topic Re: Please ensure gssapi is installed in ArcGIS API for Python Questions

Please ensure gssapi is installed

BerendVeldkamp — Tue, 07 Mar 2023 09:17:02 GMT

I'm trying to login in ArcGIS Enterprise, using a fairly standard call:

gis = GIS(portalUrl, user, pass)

This used to work, but now I get an error:

2023-03-07 10:08:59,110 - DEBUG - Connecting to portal: example.com
2023-03-07 10:08:59,114 - DEBUG - Starting new HTTPS connection (1): example.com:443
2023-03-07 10:09:00,029 - DEBUG - https://example.com:443 "GET /portal/info?f=json HTTP/1.1" 500 7058
2023-03-07 10:09:00,035 - DEBUG - https://example.com:443 "GET /portal/rest/info?f=json HTTP/1.1" 500 7058
2023-03-07 10:09:00,042 - DEBUG - https://example.com:443 "GET /portal/sharing/rest/info?f=json HTTP/1.1" 200 139
2023-03-07 10:09:00,048 - DEBUG - https://example.com:443 "GET /portal/rest/services?f=json HTTP/1.1" 500 7058
2023-03-07 10:09:00,157 - ERROR - Please ensure gssapi is installed
2023-03-07 10:09:00,171 - DEBUG - Traceback (most recent call last):
  File "D:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\lib\site-packages\arcgis\auth\_auth\_winauth.py", line 75, in __init__
    creds = gssapi.raw.acquire_cred_with_password(
  File "gssapi\raw\ext_password.pyx", line 75, in gssapi.raw.ext_password.acquire_cred_with_password
gssapi.raw.exceptions.BadNameError: Major (131072): An invalid name was supplied, Minor (2529639136): Configuration file does not specify default realm 

During handling of the above exception, another exception occurred: Traceback (most recent call last):
  File "D:\Data\MOR\Migratie\Download-wf5.py", line 45, in <module>
    main()
  File "D:\Data\MOR\Migratie\Download-wf5.py", line 33, in main
    gis = GIS(settings.ARCGIS_PORTAL_URL, settings.ARCGIS_USER, settings.ARCGIS_PASS)
  File "D:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\lib\site-packages\arcgis\gis\__init__.py", line 585, in __init__
    raise e
  File "D:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\lib\site-packages\arcgis\gis\__init__.py", line 524, in __init__
    self._portal = _portalpy.Portal(
  File "D:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\lib\site-packages\arcgis\gis\_impl\_portalpy.py", line 205, in __init__
    self.con = Connection(
  File "D:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\lib\site-packages\arcgis\gis\_impl\_con\_connection.py", line 344, in __init__
    self._create_session()
  File "D:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\lib\site-packages\arcgis\gis\_impl\_con\_connection.py", line 691, in _create_session
    self._session.auth = EsriWindowsAuth(
  File "D:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\lib\site-packages\arcgis\auth\_auth\_winauth.py", line 84, in __init__
    raise Exception("Please ensure gssapi is installed")
Exception: Please ensure gssapi is installed

A few things to notice:

Some requests to the portal return HTTP 500
The first error is Configuration file does not specify default realm . Which configuration file could this be referring to?
The second error is Please ensure gssapi is installed

This is on a client's environment, so I'm not sure if anything relevant has changed recently. One thing that did change is an upgrade to ArcGIS Pro from 3.0 to 3.1.

Re: Please ensure gssapi is installed

JCGuarneri — Tue, 07 Mar 2023 21:07:15 GMT

I'm seeing the same issue on a machine that I just upgraded to 3.1 A script that I run daily broke and I tracked it down to the GIS call like you found. Looking at my custom Python env and the default, it looks like the package it's looking for is requests-gssapi, which is installed by default. I tried updating, and un-installing/reinstalling the package. The former had no effect, the latter wouldn't let me uninstall.

I'm pretty sure the upgrade is the culprit. I'm weighing whether I'll lose more by uninstalling and going back to 3.0 or sticking with 3.1 until we have a fix.

Re: Please ensure gssapi is installed

JCGuarneri — Wed, 08 Mar 2023 15:52:20 GMT

I've found a workaround for now. It appears that the issue is limited to accounts trying to authenticate against Active Directory. Built-in Portal users are working correctly, so I created a new user just to run Python scripts and stored the credentials in a profile. My script is running correctly now. I'm not 100% sure it's necessary, but I also assigned the new user a Pro license to make sure it could use the API.

I'm also working with tech support to see if we can resolve the gssapi issue.

Re: Please ensure gssapi is installed

BerendVeldkamp — Thu, 09 Mar 2023 07:16:21 GMT

Thanks for your response, it's good to see I'm not the only one having this problem.

In the environment I'm working on, only AD users are allowed to login, so unfortunately a built-in user is not an option for me.

Please keep us informed if tech supports finds a solution!

Re: Please ensure gssapi is installed

SeanO_Neill — Wed, 17 May 2023 18:09:52 GMT

Getting the same errors 5-17-2023. Anyone have updates on how to overcome this issue with AD users?

Re: Please ensure gssapi is installed

JCGuarneri — Wed, 17 May 2023 18:48:04 GMT

@SeanO_Neill Ultimately, Esri tech support determined it was out of scope. I don't fully agree, but I've got to go with that. I'm considering logging a bug on the github page. The bit of code that handles the Windows authentication has definitely changed. Just for kicks, I followed the error chain to _winauth.py in C:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\Lib\site-packages\arcgis\auth\_auth. The error is happening in the EsriWindowsAuth class. I compared the code in this class for the 3.1 install and a machine that's still on 3.0.3, and this class has changed substantially. There's no attempt to import a package called gssapi in the older one. If I were braver, I'd try swapping the old code in to the new _winauth.py file, but I don't feel like voiding my warranty.

