topic Re: ArcGIS Server 10.1 with Forest with Multiple Domains in ArcGIS Enterprise Questions

ArcGIS Server 10.1 with Forest with Multiple Domains

JoseSousa — Thu, 16 Aug 2012 03:47:16 GMT

Hi,

Is it possible to configure ArcGIS Server for 10.1 with AD authentication in a organization with a forest made of multiple domains?
If so, is there any help guide on how to accomplish that?

Thanks,
Jose

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

BubbaHey — Thu, 16 Aug 2012 14:32:13 GMT

I've never done it, but here are some links that may help:

http://support.esri.com/en/knowledgebase/whitepapers/view/productid/194/metaid/1896

http://resources.arcgis.com/en/help/main/10.1/index.html#//0154000005qz000000

http://resources.arcgis.com/en/help/main/10.1/index.html#//0154000005n9000000

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JoseSousa — Thu, 16 Aug 2012 23:18:51 GMT

Hi Bubba,

I am not interested in allowing the setups to become available to the several domains in the forest. I just want AGS Manager 10.1 to stablish a connection with the entire forest and retrieve their users and groups to enable AD security not just those ones of a particular domain.

Regards,
Jose

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JoseSousa — Fri, 17 Aug 2012 02:54:30 GMT

Done.

Could solve it at the DB level but have done it creating a superstructure hosting all the users and groups from multiple domains.

Regards,
Jose

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

Esri_Sverige_SupportSweden — Wed, 26 Sep 2012 12:44:17 GMT

Done.

Could solve it at the DB level but have done it creating a superstructure hosting all the users and groups from multiple domains.

Regards,
Jose

Hi Jose,

Think you could explain a bit more how you did that?

Regards, Tony

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JoseSousa — Fri, 28 Sep 2012 10:45:57 GMT

Hi Tony,

Unfortunately ArcGIS Server does not seem to support a forest with multiple domains (unless there is a workaround that I am not aware).

I suggest you have a talk with the System Administrator to create a nested group and load all domains to that group. You will require an account of a member that can see them all. That account is then used in ArcGIS Server Manager for accessing the nested group.

Regards,
Jose

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

Esri_Sverige_SupportSweden — Mon, 01 Oct 2012 08:10:48 GMT

Hi Jose,

Ah alright, thanks for the info!

Regards, Tony

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

MuryadiOey — Tue, 30 Oct 2012 13:59:37 GMT

Hi Tony,

Unfortunately ArcGIS Server does not seem to support a forest with multiple domains (unless there is a workaround that I am not aware).

I suggest you have a talk with the System Administrator to create a nested group and load all domains to that group. You will require an account of a member that can see them all. That account is then used in ArcGIS Server Manager for accessing the nested group.

Regards,
Jose

I don't think it works as nested. I tried to add domain local group into Administrator role type, it didn't work. It didn't populate Role Members if you add a domain local group. but it works if it is global group. (all in Windows)

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JustinRodriguez — Mon, 11 Mar 2013 18:49:07 GMT

I don't think it works as nested. I tried to add domain local group into Administrator role type, it didn't work. It didn't populate Role Members if you add a domain local group. but it works if it is global group. (all in Windows)

You can make this work, but the solutions are NOT SUPPORTED by ESRI.

1. For Domains that are 2003 and before, Microsoft ADAM
2. For Domains that are 2008 and above, ADAM is called ADLDS

3. For LDAP users, you can create a new LDAP, Sync all of the users from your other LDAP Servers, and then point to the New LDAP ser for Authentication.

There might be others, but these are the ones that I know about. The reason these aren't supported is that they are too heavy into Domain/LDAP Administration. Also, no one from ESRI has officially tested these, so there could be some unexpected results, but from what I have seen it seems to work without issue.

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

MatejVrtich1 — Wed, 08 Jan 2014 06:38:17 GMT

Hi,

We have ArcGIS Server 10.2.1 now and it should support nested groups and domain forest since version 10.2.

We have tried the configuration with nested groups, but did not succeed.
What is the recommended configuration to allow logins to ArcGIS Server 10.2.1 from multiple domains?

Thanks,
Matej

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JustinRodriguez — Wed, 08 Jan 2014 15:01:08 GMT

Hello Matej,
Have you checked out this web help?

Using nested groups in a Windows Active Directory identity store
http://resources.arcgis.com/en/help/main/10.2/index.html#/Using_nested_groups_in_a_Windows_Active_Directory_identity_store/01540000067t000000/

Thanks-
Justin

Hi,

We have ArcGIS Server 10.2.1 now and it should support nested groups and domain forest since version 10.2.

We have tried the configuration with nested groups, but did not succeed.
What is the recommended configuration to allow logins to ArcGIS Server 10.2.1 from multiple domains?

