topic Re: Registering server with Portal prior to federation? in ArcGIS Enterprise Questions

Registering server with Portal prior to federation?

CassandraFollett — Mon, 07 Aug 2017 23:21:20 GMT

Trying to federate server using this guide for 10.5.1:
Federate an ArcGIS Server site with your portal—Portal for ArcGIS (10.5.x) | ArcGIS Enterprise

Running into this issue...

"The server at 'https://[internal machine address]6443/arcgis/admin/security/config/update' returned an error. Failed to update the security configuration. Cannot update security configuration to federate with Portal as server is not registered with Portal. Could not connect to the ArcGIS Server on machine '[Internal machine address]'.The ArcGIS Server service on that machine may not be running or the machine may not be reachable at this time."

I am a bit confused because the current documentation does not mention registering a server with Portal prior to attempting federation. Is there a step or process I am possibly missing?

Re: Registering server with Portal prior to federation?

DerekLaw — Tue, 08 Aug 2017 06:14:54 GMT

Hi Cassandra,

When you federate a Server site with Portal, you are in effect "registering" the Server site with Portal. In the help documentation you referenced, on step 4 - when you specify the Services URL and the Administration URL parameters - these are inputs that enable Portal to access and work with the Server site.

The error message you're getting suggests that Portal can't access the Server site on the network, or perhaps the Server site is not up and running.

Hope this helps,

Re: Registering server with Portal prior to federation?

CassandraFollett — Tue, 08 Aug 2017 18:49:41 GMT

Thanks, Derek. I can confirm the Server site is up and running; it's accessible from the web adaptor as well.

From the Portal machine, I can access the administration URL just fine... it is maybe worth noting, though that this is from 6443/arcgis/admin, rather than 6443/arcgis URL that the federation instructions suggest. Going to 6433/arcgis just leads to a splash page with a single image, as shown in the attached screenshot (along with errors finding and loading a script). I am going to look into what could be causing the errors on this page, but I'm suspecting now that since the script is failing to load, it may be preventing proper federation with Portal. If anyone has any ideas regarding this it'd be appreciated. Edited this post due to whole message not being posted.

Re: Registering server with Portal prior to federation?

DerekLaw — Tue, 08 Aug 2017 22:59:33 GMT

Hi Cassandra,

Ok, so you've confirmed that your Server site is up and running because you can access it right? You can access the Server administration URL, but can you access and login to ArcGIS Server Manager?

The screenshot you posted suggested that the Server site resource cannot be found.

Re: Registering server with Portal prior to federation?

CassandraFollett — Tue, 08 Aug 2017 23:04:09 GMT

Yep; ArcGIS Server Manager works fine, and I can access it from both the web adaptor and the machine hosting Portal (using the machine URL and port). However! In testing I've discovered that the GIS Server machine can't access portal, so I'm trying to address that tomorrow morning. It didn't occur to me that there may be an issue with GIS Server accessing the Portal, since the web adaptor is working without issue and is on the same machine as the Portal.

Re: Registering server with Portal prior to federation?

HungTruong — Fri, 18 Aug 2017 17:00:50 GMT

This work for me:

1. On ArcServer site, open windows firewall and set Inboung Rules and Outbound Rules to allow connections to port 7443

2. On Portal machine, open windows firewall and set Inboung Rules and Outbound Rules to allow connections to port 6443

3. make sure both ArcServer and Portal are set the same protocals (HTTP, HTTPS, or HTTP and HTTPS)

I hope this helps.

Hung Truong

Re: Registering server with Portal prior to federation?

RichelleSpry — Tue, 24 Oct 2017 04:32:03 GMT

Hi Cassandra,

Did you find a resolution to this? I am having the same issue. I am able to login via 6443/arcgis/admin but 6443/arcgis just gets the same image you provided. I am assuming it is a Server issue (rather then portal), as it does this before even adding/configuring/federating to Portal.

Thanks!

Re: Registering server with Portal prior to federation?

JonathanQuinn — Tue, 24 Oct 2017 16:41:23 GMT

Can you reach the Portal through the https://<portalmachine>.<domain>.com:7443/arcgis/sharing/rest from the Server machine? What's happening behind the scenes is that there's two way traffic, from Portal to Server via the admin URL you enter for federation, and from Server to Portal through a URL called the privatePortalURL. This can be configured through the Portaladmin API, but if it's not configured, it will default to the Portal machine over port 7443. If you can't reach the Portal from the Server machine over that URL, then that may be the problem. The error doesn't do a good job of representing the problem, unfortunately.

Re: Registering server with Portal prior to federation?

RichelleSpry — Wed, 25 Oct 2017 01:42:58 GMT

I can access and log into the ArcGIS Portal Directory. I cannot access the server administration URL (https://<IP/machine>:6443/arcgis/) required for federation.

I get:

I have noticed that when I used https://<machine name>/arcgis/ 'HTTP Error 404.0 - Not Found' (see attached), and going into c:\inetpub\wwwroot there is no 'arcgis' folder (just 'portal' and 'server'). Is there supposed to be a 'arcgis' folder there? I have 10.5.1.