Interestingly, gssapi is included in the new site packages and I can import it from the Python script window. I still get the import error, though.

Re: Please ensure gssapi is installed

JCGuarneri — Wed, 17 May 2023 19:07:22 GMT

Looking at that code block some more, I realized that just because the exception returned by the try/except block says "Please ensure gssapi is installed") doesn't mean that the problem is with importing gssapi. It turns out, that's not the issue.

Looking at the error messages again, I realized I was overlooking the core error, which happens a few lines after importing gssapi and generates the error message in @BerendVeldkamp 's original post:

gssapi.raw.exceptions.BadNameError: Major (131072): An invalid name was supplied, Minor (2529639136): Configuration file does not specify default realm

This is a gssapi error, so the "Please ensure gssapi is installed" is a red herring. To me, this supports Esri having made an error in the code somewhere. I'll definitely be filing a bug report.

Re: Please ensure gssapi is installed

SeanO_Neill — Wed, 17 May 2023 19:16:01 GMT

@JCGuarneri Thanks for that update. I will also pursue a bug in git and see if it goes anywhere. This is extremely frustrating for such a fundamental operation. -And nice reconnaissance!

Re: Please ensure gssapi is installed

JCGuarneri — Thu, 18 May 2023 12:44:07 GMT

I could have sworn I tried this before, but I'm finding it works properly if I try authenticating as "user@domain" but not if i use r"domain\user".

Re: Please ensure gssapi is installed

SeanO_Neill — Fri, 19 May 2023 16:46:24 GMT

For me this does not work...I did see your post about hard coding the creds and I'm going to investigate that. Thanks for all the input on this issue...

Re: Please ensure gssapi is installed

TonyContreras_Frisco_TX — Thu, 22 Jun 2023 17:24:55 GMT

@JCGuarneri Thank you for your contributions to this thread. I was also able to connect using "username@domain" however, it looks like attempts to call administration operations fail. The only way I was able to get it to work was to enable the psa and log in with those credentials. This is very much not ideal.

Were you able to log a bug with Esri Support, or are they still trying to blame it on a 3rd party library that they built their product around?

Re: Please ensure gssapi is installed

JCGuarneri — Mon, 26 Jun 2023 13:19:32 GMT

@TonyContreras_Frisco_TX You know, I forgot to file a bug report. Esri didn't quite lay the blame, but did say it wasn't supported. I just went to file a bug report and saw there is one from 4 days ago (perhaps by you?). I added some comments to that one. I'll also reach out to the tech support rep who was helping me and update him with my findings and that bug report.

Re: Please ensure gssapi is installed

TonyContreras_Frisco_TX — Mon, 26 Jun 2023 14:48:11 GMT

Thanks for the update. I did enter the github bug and saw your comment. The information below is a tangent, but related to your experience and something that I hope the Esri Support management will correct.

"Outside the scope of Support" is the typical answer when the analyst does not want to continue working on the issue and there is a possibility that they could say the issue is with a hardware or software component not created by Esri.

In this case, the error referencing the gssapi module. Their aircgis python API utilizes many third party python libraries (including ones that are part of the core Python product that is installed with and required to use the software purchased from and "Supported by" Esri, ie. ArcGIS Pro, ArcGIS Server), so if you get an error that mentions any of those other libraries, Esri Support makes the customer prove that the issue is with their part of the product. Instead, they should work the case and collaborate with the product team until it can be proven that the issue is with a third-party software, especially in situations of a documented supported workflow.

The same goes for Enterprise products that are documented to support Windows, LDAP, and group managed service accounts, or that have products like Apache Tomcat at the core of the runtime of their products.

Re: Please ensure gssapi is installed

Juan_Toro-Killion — Thu, 24 Aug 2023 16:06:19 GMT

Thanks for all of the info you've added on this issue. Experiencing it right now.... unfortunately for me, our email addresses are our usernames. So I think the whole double '@' thing in the username string is disallowing me to get that syntax to work. Getting "General error occurred: Invalid username or password."

Re: Please ensure gssapi is installed

Ramitha — Mon, 06 Nov 2023 10:49:24 GMT

I think I have a solution for connecting to a Portal that is using Integrated Windows Authentication from ArcGIS Pro 3.1. However, it only seems to work when connecting to the Active Portal in ArcGIS Pro.

Prior to ArcGIS Pro 3.1 my code looked like this:

gis1 = GIS("https://portalurl", username="userid@DOMAIN", password="pass")

On ArcGIS Pro 3.1 I had to change the username to include the fully-qualified domain in UPPERCASE:

gis1 = GIS("https://portalurl", username="userid@DOMAIN.COM.AU", password="pass")

Lowercase does not work! Something is definitely broken.

Re: Please ensure gssapi is installed

AlonsoOrtiz — Thu, 22 Feb 2024 16:50:37 GMT

I was getting this error also, but based on comments i just try the following and it worked, i'm using AD User, so i just remove the username and password from the string like this:
gis = GIS("myportal_url",verify_cert=False)

and that worked, in case you need to run it with a different user like admin make sure to run the script as another user, probably using a batch file to do that or opening python or cmd terminal as another user, good luck.