch (?i)^/ArcGIS/Manager(.*)$ http://Internal IP/arcgis/manager$1

ProxyPassReverse /arcgis/manager http://Internal IP/arcgis/manager

Because every url begins with forward slash...

ChrisOwen

Robert,

Below are the complete rules for the httpd.conf file. I was trying to exaplain that my rule to open and run the flex application is not working. By adding the rule (the one I posted in the last thread) to the httpd.conf file, I am no longer able to access my rest-end points. My goal here is to identify what I need to do to acess my flex application - it opens, but data is not displayed.

ProxyRequests Off

#ProxyPass / http://Internal IP/crossdomain.xml

ProxyPass / http://Internal IP/PublicWEBGIS/
ProxyPassReverse / http://Internal IP/PublicWEBGIS/

ProxyPass /ArcGIS/services http://Internal IP/ArcGIS/services

ProxyPassReverse /ArcGIS/services http://Internal IP/ArcGIS/services


ProxyPass /ArcGIS/rest http://Internal IP/ArcGIS/rest

ProxyPassReverse /ArcGIS/rest http://Internal IP/ArcGIS/rest


ProxyPass /ArcGIS/sdk/rest http://Internal IP/ArcGIS/sdk/rest

ProxyPassReverse /ArcGIS/sdk/rest http://Internal IP/ArcGIS/sdk/rest


ProxyPass /aspnet_client/ http://Internal IP/aspnet_client/

ProxyPassReverse /aspnet_client/ http://Internal IP/aspnet_client/


ProxyPass /ArcGIS/tokens http://Internal IP/ArcGIS/tokens

ProxyPassReverse /ArcGIS/tokens http://Internal IP/ArcGIS/tokens


ProxyPass /proxyoutput/ http://Internal IP/proxyoutput/

ProxyPassReverse /proxyoutput/ http://Internal IP/proxyoutput/


ProxyPass /proxyjobs/ http://Internal IP/proxyjobs/

ProxyPassReverse /proxyjobs/ http://Internal IP/proxyjobs/


ProxyPass /proxycache/ http://Internal IP/proxycache/

ProxyPassReverse /proxycache/ http://Internal IP/proxycache/


ProxyPassMatch (?i)^/ArcGIS/services(.*)$ http://Internal IP/arcgis/services$1

ProxyPassReverse /arcgis/services http://Internal IP/arcgis/services



ProxyPassMatch (?i)^/ArcGIS/rest(.*)$ http://Internal IP/arcgis/rest$1

ProxyPassReverse /arcgis/rest http://Internal IP/arcgis/rest



ProxyPassMatch (?i)^/ArcGIS/SDK/REST(.*)$ http://Internal IP/arcgis/sdk/rest$1

ProxyPassReverse /arcgis/sdk/rest http://Internal IP/arcgis/sdk/rest



ProxyPassMatch (?i)^/aspnet_client/(.*)$ http://Internal IP/aspnet_client/$1

ProxyPassReverse /aspnet_client/ http://Internal IP/aspnet_client/



ProxyPassMatch (?i)^/ArcGIS/tokens(.*)$ http://Internal IP/arcgis/tokens$1

ProxyPassReverse /arcgis/tokens http://Internal IP/arcgis/tokens



ProxyPassMatch (?i)^/proxyoutput/(.*)$ http://Internal IP/proxyoutput/$1

ProxyPassReverse /proxyoutput/ http://Internal IP/proxyoutput/



ProxyPassMatch (?i)^/proxycache/(.*)$ http://Internal IP/proxycache/$1

ProxyPassReverse /proxycache/ http://Internal IP/proxycache/



ProxyPassMatch (?i)^/proxyjobs/(.*)$ http://Internal IP/proxyjobs/$1

ProxyPassReverse /proxyjobs/ http://Internal IP/proxyjobs/

ProxyPassMatch (?i)^/ArcGIS/Manager(.*)$ http://Internal IP/arcgis/manager$1

ProxyPassReverse /arcgis/manager http://Internal IP/arcgis/manager

RobertScheitlin__GISP

Chris,

You may be trying to over simplify this by using:

ProxyPass / http://Internal IP/PublicWEBGIS/
ProxyPassReverse / http://Internal IP/PublicWEBGIS/

Basically you are saying any web traffic period will be redirected to http://Internal IP/PublicWEBGIS/

I would specify each specific url as I have done in my examples of the httpd.conf entries

ChrisOwen

Robert,

I appreciate you hanging in there with me.

