topic Re: Portal and Reverse Proxy: Too Many Redirect Errors in ArcGIS Enterprise Questions

Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Mon, 21 Jan 2019 13:21:55 GMT

Hello,

I have not been able to find step by step directions for ArcGIS for Portal and Reverse Proxy which uses IIS as a server. I have a setup in place which mostly work but fails at one critical point. Here's the setup:

1) Reverse Proxy Server (Windows) with static IP address accessible from the outside (only ports 80/443 allowed in).

2) An internal machine ('GIS') which has ArcGIS for Portal and Server installed along with their respective Web Adaptors ('portal' and 'arcgis' respectively).

3) The Portal also has WebContextURL of like 'https://gis.mydomain.com/portal'

4) The RP server has a couple of URL Rewrite entries--basically, direct to Server Farm which has the 'GIS' machine.

5) A proper SSL certificate is install as gis.mydomain.com in the IIS of both the RP server and the 'GIS' server.

So far this setup works great: I am able to access all content from the outside, such as https://gis.mydomain.com/portal/home and Gallery etc. But clicking on the Signup link in the Portal home page generates a browser error: Too Many Redirects (Header of 302). So the header being passed backed from the internal machine is 302 instead of 200.

I don't know what's happening. Maybe some extra security comes in picture when the signup.html page is called?

Any idea?

Thanks!

Irfan

*** Update: Reverse Proxy Rules Screen Cap Added in this Question***

Re: Portal and Reverse Proxy: Too Many Redirect Errors

DanielCota1 — Tue, 22 Jan 2019 20:12:39 GMT

Hi Irfan Clemson‌,

Are you able to hit the admin directory at https://gis.mydomain.com/portal/admin ?

If so, does it let you sign in there?

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Tue, 22 Jan 2019 20:21:20 GMT

Hi Daniel,

Unfortunately, the same http redirect error. Of course I am able to see this link when bypassing the Reverse Proxy.

https://gis.mydomain.com/portal/portaladmin

Thanks.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

DanielCota1 — Tue, 22 Jan 2019 20:25:32 GMT

Irfan Clemson

My mistake. I meant to specify the endpoint as /portaladmin.

So you are saying that https://gis.mydomain.com/portal/portaladmin DOES resolve okay?

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Tue, 22 Jan 2019 20:30:11 GMT

Hi,

Yes, that domain does resolve fine on some other machines when the 'host' file is modified to target the internal server--thus bypassing the Reverse Proxy server.

Interesting thing about calling the portal admin url is that it tries to find multiple portal end points:

Portal (via SSL)

/portal/portaladmin/ (not SSL/not secure).

Both end points still show 302 error.

One clue might be that in my URL Rewrite rules, as in my post above, the 'schema' of http makes it work but having httpS doesn't matter even if I disable those rules.

Thanks!

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Tue, 22 Jan 2019 20:37:13 GMT

Added a screen cap of the Reverse Proxy Rules in the original Question.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

JonathanQuinn — Wed, 23 Jan 2019 20:23:39 GMT

When you reach the sign in page via the home page, there will always be a redirect for a request to Portaladmin:

The portal/portaladmin page (without a slash) redirects to portal/portaladmin/ (with a trailing slash).

If your RP is rewriting that again, then that may be a problem. It's important to know which specific request is being redirected, though. Is the request to signing.html redirecting, or another page the home app is accessing?

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Wed, 23 Jan 2019 20:52:44 GMT

Hi,

Thank you. There are several dozens of such entries--as in this screen cap below--but none of them are directing to Portal/admin. The screen cap shows what happens, when on the home page, one clicks on the signin.html page. Again, the rest of the SSL functionality works fine.

I **think** , as I said above, my URL rules don't work on the HTTPS schema may give some clue--the rules are now part of the original Question above.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

JonathanQuinn — Thu, 24 Jan 2019 00:21:18 GMT

I see, ok. If you disable your URL redirect rule where does portal redirect to? The internal machine name, (https://portal.domain.com:7443/arcgis/home/signin.html)? I use HAProxy and I've noticed if the Host header isn't set, then I see infinite redirects for certain requests.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Thu, 24 Jan 2019 01:31:26 GMT

If I disable the Rewrite rules then the portal is unreachable from outside to the address like https://gis.mydomain.com/portal

I can't believe that there is not step by step directions provided by ESRI or anyone else which would work for Windows and IIS server. ESRI's Windows RP documentation mentions Apache in Windows environment!!

Or I must be missing something obvious.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

JonathanQuinn — Thu, 24 Jan 2019 17:57:19 GMT

Are you using ARR and the URL Rewrite module? Are you adding the X-Forwarded-For header?

