idea Secure Portal REST API Check User Names in ArcGIS Enterprise Ideas

Secure Portal REST API Check User Names

ahmedbadr2 — Sun, 04 Jun 2023 11:24:26 GMT

noticed that api called checkUsernames in ArcGIS portal sharing rest api directory is allowed by all type of users.

is there way to secure or limit consuming this api "/portal/sharing/rest/community/checkUsernames"

Re: Secure Portal REST API Check User Names

NicolasGIS — Wed, 07 Jun 2023 08:33:40 GMT

Hi,

I had made this request few years ago, and I received the following update last week from support:

ENH-000139194 - Disable anonymous access to /sharing/rest/community/checkUsernames when portal is configured to disable self-signup

Status: Implemented (Learn More )
Version Implemented: 11.0

I am running 11.1 and I confirm it is now solved.

In the meantime, we had restricted access using a reverse proxy. Don't think there is another solution if you are running ArcGIS Enterprise < 11.0

Hope that helps,

Nicolas

Re: Secure Portal REST API Check User Names

ahmedbadr2 — Sun, 11 Jun 2023 06:36:51 GMT

Hi, thank you for you feedback

Currently I am using 11.0 disabled anonymous access and portal configured to disable self-signup, this issue is still there

Re: Secure Portal REST API Check User Names

NicolasGIS — Sun, 11 Jun 2023 11:01:33 GMT

Hi @ahmedbadr2,

It's strange: I just made the test on a 11.0 Portal for ArcGIS and it works.

As soon as "Allow users to create new built-in accounts." is disabled, I get "You do not have permissions to access this resource or perform this operation" when not logged on /portal/sharing/rest/community/checkUsernames.

Anonymous access can be enabled.

Did you try in an incognito Window ?