topic Re: Making backups with PSA Disabled: How? in ArcGIS Enterprise Questions

Making backups with PSA Disabled: How?

ThomasColson — Wed, 20 Sep 2017 14:55:25 GMT

So we're required to follow all of the ArcGIS Server Security "Best Practices", which include disabling the PSA account...which now results in Back up and restore your ArcGIS Server site configuration—ArcGIS Server Administration (Windows) | ArcGIS Enterprise no longer working, as it complains that either the u and p is missing when I don't include, or when I do include it, fails and complains they're wrong. Anybody else have a work-around for this? Some .py code that will enable, then disable, the PSA as part of the routine?

Re: Making backups with PSA Disabled: How?

JakeSkinner — Fri, 10 Dec 2021 20:12:40 GMT

Hi Thomas,

Below is a python snippet you can use to enable/disable the PSA:

import urllib, urllib2, json

username = "agsAdmin"
password = "gis12345"

# Generate token
tokenURL = 'http://<server.domain.com>:6080/arcgis/admin/generateToken/'
params = {'f': 'pjson', 'username': username, 'password': password, 'client': 'requestip'}
req = urllib2.Request(tokenURL, urllib.urlencode(params))
response = urllib2.urlopen(req)
data = json.load(response)
token = data['token']

# Enable PSA
psaURL = 'http://<server.domain.com>:6080/arcgis/admin/security/psa/enable'
params = {'f': 'pjson', 'token': token}
req = urllib2.Request(psaURL, urllib.urlencode(params))
response = urllib2.urlopen(req)
data = json.load(response)
print(data)

# Disable PSA
psaURL = 'http://<server.domain.com>:6080/arcgis/admin/security/psa/disable'
params = {'f': 'pjson', 'token': token}
req = urllib2.Request(psaURL, urllib.urlencode(params))
response = urllib2.urlopen(req)
data = json.load(response)
print(data)‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Making backups with PSA Disabled: How?

ThomasColson — Wed, 20 Sep 2017 15:33:46 GMT

Thanks, but there's a catch: to generate a token you need a user name and pw....and if the PSA is initially disabled, using the PSA login results in "

Failed to log in. Invalid username or password specified."

when trying to generate a token. BTW, this is in an https-only, Windows Active Directory-Web Adapter only, environment.

Re: Making backups with PSA Disabled: How?

JakeSkinner — Wed, 20 Sep 2017 15:41:00 GMT

You should be able to use another account that is part of your Administrator group to generate the token. Are you using web tier authentication?

Re: Making backups with PSA Disabled: How?

ThomasColson — Wed, 20 Sep 2017 17:12:38 GMT

Yes, but the problem continues...can't "bake" AD login credentials into a .py that's tied to Windows Task Scheduler, can't add a service account to the admin role, all AD logins are by PIV-card only....the real solution here would be to create a "Backup" role in the ArcGIS Server web-tier security scheme, and allow site backups to be triggered by service accounts coming from AD, not a PSA. I can easily generate a token at the admin interface, but the backup scripts are running nightly, automated. This was working fine 'till I started paying attention to the "Highly Secure" doc.