nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Open Flex site to public

ChrisOwen

I spke too soon, I was not able to access the flex site outside of the network. I will add the cross domain code in the next thread...

My flex site is ready for public consumption.
Does anyone have guidance or hints on how to make the flex site consumable from a public facing IIS server?
I have the bin-release folder ready to go, I just don't know what is needed from the outward facing IIS server. Do I need to create a crossdomain.xml?
I can provide more info if needed...
Thanks!
Chris

Vind meer berichten getagd met

Accepted answers

All comments

ChrisOwen

Here is the code I used for the cross domain.xml

<?xml version="1.0" ?> 
 <cross-domain-policy>
  <allow-access-from domain="*" /> 
  <site-control permitted-cross-domain-policies="all" /> 
  <allow-http-request-headers-from domain="*" headers="*" /> 
 </cross-domain-policy>

Do I have to explicitly define the domain?

Thanks,
Chris

JonFisher

Your crossdomain.xml file looks right as is, you should just need to put it in your webroot on the server.

That being said, we are having a trouble with the data extract widget where it's trying to access the crossdomain.xml file on our internal domain name rather than external DNS name, and we have not yet figured out how to fix that (see http://forums.arcgis.com/threads/23045-DataExtractWidget for details)

EDIT: also, make sure that the file name is crossdomain.xml rather than "cross domain.xml" (with a space) as you listed it below.

ChrisOwen

Thanks for the reply Jon.
The file name is named correctly and it sits on the wwwroot of the GIS Server box...still nothing.

The site is viewable (widgets, etc) but the data just does'nt display. I am going to look at the GIS Server settings, but any ideas are welcome.

Chris

JonFisher

Does any data display (e.g. base maps, ESRI operational layers) but not your own? Or do no map services ever display? It helps to be able to figure out if it's a problem with your map services or the application itself. Post your config.xml file and maybe we can spot something wrong there.

ChrisOwen

All of the data comes form our SDE.
Attached is the config.XML

config.txt.zip

JonFisher

the URLs pointing to your map services are incorrect. "http://gis/ArcGIS/rest/services/GISBaseMap_wwcOrtho062/MapServer" will not resolve properly. You need to replace "gis" with the DNS name of the server (e.g. gis.yourcompany.com).

An easy test: if you can't load the URL in your config file in a browser (e.g. the one listed above), it won't work in the flex map either.

ChrisOwen

Ah-Ha, let me give that a try...

ChrisOwen

I changed the rest services in the config file to have the complete DNS name, but it still doesn't work from outside the network (it still works internally, so no issue there).

Still trying to fugure this out...

RobertScheitlin__GISP

Chris,

What is the url? I will be glad to run a http diagnostic on your site and tell you what is going wrong.

ChrisOwen

Thanks Robert
http://64.35.142.197:8000

RobertScheitlin__GISP

Chris,

You shouldn't have a mixture of IP address and server names.

You currently have gis.ci.walla-walla.wa.us in some places and 64.35.142.197:8000 in others. Just use gis.ci.walla-walla.wa.us in all your code and xml files.

ChrisOwen

The crossdomain.xml is the only place I had the 64.35.142.197:8000 - could this be the culprit?

RobertScheitlin__GISP

Chris,

Actually the DNS lookup for http://gis.ci.walla-walla.wa.us is not working. Do you have IT people that could look at this?

ChrisOwen

I'll have them look into this and update the post with the findings.

ChrisOwen

So, it appears the current web server does not have a reverse proxy software/service running and is the reason the rest directories/sites are not able to display - at least that is what we are concluding.

Our approach is to virtualize the existing web server (as not to disrupt the current IIS services) and install a reverse proxy whihc allows http traffic into our network. With that said, does anyone have suggestions for a simple, light-weight reverse proxy? We are running a Windows 2008 server.

If anyone has reverse proxy suggestions and some quick reasoning, this would be a tremendous help.

Thanks!
Chris

RobertScheitlin__GISP

Chris,

I just use an OLD OLD server that we were going to get rid of and have that in the DMZ with Apache on it for the reverse Proxy server. Apache is one of the ones esri recommended in a white paper I read on reverse proxy configuration for ArcGIS Server.

Links:

http://resources.arcgis.com/content/kbase?fa=articleShow&d=32634
http://webhelp.esri.com/arcgisserver/9.3/dotnet/index.htm#firewalls_and_server.htm

ChrisOwen

Robert - this is perfect, a great start. I'll follow up, hopefully at the next level.

ChrisOwen

Robert,
So we are working on a reverse proxy (with Apache) for security. I still have nopt been able to access the flex web site from the public side..I installed Fiddler and the error still points to the domain not being accessible.

I have read that the the crossdomain.xls needs to also be installed on the proxy server. Is this the case? We do not have IIS installed on the proxy server, therefore no wwwroot folder to place the crossdomain.xml, but if this is a requirement, it will be one step closer to making it work.

Can you confirm this requirement?

Thanks,
Chris

RobertScheitlin__GISP

Chris,

Put it in the htpdocs folder on the Apache server.

JasonHansel

If you are running server 2008, you should be bale to configure IIS 7.0 to handle the reverse proxy.

ChrisOwen

Still nothing...