What exact URL is it redirecting to? I understand it's not https://gis.mydomain.com/portal, but is it the internal machine name for Portal?

I agree that we should update the documentation to cater to the most likely scenario: Apache for Linux and IIS for Windows. We don't provide step by steps instructions for any of the load balancers/reverse proxies as we rely on the load balancer or reverse proxy documentation instead. We provide information on what our software expects, (such as an HTTPS binding and X-Forwarded-For header).

In this particular case, if there is a setting that would help resolve the redirect, we'll look into if it's appropriate to add to the documentation.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Thu, 24 Jan 2019 18:09:14 GMT

Thank you.

Yes,we have the ARR module also installed but no Proxy is set there and so I am not sure if ARR is even doing anything. The URL Rewrite module has a few rules, as in my Question above.

I am not sure how to set the X-Forwarded-Headers in IIS?

Yes, the https://gis.mydomain.com/signin.html does get directed properly to the internal server's IIS--I can see that in the internal server's IIS logs with a bunch of entries like https://gis.mydomain.com/signin.html with code of 302; I believe the same response is seen in the browser.

I think I am close: Except for the signin.html (and the PortalAdmin page) every part of the Portal is accessible which doesn't require a login.

Yes, please look into it. It should not be hard to duplicate the environment for ESRI and come up with instructions. We have no other issues setting up other Reverse Proxy rules for ArcGIS Servers using IIS and URL Rewrite.

Thanks!

Re: Portal and Reverse Proxy: Too Many Redirect Errors

EricMoody — Sun, 27 Jan 2019 17:58:38 GMT

Count me in as well. We are using a load balancer and everything works on the internal addresses. However when trying to hit the site externally Portal Home comes up fine but as soon as you hit Sign In we get the dreaded ERR_TOO_MANY_REDIRECTS. Not sure what could be wrong, we have the WebContextURL set in portaladmin, we have tried multiple configuration settings in portaladmin for the WA URL. I agree it would be nice if Esri could provide some more context as to exactly what the software needs configured on a Load Balancer to work properly.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

JonathanQuinn — Mon, 28 Jan 2019 16:54:28 GMT

If you reach the Portal home page over https and then click sign in, does that help at all?

I set up ARR with URL Rewrite and I find that if I reach a URL that Portal will redirect to HTTPS, ARR will redirect indefinitely. For example, the sign in page requires HTTPS. If I reach the Portal home page over http and then click Sign In, I'm redirected indefinitely. If i reach the Portal home page over HTTPS, then I don't see a problem.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

JonathanQuinn — Mon, 28 Jan 2019 16:55:05 GMT

What load balancer are you using?

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Mon, 28 Jan 2019 17:26:16 GMT

Thank you. My Portal is set to only allow HTTPS and, yes, I reach the portal homepage via https://gis.mydomain.com/portal and then click on the Signin page, upon which I see the redirects. I hope I understood your question correctly.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Fri, 01 Feb 2019 14:44:57 GMT

Also, if I go to the http version of the Portal home page and click on Signin link then the same error happens: ArcGIS Portal insists on redirecting to the httpS page, this is despite me turning off SSL required in the Security page of the Portal (via the Portal's public interface). FYI.

Thanks

Re: Portal and Reverse Proxy: Too Many Redirect Errors

JonathanQuinn — Fri, 01 Feb 2019 18:14:57 GMT

Portal requires you to sign in over HTTPS. There's no avoiding that, unfortunately. Configuring Portal to not require SSL only means that most other pages can be accessed via HTTP or HTTPS.

I see the redirect you're talking about only in the situation where I reach the home page over HTTP and then click Sign In. I don't see any issues if I reach the home page over HTTPS and then click Sign In. I'm still investigating.

Re: Portal and Reverse Proxy: Too Many Redirect Errors

JonathanQuinn — Wed, 06 Feb 2019 18:57:20 GMT

Well, I had to rebuild the environment and don't see a redirect anymore. Not sure what's changed. Below are my settings:

Rewrite rules:

I disabled the default rule created.

Proxy settings:

Note that X-Forwarded-For is equivalent to X-Forwarded-Host:

Portal re-write rule:

Server re-write rule:

The Web Context URL is set to https://pub.acme.com/portal for Portal and https://pub.acme.com/server for Server:

Do any of your settings seem different?

Re: Portal and Reverse Proxy: Too Many Redirect Errors

IrfanClemson — Wed, 06 Feb 2019 19:28:48 GMT

I will check later. Only difference, top of the head, is in my case the 'scheme' is http and not https in the Action Properties. The rest of the settings are default/similar to your's. I will be back. Thanks