topic Re: Connect to Portal with IWA in ArcGIS API for Python Questions

Connect to Portal with IWA

JoeHershman — Sun, 12 Dec 2021 08:58:51 GMT

I am trying to connect to a Portal that uses IWA and get an error:

Failed Kerberos authentication

I have tried both the domain accounts and the initial administrator account setup with same issue. Is it possible to login to a site with IWA? If so what am I not doing correct

target = GIS("https://pmydoamin.com/portal", "user@domain", "pwd", verify_cert=False)

Thanks

Re: Connect to Portal with IWA

ChristianWells — Fri, 06 Jan 2017 03:57:16 GMT

Have you tried created the GIS object without the username or password?

The doc here for IWA points to not using a username or password:

Working with different authentication schemes | ArcGIS for Developers

It looks like there are some additional requirements for using IWA and the ArcGIS Python API:

"If your portal is configured to pick up your Windows credeintials using NTLM or Kerberos, you can omit passing in the username and password. The ArcGIS Python API is able to figure out when the GIS is using Windows authentication and picks the login credentials from the currently running process providing a seamless and secure login experience. Windows authentication only works on the Windows OS and requires pywin32 and kerberos-sspi python packages."

Re: Connect to Portal with IWA

JoeHershman — Sun, 12 Dec 2021 08:58:54 GMT

Christian,

Even in that situation I get the same error:

I have the two packages installed:

PS C:\Program Files\Anaconda3> pip install kerberos-sspi
Requirement already satisfied: kerberos-sspi in c:\program files\anaconda3\lib\site-packages
Requirement already satisfied: pywin32 in c:\program files\anaconda3\lib\site-packages (from kerberos-sspi)

Using

from arcgis.gis import GIS
target = GIS("https://portaldev.domain.com/portal")‍‍‍

Gives:

The Security configuration is the IWA from help

{ "type": "WINDOWS", "properties": { "userPassword": "OZGpymvHxMecgY67515cng==", "caseSensitive": "false", "userEmailAttribute": "mail", "user": "ram\\portal", "userFullnameAttribute": "cn", "isPasswordEncrypted": "true" } }

Logging into the Portal works as expected. We have the zone trusted at the domain level so nothing needs to be configured on individual machines and single sign on works without issue on the machine I have ArcGIS Python installed

Any other thoughts on what might be happening?

Thanks

-Joe

Re: Connect to Portal with IWA

RohitSingh2 — Fri, 06 Jan 2017 19:19:04 GMT

Hi Joe,

Can you try querying your user object after attempting to connect to your GIS:

target.properties.user.username

Does that report your username?

You're getting 'Failed Kerberos authentication' but NTLM authentication may be succeeding as you're not getting a 'Failed to authenticate using NTLM' error.

Thanks,

Rohit

Re: Connect to Portal with IWA

JoeHershman — Fri, 06 Jan 2017 19:24:06 GMT

Why yes that does work. I never though to go any further after I received the error.

Thanks

-Joe

Re: Connect to Portal with IWA

XiaoyiZhang1 — Fri, 06 Jan 2017 20:15:29 GMT

Rohit,

Same here. run target.properties.user.username and it returns my username not the one I passed

Re: Connect to Portal with IWA

RohitSingh2 — Mon, 09 Jan 2017 12:54:15 GMT

When using IWA, you should not pass in a username and password. Login credentials will be picked up from the running process.

Re: Connect to Portal with IWA

XiaoyiZhang1 — Mon, 09 Jan 2017 14:13:42 GMT

Rohit,

Try without username/pwd and got same error.

<class 'pywintypes.error'> Failed Kerberos authentication

It did return correct username.

in[0]

=============================

import datetime
import arcgis
from arcgis.gis import GIS
from IPython.display import display

# create a Web GIS object
gis = GIS("https://maps.va.gov/portal", verify_cert=False)
gis.properties.user.username

Out[0]

================================

'ArcGIS@VHAMASTER'

Re: Connect to Portal with IWA

RohitSingh2 — Mon, 09 Jan 2017 14:27:59 GMT

That's a warning message that you can ignore. It was able to log in using IWA using NTLM.

Re: Connect to Portal with IWA

JoeHershman — Mon, 09 Jan 2017 17:49:20 GMT

Rohit... It would seem that this message is very confusing, and that perhaps in the next release of the API that if login succeeds no warning/error message should occur

Re: Connect to Portal with IWA

RohitSingh2 — Mon, 09 Jan 2017 17:54:44 GMT

I agree this is confusing... we'll take care of it in the next update. Thanks for the suggestion.