Re: Registering server with Portal prior to federation?

JonathanQuinn — Wed, 25 Oct 2017 19:30:31 GMT

No, when you reach https://portal.domain.com:7443/arcgis/ or https://server.domain.com:6443/arcgis, the 7443 and 6443 ports are running on internal web servers and not through IIS. You won't see an "arcgis" folder, (unless you've installed a web adaptor named "arcgis", which WILL use IIS).

Can you clarify what you mean when you say you can't "access the server administration URL (https://<IP/machine>:6443/arcgis/) required for federation"? Do you mean that it doesn't resolve, or returns that banner page? The banner page is fine, that's an indication things are up and running. You can append /admin to the end of the URL to be sure.

In the error message Could not connect to the ArcGIS Server on machine '[Internal machine address], is the '[Internal machine address]' your Portal machine name?

Re: Registering server with Portal prior to federation?

RichelleSpry — Wed, 25 Oct 2017 22:53:28 GMT

Thanks Jonathan, this is great information.

Yes, the banner page returns and good to know that is not an issue. Also, yes I am referring to my Portal and Server machine name, as they are on the same server. This is a single machine deployment on AWS created from the Esri AMI (Esri ArcGIS Enterprise 10.5.1 with SQL Server Express 2017), so the software (inc. web adapters) were all pre-installed, and I am in the process of configuring.

The error I am mainly referring to, is when I attempt to federate my server with portal (using the previously mentioned URL's), I get this error:

It might be also useful to know that as this is just a pull-up pull-down environment for development work, I am using self-certification from IIS. I have tried a number of combinations (e.g. IP, localhost) along with the machine name (which this thread indicates is what should be used). But still get the error.

Thanks

Re: Registering server with Portal prior to federation?

JonathanQuinn — Fri, 27 Oct 2017 17:32:18 GMT

The URL you pulled up in your browser and the URL in the error message are the same, right?

Can you take a look at the Portal logs to see if there are any more detailed error messages? Are you using a self signed certificate for 6443? Does the CN for the cert match the hostname you're using in the URL? For example, in AWS, I know IP addresses are used as the hostname, so check if the certificate is issues to the IP address and that you're using the IP address for the URL.

Re: Registering server with Portal prior to federation?

RichelleSpry — Mon, 30 Oct 2017 06:23:39 GMT

Yes, they are the same URL's. Also, in AWS the CN defaults to the server name.

So I was able to federate with the following settings:

Service URL: https://[server name]/server
Admin URL: https://[server private IP]:6443/arcgis

However, using the private IP locks me out of any external access to my Portal and ArcServer services. I presume these settings are still not correct, as private ip would not work if portal and server were on separate machines?

Re: Registering server with Portal prior to federation?

RobertDriessen2 — Mon, 27 Nov 2017 10:38:45 GMT

Hi Jonathon

I am really confused about the privatePortalURL. We are setting up high availability with portal in dmz (lets say portal1.domain and portal2.domain - they also have web adapter installed). There is a f5 loadbalancer (gis.domain) referencing portal1.domain and portal2.domain.

ArcGIS server is inside the firewall (server1.domain and server2.domain (with web adapters)) and there is a load balancer for these arcgisserver.domain.

We have successfully set up Active Directory on the portals. We have successfully federated the servers (via arcgisserver.domain). But once federated we can no longer access the server manager https://server1.domain:6443/arcgis/manager or https://arcgisserver.domain:6443/arcgis/manager. I get a perpetual please wait message with nothing in the logs to indicate the problem. If I unfederate then I regain access.

So now I am checking everything. In this scenario should the

privatePortalURL="https://gis.domain:7443/arcgis" (address to f5 for portals)

privatePortalURL="https://arcgisserver.domain:7443/arcgis" (address to f5 for servers)

Note we are using the same default web adapter context (arcgis) on all web adapters.

Any help appreciated as we seem to have reached an impasse on this one.

Re: Registering server with Portal prior to federation?

JonathanQuinn — Tue, 28 Nov 2017 18:46:10 GMT

What URL did you use as the Admin URL during federation? That's the only URL that you'll be able to use to access Server Manager. Portal uses oauth and once you federate, Portal will record the Admin URL as a URL that can be used for oauth authentication. The internal machine URLs won't work anymore. We're hoping to fix that in later releases of the software.

In regards to your comment that you're using the same web adaptor context for all web adaptors, are you using a different web adaptor for Portal and Server? You'll see unexpected results and your deployment likely won't fully work if you use the same one:

Common problems and solutions—Portal for ArcGIS (10.5.x) | ArcGIS Enterprise

The privatePortalURL should be a URL that balances traffic between the Portals and is able to check the health of the Portals so it's not sending requests to a downed machine. It'll be https://f5.domain.com:7443/arcgis, and within your F5, you'll have the pool of machines running Portal. It can even be https://f5.domain.com/arcgis or even a custom context as long as you're handling the redirection and port translation. If you can reach the Sharing API through the URL, you're good to set it as the privatePortalURL.