Our testing is from the reverse proxy machine only - we are trying to open the flex application directly from the reverse proxy machine with no success. This is our attempt to eliminate the other external firewall.

My httpd.config rules look identical to yours, except we do not have a rule to get to the flex viewer. Our current rule looks like this:

ProxyPass / http://Internal IP/PublicWEBGIS/
ProxyPassReverse / http://Internal IP/PublicWEBGIS/

The syntax is incorrect. I know this because if I un-comment it out, I can't get to the the rest-end pooints from the reverse proxy server. I was hoping to get the correct syntax to allow access to the flex viewer application.

Also, I have forwarded your comments to the network admin...waiting to hear what he has to say.

RobertScheitlin__GISP

Chris,

   One of the biggest problems I see is that http://gisrp.ci.walla-walla.wa.us is not resolving on the DNS lookup. You are attempting a setup that is pretty different from mine, the introduction of another firewall is possibly a big issue. So maybe I can explain my setup in detail and share that with your network admin.

1. Reverse proxy server (old windows 2000 server with Apache web server setup for reverse proxy). This server is in the Hardware Firewalls DMZ. All traffic to http://gis.calhouncounty.org is directed to this server. This server is allowed to communicate through one non-standard port (not port 80) through the firewall to my internal GIS servers.

2. Main GIS Server (SDE, SQL Server).

3. GISServ2 (IIS, ArcGIS Server) Server 2003 R2 Standard 64 Bit
    IIS is using a non-standard port like 12345

4. gisbeta (IIS, ArcGIS Server) Server 2008 R2 Standard 64 Bit
    IIS is using a non-standard port like 12345

So in my main config.xml for Flex Viewer I use
http://gis.calhouncounty.org/ArcGIS/rest/services/Highway/MapServer
which get directed to http://gisbeta:12345/ArcGIS/rest/services/Highway/MapServer
and
http://gis.calhouncounty.org/ArcGIS2/rest/services/ParcelViewer/MapServer
which get directed to http://GISServ2:12345/ArcGIS2/rest/services/ParcelViewer/MapServer

And the main flex viewer app http://gis.calhouncounty.org/flexviewer2.0/
which gets directed to http://gisbeta:12345/FlexViewer2.1/

ChrisOwen

Would anyone be willing to share a working httpd.config file that we could use to compare against ours, which does not launch the flex application?

my email address is cowen@ci.walla-walla.wa.us

ChrisOwen

Robert,

We have another layer of firewall, which is the 64.35.142.197:8000 address. Then we have the reverese proxy server, then the internal application server.

From the reverse proxy server, I can get to all rest end points. I tried to open the flex application from the reverse proxy server, and no data is visible. The reverse proxy httpd.conf uses IP address and the config.xml uses dns name of the proxy server - I thought this was the correct way.

Sorry, I thought I was close, but it looks like I need to start working with my Network Admin again.

EDIT: I am going to ask the Network Admin to place the crossdomain file on the external firewall server. That way, the cross domain will located on the external firewall. the proxy server, and the internal application server...

My Network Admin thinks it is either a crossdomain issue or the .swf needs to be compiled with the internal servers IP address. I haven't read about anyone having to make changes to the .swf file...

RobertScheitlin__GISP

Chris,

You still have some significant issue there.

1. I should be able to use : http://gisrp.ci.walla-walla.wa.us/ArcGIS/rest/services/GISBaseMap_wuts/MapServer and get to that service end point.

2. You can not mix machine names and IP addresses. because your main config xml is using addresses like above your reverse proxy has to handle those addresses.

3. Shouldn't I be able to type in http://gisrp.ci.walla-walla.wa.us/PublicWEBGIS/index.html?

ChrisOwen

I am trying to open the flex appplication using the following url:
http://64.35.142.197:8000/index.html

Whn I run fiddler, it give me an error and points to the crossdomain.xml file on the external server - I assume that means either:
A.) the crossdomain is not configured correctly
B.) my httpd.config is not configured properly.

What I was trying to explain is that I had the httpd.config configured to access the rest services, I just couldn't access the flex application (index.html). I then added this line of code to the httpd.conf file and at least I could see the site, widgets, etc, but no data. Without adding that line to the httpd.config, all that was visible was "It Works!".

