topic Re: Failed to return user store. For input string: "8997:266::8997:266" in ArcGIS Enterprise Questions

Failed to return user store. For input string: "8997:266::8997:266"

RandallClark2 — Thu, 06 Aug 2015 19:09:48 GMT

So i came in to work today and try to log on to my ArcGIS server site with my domain account and got the following error

"Failed to return user store. For input string: "8997:266::8997:266"

So i log on with my primary psa account and to see whats up...after poking around it seems for some reason the site can not find any of the users in the our domain.

So i go to the Config Store in the security settings and test the connection.

what i get now is

"Testing the connection failed. Please verify that you can connect to the Windows domain outside of ArcGIS Server using the username and password values you entered in the input boxes below.

For input string: "8997:266::8997:266"

So some where between last night and this morning i can not connect to the domain and can not bring and users in.

Any thoughts as to what is going on?\

ArcGIS for Server 10.3, Server 2012 R2

Edit:

From the logs...

</Msg>

<Msg time="2015-08-06T11:35:58,528" type="SEVERE" code="6581" source="Admin" process="2948" thread="1" methodName="" machine="AFGIS.AD.FULLERTON.EDU" user="" elapsed="">Failed to validate user credentials for the user 'AD\raclark'. Failed to return user store. For input string: "8997:266::8997:266"

</Msg>

<Msg time="2015-08-06T11:36:04,323" type="SEVERE" code="6619" source="Admin" process="2948" thread="1" methodName="" machine="AFGIS.AD.FULLERTON.EDU" user="" elapsed="">Failed to return user store. For input string: "8997:266::8997:266"

This is my current error code. it comes up when i try to switch to the windows domain for users....

<Msg time="2015-08-06T12:05:14,665" type="WARNING" code="7270" source="Admin" process="2948" thread="1" methodName="" machine="AFGIS.AD.FULLERTON.EDU" user="" elapsed="">Unable to connect to the identity store using the supplied parameters. Verify that you can connect to the identity store outside of ArcGIS Server using the same parameters. For input string: "8997:266::8997:266"

Edit: 8/10/15

And today when i come in an test it. It works. So i am guessing something on the IT side and not ESRI but i would still love for ESRI or anyone to weigh in on what is going on.

#ESUI Support

Edit: 8/11/2015

So still every thing seems to be working. Best guess is that it was something on the IT side and problems with the AD server.

Re: Failed to return user store. For input string: "8997:266::8997:266"

RebeccaStrauch__GISP — Thu, 06 Aug 2015 19:16:43 GMT

Check to see if the password expired for the user that is registered to access your domain users. If so, you will need to update the security connection passwork (In AGS admin/manager). I had a similar problem (different error message) happen every time I had to update my password (which I was using to connect).

Worth a check anyway.

Re: Failed to return user store. For input string: "8997:266::8997:266"

RandallClark2 — Thu, 06 Aug 2015 19:45:23 GMT

Sadly it is not that,

The account that i am using is my account personal account and that pw has not changed for it yet.

Thanks for the advice tho'

Re: Failed to return user store. For input string: "8997:266::8997:266"

AaronCohen — Fri, 07 Aug 2015 18:58:05 GMT

Same problem here.

Did you do any AGS upgrade lately?

I did from 10.2.2 to 10.3.1 and now having issues. may be a coincidence but ESRI Tech says nothing was changed from 10.2.2 to 10.3.1 for user authentication.

Restarting server corrects the issue temporarily but seems to return a day or two later.

Basically the map server cannot authenticate me or any other domain user to the domain.

Could possibly be a stealthy Windows upgrade issue.

Any thoughts on how to troubleshoot?

Re: Failed to return user store. For input string: "8997:266::8997:266"

AaronCohen — Fri, 07 Aug 2015 19:04:11 GMT

Have your IT folks made any changes to domain controllers?

Re: Failed to return user store. For input string: "8997:266::8997:266"

RandallClark2 — Sun, 09 Aug 2015 16:16:43 GMT

Nope not an upgrade. fresh install.

We are the first department on Campus to even be using security measures for the Server site.

Yeah i tried that. I think i even went as far as to uninstalling the server and it fixed it for about a day or two.

Re: Failed to return user store. For input string: "8997:266::8997:266"

RandallClark2 — Sun, 09 Aug 2015 16:24:24 GMT

I am trying not to get IT involved or at least if i have to i know what to ask them (they dont do well with open ended questions).

So given how common this problem seems to be i am hoping someone who has experienced has found a solution or can at least tell what to ask IT.

But if i was going to ask IT what would i ask them?

Re: Failed to return user store. For input string: "8997:266::8997:266"

AaronCohen — Tue, 11 Aug 2015 17:02:56 GMT

Not sure yet.

I am a GIS coordinator in IT so I have my NetAdmin's ear and they are very willing to work with me on this.

I have reopened my ESRI support request and asked to have a developer talk with my Net Admin.

We don't think it is necessarily a problem with 10.3.1 but something has changed on our end.

If we can get ESRI to describe HOW they authenticate it may give us a clue.

More later.

Re: Failed to return user store. For input string: "8997:266::8997:266"

RandallClark2 — Tue, 11 Aug 2015 18:57:59 GMT

I would love to know what if anything you come up with. the best answer i have gotten so far was on my /r/gis post.