Re: Connect to Portal with IWA

XiaoyiZhang1 — Mon, 09 Jan 2017 18:50:49 GMT

How can I suppress those messages below for now when using IWA using NTLM?

<class 'pywintypes.error'> Failed Kerberos authentication

Re: Connect to Portal with IWA

JoeHershman — Sun, 12 Dec 2021 08:58:56 GMT

I have not been doing anything since the newest API was released. When trying to connect with IWA (not passing credentials I now get the following and no connection is established. I have no issue connecting to portal through my browser and IWA works as expected.

---------------------------------------------------------------------------

ValueError Traceback (most recent call last)
<ipython-input-13-740700131cc8> in <module>()
 2
----> 4 portal = GIS("https://portaldev.ramtech-gis.com/portal", verify_cert=False)
C:\ArcGISPython\Anaconda\lib\site-packages\arcgis\gis.py in __init__(self, url, username, password, key_file, cert_file, verify_cert, set_active)
 91 self._datastores_list = None
 92 self._portal = portalpy.Portal(self._url, self._username, self._password, self._key_file, self._cert_file,
---> 93 verify_cert=self._verify_cert)
 94 
 95 if self._url.lower() == "pro":
C:\ArcGISPython\Anaconda\lib\site-packages\arcgis\_impl\portalpy.py in __init__(self, url, username, password, key_file, cert_file, expiration, referer, proxy_host, proxy_port, connection, workdir, tokenurl, verify_cert)
 159 verify_cert=verify_cert)
 160 #self.get_version(True)
--> 161 self.get_properties(True)
 162 
 163
C:\ArcGISPython\Anaconda\lib\site-packages\arcgis\_impl\portalpy.py in get_properties(self, force)
 973 if not self._properties or force:
 974 path = 'accounts/self' if self._is_pre_162 else 'portals/self'
--> 975 resp = self.con.post(path, self._postdata(), ssl=True)
 976 if resp:
 977 self._properties = resp
C:\ArcGISPython\Anaconda\lib\site-packages\arcgis\_impl\connection.py in post(self, path, postdata, files, ssl, compress, is_retry, use_ordered_dict, add_token, verify_cert, token)
 912 headers.append(('Accept-encoding', 'gzip'))
 913 
--> 914 handlers = self.get_handlers(verify_cert)
 915 opener = request.build_opener(*handlers)
 916
C:\ArcGISPython\Anaconda\lib\site-packages\arcgis\_impl\connection.py in get_handlers(self, verify_cert)
 810 from .common._iwa import NtlmSspiAuthHandler, KerberosSspiAuthHandler
 811 
--> 812 auth_NTLM = NtlmSspiAuthHandler()
 813 auth_krb = KerberosSspiAuthHandler()
 814
C:\ArcGISPython\Anaconda\lib\site-packages\arcgis\_impl\common\_iwa.py in __init__(self)
 53 
 54 def __init__(self):
---> 55 self.sspiauth = SSPINTLMAuth()
 56 
 57 def http_error_401(self, req, fp, code, msg, headers):
C:\ArcGISPython\Anaconda\lib\site-packages\arcgis\_impl\common\_iwa.py in __init__(self, user)
 17 if not user:
 18 user = win32api.GetUserName()
---> 19 self.sspi_client = sspi.ClientAuth("NTLM",user)
 20 
 21
C:\ArcGISPython\Anaconda\lib\site-packages\win32\lib\sspi.py in __init__(self, pkg_name, client_name, auth_info, targetspn, scflags, datarep)
 109 client_name, self.pkg_info['Name'],
 110 sspicon.SECPKG_CRED_OUTBOUND,
--> 111 None, auth_info)
 112 _BaseAuth.__init__(self)
 113
ValueError: year 30828 is out of range‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Connect to Portal with IWA

simoxu — Thu, 07 Sep 2017 13:05:36 GMT

Hi Rohit,

I tried everything I can, but I still can't connect to my portal with IWA.

I get HTTP 401 error: unauthorized.

I posted in another discussion, could you please have a look?

Python API can't connect to portal with windows authentication

Thanks.

Re: Connect to Portal with IWA

simoxu — Tue, 12 Sep 2017 08:31:26 GMT

FYI

Python for Windows Extensions / Bugs / #748 pywin32 issue(s) under Python 3.6.1

Try Python 3.5.4, it works for me.