Thanks,
Matej

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

MatejVrtich1 — Thu, 09 Jan 2014 05:28:50 GMT

Hi Justin,

Yes, we configured ArcGIS Server to use the AGSMembershipProvider.AGSADMembershipProvider and AGSMembershipProvider.AGSADRoleProvider according the web help.
However, having done that, we still cannot login to ArcGIS Server using credentials from the second domain.

Let me describe our configuration.
We have AGS running in domain A.
Users from domain A can login to ArcGIS Server (using either Windows authentication or the membership and role providers mentioned above).
We have domain B and we need to allow users from domain B to login to ArcGIS Server.
So we created group A in domain A with nested group B from domain B.
Users from domain B which need access to ArcGIS Server are members of group B which is member of group A.
Using this configuration, users from domain B still cannot login to ArcGIS Server.

Thanks,
Matej

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JustinRodriguez — Thu, 09 Jan 2014 15:42:31 GMT

Thank you for the reply,
Based on your description, there could be a couple of problems going on here.

1. Can you just grant a security group from Domain B privileges directly from ArcGIS for Server? From an ArcGIS Security standpoint, there shouldn't be any need to nest security groups the way you are doing it (I understand there might be other reasons though). It would be an excellent test.

2. Is your Domain Controller for Domain A a global catalog server for Domain B? This would be a requirement as well.

-Thank you very much

Justin R

Hi Justin,

Yes, we configured ArcGIS Server to use the AGSMembershipProvider.AGSADMembershipProvider and AGSMembershipProvider.AGSADRoleProvider according the web help.
However, having done that, we still cannot login to ArcGIS Server using credentials from the second domain.

Let me describe our configuration.
We have AGS running in domain A.
Users from domain A can login to ArcGIS Server (using either Windows authentication or the membership and role providers mentioned above).
We have domain B and we need to allow users from domain B to login to ArcGIS Server.
So we created group A in domain A with nested group B from domain B.
Users from domain B which need access to ArcGIS Server are members of group B which is member of group A.
Using this configuration, users from domain B still cannot login to ArcGIS Server.

Thanks,
Matej

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

MatejVrtich1 — Thu, 16 Jan 2014 10:30:19 GMT

Hi Justin,

Sorry for the delay but I was gathering more information about the underlying configuration.

The configuration is as follows:
Domain A and Domain B are not in the same domain forest.
Eeach domain serves as a global catalog for themselves.
There is one way selective trust between Domain A and Domain B.

Is there any way how to use this configuration with ArcGIS for Server?

Thanks,
Matej

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JustinRodriguez — Fri, 17 Jan 2014 16:59:27 GMT

Hi Justin,

Sorry for the delay but I was gathering more information about the underlying configuration.

The configuration is as follows:
Domain A and Domain B are not in the same domain forest.
Eeach domain serves as a global catalog for themselves.
There is one way selective trust between Domain A and Domain B.

Is there any way how to use this configuration with ArcGIS for Server?

Thanks,
Matej

Hello Matej,
Unfortunately our product requires the Domain Controllers to be Global Catalog Servers of each other. If this is not done, our Software cannot support this configuration.

With that being said, there is a Microsoft Domain Tool that may allow you to get around this issue.. The tool is call ADLDS. This workflow would not be supportable by ESRI Tech Support, but I know that some clients have successfully used it to correct the issue in an environment with two way or one way trusts. I hope that helps you. Take care-

Justin Rodriguez

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

MatejVrtich1 — Mon, 20 Jan 2014 13:25:12 GMT

Hi Justin,

Thank you for the tip using the AD LDS.
As I understand this, the AD LDS will be the central repository of users and groups which will be replicated from Domain A and Domain B. ArcGIS for Server will use the AD LDS as the identity provider.

Using this AD LDS, do you think it should be possible to use the Integrated Windows Authentication instead of Token authentication to authenticate users of ArcGIS for Server?

Thanks,
Matej

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JoshuaDalton — Wed, 13 Aug 2014 21:51:43 GMT

Matej, were you able to deploy AD LDS to resolve this issue? If so, can you explain how you went about configuring ad-lds and some instructions that helped you do so?

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

JoshuaDalton — Wed, 13 Aug 2014 21:56:58 GMT

Jose, I'm not a domain admin, and I'm not sure how this nested group you mention would be configured. Do you recall how you laid this out and can you explain further?

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

Lynchburg_GISDivision — Wed, 16 Dec 2015 16:29:54 GMT

We are also looking into ADLDS as an option. If anyone can provide details and additional information, we'd truly appreciate it!

Re: ArcGIS Server 10.1 with Forest with Multiple Domains

LakshmananVenkatesan — Tue, 26 Apr 2016 16:11:25 GMT

Hi Folks,

Sorry for late into the party, does any one has resolved this issue or has any documentation on this?

Even at 10.4 - It seems if domains (A and B) in different forest ArcGIS server does not support this config.