Some one there said it was probably the domain server and check if IT to see if they had any problems.

Which makes kind of makes sense now that every thing is working again.

Thanks for your time.

Re: Failed to return user store. For input string: "8997:266::8997:266"

AaronCohen — Tue, 18 Aug 2015 13:22:58 GMT

We got it solved here.

Somehow the map server machine had the Windows Tunnel Adapter 6TO4 enabled.

So in simple terms, it wanted to call other machines (the DC) by IPv6 name not our current IPv4 name.

Run an ipconfig /all and take a look at the results.

If you see Tunnel Adapter 6TO4 that very well may be your issue.

good luck!

Re: Failed to return user store. For input string: "8997:266::8997:266"

NicolasGIS — Tue, 15 Sep 2015 06:59:05 GMT

Same problem here ...

Fresh install as well of ArcGIS Server 10.3.1 with webadaptor 10.3.1 on Windows Server 2008 R2 Enterprise SP1 running on IIS 7.

ArcGIS Server is configured to use Windows Domain with ArcGIS Server token authentication.

Failed to validate user credentials for the user 'XXX'. Failed to return user store. For input string: "1458:210:40::100:e"

Any progress made on this subject ?

Cheers

Re: Failed to return user store. For input string: "8997:266::8997:266"

RandallClark2 — Tue, 15 Sep 2015 14:52:27 GMT

Yes, was something on the IT side, they were doing something to the machine that was running the AD. But what ever it was they stopped and its been working fine.

Re: Failed to return user store. For input string: "8997:266::8997:266"

NicolasGIS — Tue, 13 Oct 2015 15:25:57 GMT

All right thanks.

After talking with our IT they have disabled IPV6 on the server and since then we do not have the problem anymore.

The thing is, according to our IT, "disabling IPV6 in Windows 2008 R2 is not recommended and not tested\supported by Microsoft" ... So I wish there were a better solution because we might have soon bad surprises.

But ArcGIS Server is supposed to be fully IPV6 comptatible :

38707 - Does ArcGIS Server support IPv6?

Another interesting thing that our IT underlines is that it seems like the IP of DC (Domain Controler) is truncated by ArcGIS Server and this is the reason why I guess it is not able to connect.

An example from our log :

- Failed to return role store. For input string: "1459:201:b56e::150:2d"

while the IP adress of our DC is : 2001:1459:201:b56e::150:2d

Food for thought !

Cheers

Re: Failed to return user store. For input string: "8997:266::8997:266"

RandallWilliams — Fri, 20 Nov 2015 15:48:12 GMT

I'm curious to see if explicitly defining your global catalog using IPv4 helps anyone on this thread encountering this issue:

http://server.arcgis.com/en/server/latest/administer/windows/configuring-the-domain-controller-used-by-arcgis-server.htm

Re: Failed to return user store. For input string: "8997:266::8997:266"

NicolasGIS — Fri, 20 Nov 2015 17:31:36 GMT

Esri support asked us to try. We did and did not solve the problem for us. Also it is better if it is dynamic as a dc can be under maintenance.

Re: Failed to return user store. For input string: "8997:266::8997:266"

NicolasGIS — Fri, 15 Jan 2016 11:14:20 GMT

FYI, ESRI opened a BUG regarding this issue :

BUG-000093484

"When trying to connect to domain controller to user store in ArcGIS Server using IPv6, this will not connect properly"

Re: Failed to return user store. For input string: "8997:266::8997:266"

RandallClark2 — Tue, 23 Feb 2016 16:32:37 GMT

So it started up again, right after a name password reset for the user names.

So i came back to this thread and was looking through stuff and i saw your post.

When run ipconfig i do see a reference to Tunnel Adapter 6TO4so i am guessing it has something to do with that.

My question is what did you do you resolve this?

Re: Failed to return user store. For input string: "8997:266::8997:266"

Anonymous User — Wed, 02 Mar 2016 16:48:26 GMT

I would also like to confirm that disabling IPv6 on a testing VM running ArcGIS for Portal 10.4 and ArcGIS Server 10.4 has fixed my issue connecting to an AD user store within Portal for ArcGIS.

https://support.microsoft.com/en-us/kb/929852

Thank you for this thread I wasted enough time trying to get this to work.

Re: Failed to return user store. For input string: "8997:266::8997:266"

AaronCohen — Wed, 02 Mar 2016 21:33:09 GMT

Sorry for my tardy reply.

My Net Admin folks disabled the Windows Tunnel Adapter 6TO4 on the map server.

How they did that I do not know.

From what I can determine it is a setting in Device Manager on that specific server.

Re: Failed to return user store. For input string: "8997:266::8997:266"

NicolasGIS — Thu, 21 Jul 2016 11:50:20 GMT

Yes same issue with Portal for ArcGIS !

I confirm that I was having the same problem with Portal 10.3.1 when trying to configure it to use Windows Active Directory.

But with Portal, the error message was not talking about IPV6 which make it even more difficult to debug :

"Failed to update identity store. Cannot connect to user store using supplied configuration. Verify the user store configuration is correct and try again."

After deactivating IPV6 on W2K8 server, it worked ! Hopefully, I had already struggle with ArcGIS Server to find out this !