topic Re: Collaboration to AGOL - Pending in ArcGIS Enterprise Questions

Collaboration to AGOL - Pending

TacomaPower — Fri, 14 Dec 2018 21:19:17 GMT

I'm attempting to setup collaboration between ArcGIS Online and ArcGIS Enterprise (Portal).
Each time I try,my Portal keeps saying:

"Cannot execute collaboration workspace sync. Participate with ID (Guest - Portal) has status NOT active for collaboration with name 'xxx' and id , workspace id"

I've searched and searched with no results

Re: Collaboration to AGOL - Pending

CodyMarsh — Mon, 17 Dec 2018 23:19:44 GMT

Hello,

By chance when you created the collaboration did you place a feature layer or any form of content into the group that is shared between AGOL and Portal? If no content is added then the sync will say failed and the Guest will show as Not Joined.

Re: Collaboration to AGOL - Pending

JohnSmith45 — Tue, 08 Jan 2019 03:30:01 GMT

Hi,

Was this resolved? I'm also having this issue and have, as suggested by Cody, made sure that there is items (feature services) in both the portal and the agol groups prior to creating the collaboration. Any advice appreciated.

John

Re: Collaboration to AGOL - Pending

Anonymous User — Fri, 01 Feb 2019 21:47:05 GMT

Hi John, can you make sure Enterprise has joined the collaboration workspace? As an Admin, under Settings > Collaboration > click your collaboration > click the cog/settings icon next to the workspace > confirm you don't see the 'join workspace' option (should see 'leave workspace' option).

Hilary

Re: Collaboration to AGOL - Pending

GangWang — Thu, 07 Mar 2019 17:07:22 GMT

We had the same issue. The status shows that the participant has joined the collab workspace from portal UI. However the status shows as "pending" from the rest end point. Any idea why is that?

Re: Collaboration to AGOL - Pending

Anonymous User — Sat, 23 Mar 2019 00:29:19 GMT

Hi Gang,

Are you still seeing this? Can you confirm the guest has explicitly joined the workspace (not just accepted the collaboration invite)?

Hilary

Re: Collaboration to AGOL - Pending

AdamRepsher — Tue, 28 May 2019 12:30:07 GMT

Hi Hilary Curtis‌,

I am attempting to work through this same problem. collaboration‌ portal_for_arcgis arcgis_online‌ portal‌

The Portal Admin log shows this:

The Guest (Portal) shows this:

The Host (ArcGIS Online) shows this:

...
...

My Portal (Enterprise) install is NOT internet accessible (intranet) but it is configured correctly to pass through our enterprise proxy. It is also configured with Domain Certificates. It is secured through Active Directory. Roles and Users are managed through Portal.

The ArcGIS Online side of this collaboration is configured to use a resource account that is in the Active Directory and registered as a Portal user. Right now, the collaboration has that User ID as: user1@DOMAIN, as the user is listed within Portal. I am wondering if it needs to be changed to DOMAIN\user1.

Looking at the Admin Log - in the "USER" column - I am wondering if it is even getting credentials....

Any ideas would be great!

Thanks,

--Adam

Re: Collaboration to AGOL - Pending

PeggyFung — Wed, 05 Jun 2019 18:42:15 GMT

Hello Adam Repsher, Hilary Curtis,

I just wanted to add that I have almost exactly the same set up as Adam, the only difference being that my user was added as DOMAIN\user1. I am having the same issue as Adam.

Thanks,

Peggy

Re: Collaboration to AGOL - Pending

Anonymous User — Thu, 13 Jun 2019 20:24:38 GMT

Hi Peggy and Adam, thanks for the screenshots. Can you check - does your firewall support outbound communication through port 443? Enterprise will always "reach out" in collaborations with Online so that needs to be in place in order to connect. First thought is that the username shouldn't be an issue - the collaboration error message refers to ArcGIS Enterprise as the participant that can't be reached. Just to confirm - both the invitation and response files were exchanged and imported?

Re: Collaboration to AGOL - Pending

PeggyFung — Thu, 20 Jun 2019 14:21:19 GMT

Hi Hilary,

Yes, the firewall is enabled for outbound communication via port 443. I need to correct myself on my previous post, my issue is with Portal to Portal, not Portal to Online collaboration. Portal to Online collaboration worked after we added the ArcGIS.com domains to our proxy UAB. I am currently working with Esri Tech Support, and the case was recently escalated. Will let you know if I have any updates!

Re: Collaboration to AGOL - Pending

Anonymous User — Fri, 21 Jun 2019 22:48:46 GMT

Great, thanks for the update Peggy! Glad you are connected in with support.

Re: Collaboration to AGOL - Pending

AleksandraZietara — Tue, 06 Aug 2019 09:25:15 GMT

Hello,

I am experiencing the same problem. Have you ever found any solution?

