Latest Contributions by PaulHardin

If you want to try to work on resolving this for yourself you can try to follow the summary of what we had to do with Esri's help. 1. The UpdateIdentityStore configuration settings was reviewed. With our DBA/Administrator present with Esri remoted in, we reviewed the configuration settings for the Identity Store. As an administrator of Portal, go to My Organization, click on Edit Settings, click on the Security tab and verify the "Allow access to the portal through SSL only" is checked. It doesn't matter whether the "Allow anonymous access to your portal" is checked or not as using LDAP or Integrated Windows Authentication basically forces a login. Using the URL, https://webadaptor.domain.com/arcgis/portaladmin, replacing the "webadaptor.domain.com" with your portal server domain. If you used a different website, you may need to also change the "Arcgis" folder appropriately. In our case, we placed it in a "portal" website with its own WebAdaptor since Portal and ArcGIS for Server Enterprise are installed on the same server. Login in to the portaladmin site as an administrator. Go to Security > Config > Update Identity Store. Make sure you are using the example as provided in the help documentation (http://resources.arcgis.com/en/help/main/10.2/index.html#/Using_Integrated_Windows_Authentication_with_your_portal/017s00000066000000/ changing the appropriate properties for your enterprise's AD user, password, domain, etc. Note: Esri verified you will get an error when the format is set to JSON formatting and it is normal operation. 2. We attempted to log in and got the same log in error as before. 3. We took the following steps to ensure the AD query credentials were valid and communicating with Active Directory. Go to the ArcGIS Server Manager endpoint at https://webadaptor.domain.com/arcgis/manager/# replacing the domain with your server domain and log in as an administrator. Click on the Security tab. IMPORTANT: This is only for testing the Active Directory user query login and not to be saved. Click on the Edit button (pencil icon) for Configuration Settings. Complete the steps to configure ArcGIS Server to communicate with Windows Active Directory. At the step to type in domain/username and password type in the credentials and click TEST. IMPORTANT: Once the credentials are validated click Cancel. 4. We connected back to the Portal Admin API and deleted the configurations we added previously in Step 1. 5. On the Portal server, go to the Windows services manager and stop the Portal service and then restart the Portal service. 6. Once the Portal starts back up, we ensured we could create an account from the Portal Home page. 7. Once the account creation was confirmed we connected tot he Portal Admin API and added the Windows Active Directory configurations again from Step 1. 8. On the Portal server, open the IIS Manager. Click on the Portal site. Click on Authentication. For these settings, Disable Anonymous Authentication and Enable Windows Authentication. 9. If you organization allows and you desire a single-signon experience, you could then add the Portal server as a Trusted Site in Internet Options for Internet Explorer on the Security tab. You would need to click on the Custom Level button and scroll to the bottom of the window and select "Automatic logon with current user name and password", click Ok, click Apply and then click Ok. You may want to verify with your IT department if this is in accordance with their IT Security policies. If not, you do not have to perform this step. If this step is not performed then any time you go to Portal you will be prompted to enter a user name and password on the login form that pops open. As for the other issue we were having with the Security messages that kept appearing we made the following changes: 1. On the ArcGIS Server REST API endpoint (https://webadaptor.domain.com/arcgis/admin), we needed to change the ArcGIS Server from HTTP Only to HTTP and HTTPS. Once you log in as an administrator, click on Security > Config > Update. If not already set, change HTTP Only to HTTP and HTTPS from the drop-down list for the Protocol and click Update. 2. For some reason, this kind of got our WebAdaptor out of sync and we had to re-initialize it by re-configuring our WebAdaptor the same way we did during the ArcGIS Server installation. This has to be done from the server itself. Remote into the ArcGIS server and open a browser. Go to http://localhost/arcgis/webadaptor. You can use your ArcGIS WebAdaptor server domain if using localhost does not work for you. Select ArcGIS for Server and click Next. Ensure the ArcGIS Server URL is correct. Enter the Administrator user name and password and click Configure. This will re-initialize WebAdaptor. 3. Ensure you can see the REST map services in both the HTTP protocol and HTTPS protocol by going to your http://webadaptor.domain.com/arcgis/rest/services for the unsecured services and https://webadaptor.domain.com/arcgis/rest/services for your secured services. Test to make sure you can see and preview both of these in the ArcGIS JAVA viewer or other viewer of your choice from the map service page. 4. When you try to add map services to Portal, make sure you use the HTTPS URL and you will not see the Security messages that pop up when you search for map services. I know this is long but it is the steps we had to take with Esri on a conference call and remoted in to see how it was all set up. I hope this works for any of you that are having these issues. Sincerely, Paul Hardin Senior GIS Specialist Nashville Electric Service P.S. A special note of thanks to Esri Technical Support agent, Dustin. ... View more