ProxyPass / http://internal server IP/PublicWEBGIS/

I have the exact crossdomain.xml file on the wwroot of the internal server and on the external server (in the htdocs folder).

RobertScheitlin__GISP

Chris,

What do you mean by getting stuck? As I have shown you in my examples you need to proxy pass all the calls to the rest services directory, manager, etc.

ChrisOwen

Communication is workiing form the proxy server and the internal server, the only issue is:

How do I edit the httpd.config file to publish the actual flex site?

I know the proxy is working because I receive a "It works!" from the site url.

I then added the line to the httpd.config:

ProxyPass / http://internal server IP/PublicWEBGIS/

I am again, only able to view the widgets, not the data. Can anyone shed some light on this - it has to be a simple line of code inserte into the httpd.conf file.

EDIT: When I chck the site against Fiddler, it is getting stuck at the crossdomain.xml file on the external server (proxy server).

Here are the crossdomain rules:

#<?xml version="1.0" ?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>

<allow-access-from domain="*" />
<site-control permitted-cross-domain-policies="all" />
<allow-http-request-headers-from domain="*" headers="*" />

</cross-domain-policy>#

ChrisOwen

Thank you Robert.

It turns out Apache was not installed correctly/became corrupted. Also, our httpd.conf had some duplicate entries, thus making the redirection not work correctly. I updated the flex config.html with the fully qualified dns, and the rest points are now being re-directed correctly from the proxy server.

We are very close.

Thnaks for keeping in touch and providing key information!

I will follow once the site is up and operational, unless we hit another snag...

RobertScheitlin__GISP

Chris,

Now that I am back in the office here is a piece of my httpd.conf file

ProxyPass /ArcGIS/Services http://gisserver:12345/ArcGIS/Services
ProxyPassReverse /ArcGIS/Services http://gisserver:12345/ArcGIS/Services

ProxyPass /arcgis/services http://gisserver:12345/ArcGIS/Services
ProxyPassReverse /arcgis/services http://gisserver:12345/ArcGIS/Services

ProxyPass /ArcGIS/services http://gisserver:12345/ArcGIS/Services
ProxyPassReverse /ArcGIS/services http://gisserver:12345/ArcGIS/Services

ProxyPass /proxyoutput/ http://gisserver:12345/proxyoutput/
ProxyPassReverse /proxyoutput/ http://gisserver:12345/proxyoutput/

ProxyPass /proxyindex/ http://gisserver:12345/proxyindex/
ProxyPassReverse /proxyindex/ http://gisserver:12345/proxyindex/

ProxyPass /proxycache/ http://gisserver:12345/proxycache/
ProxyPassReverse /proxycache/ http://gisserver:12345/proxycache/

ProxyPass /proxyjobs/ http://gisserver:12345/proxyjobs/
ProxyPassReverse /proxyjobs/ http://gisserver:12345/proxyjobs/

and then in my main config.xml I use

url="http://gis.calhouncounty.org/arcgis/rest/services/MyService/MapServer"

ChrisOwen

Yes, I am still working on this - I have ESRI and my Network Admin helping, but still no resolution.

Two questions regarding the reverse proxy:

1. Which IP address should the httpd.conf rules point to? The internal or external IP address of the application server?

2. Which IP address does the rest end-point need to point to (from config.xml)? The internal or external IP address of the reverese proxy server?

Thanks!

ChrisOwen

ESRI confirmed that the virtual machine with Windows Server 2003 OS is OK for the reverse proxy.

When I run Fiddler, the roadblock is when the site tries to access the crossdomain on the application server. Doe sanyone know which file tries to access the crossdomain.xls? I beleive this to be the road block since, the crossdomain is on the application server, and public web traffic is being blicked by our firewall.

Chris

RobertScheitlin__GISP

Chris,

Do you guys have that server with the virtual server in the DMZ? I am not really sure how to do this with a virtual server. Do you have some old PC you can use and test Apache on it and place that in the DMZ?

ChrisOwen

My Network Admin and myself discussed what is occurring and he is not convinced it is the DNS.
His testing theory is since he is not able to view the flex sight from the reverse proxy server, something else is going on...we then began to discuss the reverse proxy server.