Here are some proxy requests from the httpd.conf...do I need to put in th efully qualified DNS instead of just server name:

ProxyRequests On

proxypass / http://GIS/PublicWEBGIS/


ProxyPass /ArcGIS/services http://GIS/ArcGIS/services

ProxyPassReverse /ArcGIS/services http://GIS/ArcGIS/services

RobertScheitlin__GISP

Chris,

Are you using the standard port 80 on the IIS Server inside the firewall? Is that port open on the fire wall between the Apache Reverse proxy server and the internal web server? On major thing to not the big purpose of the reverse Proxy server is security so if you use the standard port 80 http port than there is not a maximum benefit to your reverse proxy configuration. Optimally you would establish IIS on a non standard port on the internal server and then if a hacker hacked into the server in the DMZ they would have to know which port is open between this server and the internal IIS Server. So my httpConfig file on the Apache server it looks something like:

ProxyPass /ArcGIS/services http://gisserver:12345/ArcGIS/services

ProxyPassReverse /ArcGIS/services http://gisserver:12345/ArcGIS/services

I have to go off memory here because I am at the esri Dev Summit and can not check my Reverse Proxy Server this week.

ChrisOwen

Thanks for that security info, I will be sure to discuss this with the IT folks.
I am getting close, but still have the crossdomain.xls error popping up. From the Fiddler analyzer:

No Proxy-Authorization header is present.

No authorization header is present.

I have the crossdomain.xls file on the interneal server and the reverse proxy server, per Robert's instructions.

EDIT: Per ESRI and the Fiddler report - "reconfigure the DNS to have a record for 'gis.ci.walla-walla.wa.us' or just use the IP address of the host machine instead of the machine name."

I will be working with the Network Admin on this and will follow up with the results. Any other insight is always appreciated too.

ChrisOwen

My Network Admin and myself discussed what is occurring and he is not convinced it is the DNS.
His testing theory is since he is not able to view the flex sight from the reverse proxy server, something else is going on...we then began to discuss the reverse proxy server.

We setup the proxy server as a Windows 2003 Server virtual machine and began to question if this was the reason for the DNS block. I have three questions regrading the reverse proxy setup...

1. Can the reverse proxy run from a virtual machine?

2. Can the reverse proxy run using Windows Server 2003 OS (or what OS is best practice)?

3. Will we get anywhere if the reverse proxy cannot be viewed from the virtual machine (is this a good test)?

Robert, you wrote you used an old old machine as your reverse proxy - can you provide the OS used?

Thanks, we couldn't get this far without your feedback!

RobertScheitlin__GISP

Chris,

Do you guys have that server with the virtual server in the DMZ? I am not really sure how to do this with a virtual server. Do you have some old PC you can use and test Apache on it and place that in the DMZ?

ChrisOwen

ESRI confirmed that the virtual machine with Windows Server 2003 OS is OK for the reverse proxy.

When I run Fiddler, the roadblock is when the site tries to access the crossdomain on the application server. Doe sanyone know which file tries to access the crossdomain.xls? I beleive this to be the road block since, the crossdomain is on the application server, and public web traffic is being blicked by our firewall.

Chris

ChrisOwen

Yes, I am still working on this - I have ESRI and my Network Admin helping, but still no resolution.

Two questions regarding the reverse proxy:

1. Which IP address should the httpd.conf rules point to? The internal or external IP address of the application server?

2. Which IP address does the rest end-point need to point to (from config.xml)? The internal or external IP address of the reverese proxy server?

Thanks!

RobertScheitlin__GISP

Chris,

Now that I am back in the office here is a piece of my httpd.conf file

ProxyPass /ArcGIS/Services http://gisserver:12345/ArcGIS/Services
ProxyPassReverse /ArcGIS/Services http://gisserver:12345/ArcGIS/Services

ProxyPass /arcgis/services http://gisserver:12345/ArcGIS/Services
ProxyPassReverse /arcgis/services http://gisserver:12345/ArcGIS/Services

ProxyPass /ArcGIS/services http://gisserver:12345/ArcGIS/Services
ProxyPassReverse /ArcGIS/services http://gisserver:12345/ArcGIS/Services

ProxyPass /proxyoutput/ http://gisserver:12345/proxyoutput/
ProxyPassReverse /proxyoutput/ http://gisserver:12345/proxyoutput/

ProxyPass /proxyindex/ http://gisserver:12345/proxyindex/
ProxyPassReverse /proxyindex/ http://gisserver:12345/proxyindex/

ProxyPass /proxycache/ http://gisserver:12345/proxycache/
ProxyPassReverse /proxycache/ http://gisserver:12345/proxycache/

ProxyPass /proxyjobs/ http://gisserver:12345/proxyjobs/
ProxyPassReverse /proxyjobs/ http://gisserver:12345/proxyjobs/

and then in my main config.xml I use

url="http://gis.calhouncounty.org/arcgis/rest/services/MyService/MapServer"

ChrisOwen

Thank you Robert.

It turns out Apache was not installed correctly/became corrupted. Also, our httpd.conf had some duplicate entries, thus making the redirection not work correctly. I updated the flex config.html with the fully qualified dns, and the rest points are now being re-directed correctly from the proxy server.

We are very close.

Thnaks for keeping in touch and providing key information!

I will follow once the site is up and operational, unless we hit another snag...

ChrisOwen

Communication is workiing form the proxy server and the internal server, the only issue is:

How do I edit the httpd.config file to publish the actual flex site?

I know the proxy is working because I receive a "It works!" from the site url.

I then added the line to the httpd.config:

ProxyPass / http://internal server IP/PublicWEBGIS/

I am again, only able to view the widgets, not the data. Can anyone shed some light on this - it has to be a simple line of code inserte into the httpd.conf file.

EDIT: When I chck the site against Fiddler, it is getting stuck at the crossdomain.xml file on the external server (proxy server).

Here are the crossdomain rules:

#<?xml version="1.0" ?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>

<allow-access-from domain="*" />
<site-control permitted-cross-domain-policies="all" />
<allow-http-request-headers-from domain="*" headers="*" />

</cross-domain-policy>#

Doe mee aan het gesprek

Aangemelde leden kunnen berichten plaatsen, updates volgen en meer. Nieuw hier? Registreer een gratis account.

Snelle Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.