Aleksandra

Re: Collaboration to AGOL - Pending

AdamRepsher — Mon, 26 Aug 2019 10:56:14 GMT

Hi Aleksandra Zietara‌,

I did update my Portal to 10.7 - and I made sure that the username I was entering for ArcGIS Online to access my portal was correct - DOMAIN\userID. Everything worked after that. No issues at all.

Re: Collaboration to AGOL - Pending

MichaelVolz — Mon, 07 Oct 2019 17:27:53 GMT

Adam:

You say that your Portal (Enterprise) install is NOT internet accessible (intranet) but it is configured correctly to pass through our enterprise proxy. Does this mean that your Portal does have access to the internet through this proxy and that is how you would be able to collaborate with AGOL?

Re: Collaboration to AGOL - Pending

AdamRepsher — Thu, 10 Oct 2019 15:47:53 GMT

Michael Volz‌,

Sorry this took a few days!

Yes. Our enterprise Proxy allows common port and http(s) protocol (443, 80) connections going outward. Once a connection is established, the remote server (ArcGIS Online) can communicate back.

I have another few connections (in GeoEvent Server) that must be made through the Proxy that are NOT on common ports/protocol. I had to obtain waivers, which had to go through an IT management process to approve - and eventually they added proxy rules for my specific server and required ports/protocols.

Make sense? I'm not great with network lingo....

--Adam

Re: Collaboration to AGOL - Pending

MichaelVolz — Thu, 10 Oct 2019 16:05:41 GMT

Adam:

Do you have a means to determine yourself if those ports are open (something like telnet to determine open ports)?

Currently, my org's sandbox Portal is not accessible to the internet, but I thought the collaboration could be setup where traffic could just flow from AGOL to the internal portal that does not have outward connectivity?

Re: Collaboration to AGOL - Pending

AdamRepsher — Mon, 21 Oct 2019 15:14:18 GMT

No, I don't.

I can tell if the server even has access to the proxy by logging into it and opening up arcgis.com or any outside website in a browser window.

In Portal, make sure that you have the correct IP or URL to the proxy in your portal config. It took me a while to get the correct address from IT staff because they did not (want to) understand what I was trying to do.
Also - My server is not accessible FROM the internet. I did not say that it could not access the internet.

I'd ask your IT if the account you are using as your "the account to be used by Portal for ArcGIS to perform a variety of functions in support of the portal" has the rights to pass through the proxy. Sorry - I can't find a name for it in the documentation. The account that has access to the other machines in your Enterprise, your file storage, etc. I use a domain account so that it can be given permissions on the network. That user might need rights for the proxy.

Re: Collaboration to AGOL - Pending

MichaelVolz — Mon, 21 Oct 2019 15:26:56 GMT

Adam:

Thanks for the feedback. I actually had multiple problems with my setup that needed to be addressed. Unbeknownst to me another active directory account had been remoted into the server (or a lock was being held onto from this account which was resolved by rebooting the server) and this type of account blocks all internet access including to AGOL (enhanced security to prevent MalWare attacks).

I then found out that the self-signed certificates used for the base Enterprise deployment for AGS, Portal, and the DataStore are not adequate for Collaboration tasks. ESRI tech support assisted me with installing the proper domain certificates for AGS, Portal, and the DataStore using the same certificate that had already been installed and configured for the web adaptors.

The Collaboration now works for me, but there are some workflows that I would have like to have used which are just not possible (e.g. Copying web apps from AGOL to Portal - the ESRI tech support specialist did inform me that this workflow can be done in the reverse direction Portal to AGOL which would not meet my current collaboration workflow needs).

Re: Collaboration to AGOL - Pending

AndresCastillo — Thu, 01 Apr 2021 11:12:48 GMT

See this article:

https://support.esri.com/en/technical-article/000020418

Discusses:

Configure a firewall allowed list to enable access to ArcGIS Online and associated URLs

related to whitelisting ArcGIS domains

No outbound traffic is allowed on port 443

Related to ensuring the correct ports are open.

The Windows account running the Portal for ArcGIS service does not have any internet connection

Ensuring the correct configuration of the forward proxy server.

I am working with Esri Support, and so far, we have observed these steps:

Created a collaboration between the two portals.
Tried to share a Hosted feature layer, but wasn't successfully shared.
Checked the sync between portals, but the destination portal has (not yet joined).
Checked the logs.
Imported the domain certificate (pfx with password) to the source portal, and updated the portal certificate.
Restarted the source Portal service.
Exported the source portal certificate.
Import the source portal certificate to the destination portal using https://enterprise.arcgis.com/en/portal/latest/administer/windows/configuring-the-portal-to-trust-certificates-from-your-certifying-authority.htm
repeat steps 5-8 (destination portal to source portal)