We setup the proxy server as a Windows 2003 Server virtual machine and began to question if this was the reason for the DNS block. I have three questions regrading the reverse proxy setup...

1. Can the reverse proxy run from a virtual machine?

2. Can the reverse proxy run using Windows Server 2003 OS (or what OS is best practice)?

3. Will we get anywhere if the reverse proxy cannot be viewed from the virtual machine (is this a good test)?

Robert, you wrote you used an old old machine as your reverse proxy - can you provide the OS used?

Thanks, we couldn't get this far without your feedback!

ChrisOwen

Thanks for that security info, I will be sure to discuss this with the IT folks.
I am getting close, but still have the crossdomain.xls error popping up. From the Fiddler analyzer:

No Proxy-Authorization header is present.

No authorization header is present.

I have the crossdomain.xls file on the interneal server and the reverse proxy server, per Robert's instructions.

EDIT: Per ESRI and the Fiddler report - "reconfigure the DNS to have a record for 'gis.ci.walla-walla.wa.us' or just use the IP address of the host machine instead of the machine name."

I will be working with the Network Admin on this and will follow up with the results. Any other insight is always appreciated too.

RobertScheitlin__GISP

Chris,

Are you using the standard port 80 on the IIS Server inside the firewall? Is that port open on the fire wall between the Apache Reverse proxy server and the internal web server? On major thing to not the big purpose of the reverse Proxy server is security so if you use the standard port 80 http port than there is not a maximum benefit to your reverse proxy configuration. Optimally you would establish IIS on a non standard port on the internal server and then if a hacker hacked into the server in the DMZ they would have to know which port is open between this server and the internal IIS Server. So my httpConfig file on the Apache server it looks something like:

ProxyPass /ArcGIS/services http://gisserver:12345/ArcGIS/services

ProxyPassReverse /ArcGIS/services http://gisserver:12345/ArcGIS/services

I have to go off memory here because I am at the esri Dev Summit and can not check my Reverse Proxy Server this week.

ChrisOwen

Still nothing...

Here are some proxy requests from the httpd.conf...do I need to put in th efully qualified DNS instead of just server name:

ProxyRequests On

proxypass / http://GIS/PublicWEBGIS/


ProxyPass /ArcGIS/services http://GIS/ArcGIS/services

ProxyPassReverse /ArcGIS/services http://GIS/ArcGIS/services

JasonHansel

If you are running server 2008, you should be bale to configure IIS 7.0 to handle the reverse proxy.

RobertScheitlin__GISP

Chris,

Put it in the htpdocs folder on the Apache server.

ChrisOwen

Robert,
So we are working on a reverse proxy (with Apache) for security. I still have nopt been able to access the flex web site from the public side..I installed Fiddler and the error still points to the domain not being accessible.

I have read that the the crossdomain.xls needs to also be installed on the proxy server. Is this the case? We do not have IIS installed on the proxy server, therefore no wwwroot folder to place the crossdomain.xml, but if this is a requirement, it will be one step closer to making it work.

Can you confirm this requirement?

Thanks,
Chris

ChrisOwen

Robert - this is perfect, a great start. I'll follow up, hopefully at the next level.

RobertScheitlin__GISP

Chris,

I just use an OLD OLD server that we were going to get rid of and have that in the DMZ with Apache on it for the reverse Proxy server. Apache is one of the ones esri recommended in a white paper I read on reverse proxy configuration for ArcGIS Server.

Links:

http://resources.arcgis.com/content/kbase?fa=articleShow&d=32634
http://webhelp.esri.com/arcgisserver/9.3/dotnet/index.htm#firewalls_and_server.htm

ChrisOwen

So, it appears the current web server does not have a reverse proxy software/service running and is the reason the rest directories/sites are not able to display - at least that is what we are concluding.

Our approach is to virtualize the existing web server (as not to disrupt the current IIS services) and install a reverse proxy whihc allows http traffic into our network. With that said, does anyone have suggestions for a simple, light-weight reverse proxy? We are running a Windows 2008 server.

If anyone has reverse proxy suggestions and some quick reasoning, this would be a tremendous help.

Thanks!
Chris

ChrisOwen

I'll have them look into this and update the post with the findings.

Doe mee aan het gesprek

Aangemelde leden kunnen berichten plaatsen, updates volgen en meer. Nieuw hier? Registreer een gratis account.

Snelle Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.