Re: Registering server with Portal prior to federation?

OscarDiago_Alonso — Wed, 31 Jan 2018 08:43:33 GMT

Good morning!

I'm having the same problem as the original poster. We have two machines:

- ArcGIS Portal + Web Adaptor

- ArcGIS Server + Web Adaptor + ArcGIS Data Store

From the first one I can access the Server, but I can't access the Portal machine from the Server one. Is that the problem? Should I contact the tech department to ask them to enable the comunication from the Server machine to the Portal machine?

And another question: do I have to share the folders (arcgisserver, arcgisportal, arcgisdatastore) as well?

Thanks for any help providad!

Re: Registering server with Portal prior to federation?

JonathanQuinn — Fri, 02 Feb 2018 16:56:52 GMT

The privatePortalURL can be used to resolve issues where the Server can't reach the portal through the machine URL:

Ex.

https://portal.domain.com:7443/arcgis/sharing/rest

If you have a machine that can help facilitate that communication, install the web adaptor or set up a reverse proxy on that machine and then set the privatePortalURL to that URL so Server can communicate with the Portal through that additional machine. The Portal will communicate with the Server through the Admin URL, so that's something else to think about. You could just ask your IT staff to resolve the problem, though...

You don't need shared foldres if you aren't creating a multi-machine site or an HA portal.

Re: Registering server with Portal prior to federation?

AhmadAwada1 — Wed, 04 Apr 2018 11:55:19 GMT

Dear Jonathan,

Throughout this thread, you asked Richelle the following:

"In the error message Could not connect to the ArcGIS Server on machine '[Internal machine address], is the '[Internal machine address]' your Portal machine name?"

In my case, i am getting the above message where my internal machine address is the portal machine which is strange!

Note that i got this error whenever trying to validate the federation between portal and server. I also got a java.net error connection timeout. Also note that all my highly available system was working fine using Microsoft NLBs until we migrated to F5 (same VIP names, no reverse proxy rules, valid SSL certificates..).

Here are the portal log:

/Msg>
<Msg time="2018-04-04T12:20:43,991" type="WARNING" code="207051" source="Portal Admin" process="2620" thread="13" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">Validation failed for federated server 'https://prdgisapp-nlb.domain.local:6443/arcgis'.</Msg>
<Msg time="2018-04-04T12:20:43,991" type="FINE" code="207051" source="Portal Admin" process="2620" thread="13" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">Validation failed for federated server 'https://prdgisapp-nlb.domain.local:6443/arcgis'. Validation steps. Step1: Error: java.net.ConnectException: Connection timed out: connect.
</Msg>
<Msg time="2018-04-04T12:21:28,619" type="INFO" code="216003" source="Portal" process="1728" thread="1" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">HA: Node prdgisweb1.domain.local is configured to be master.</Msg>
<Msg time="2018-04-04T12:21:28,619" type="INFO" code="216004" source="Portal" process="1728" thread="1" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">HA: Monitoring the standby nodes.</Msg>
<Msg time="2018-04-04T12:22:07,710" type="DEBUG" code="9999" source="Portal Admin" process="2620" thread="13" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">java.lang.RuntimeException: java.net.ConnectException: Connection timed out: connect
at com.esri.arcgis.portal.admin.core.util.HttpClient.get(HttpClient.java:152)
at com.esri.arcgis.portal.admin.core.client.ServerClient.getServerAdminInfo(ServerClient.java:260)
at com.esri.arcgis.portal.admin.core.federation.ServerFederationManager.a(ServerFederationManager.java:1625)
at com.esri.arcgis.portal.admin.core.federation.ServerFederationManager.a(ServerFederationManager.java:1558)
at com.esri.arcgis.portal.admin.core.federation.ServerFederationManager.validateAllServers(ServerFederationManager.java:1902)
at com.esri.arcgis.portal.admin.rest.federation.ServerFederationResource.getValidateAllServers(ServerFederationResource.java:111)
at sun.reflect.GeneratedMethodAccessor812.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.sun.jersey.spi.container.JavaMethodInvokerFactory$1.invoke(JavaMethodInvokerFactory.java:60)
at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethodDispatchProvider$ResponseOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:205)
at com.sun.jersey.server.impl.model.method.dispatch.ResourceJavaMethodDispatcher.dispatch(ResourceJavaMethodDispatcher.java:75)
at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:302)
at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147)
at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108)
at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147)
at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84)
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1511)
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1442)
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1391)
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1381)
at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:416)
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:538)
at com.sun.jersey.spi.container.servlet.ServletContainer.doFilter(ServletContainer.java:910)
at com.sun.jersey.spi.container.servlet.ServletContainer.doFilter(ServletContainer.java:858)
at com.sun.jersey.spi.container.servlet.ServletContainer.doFilter(ServletContainer.java:812)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at com.opensymphony.sitemesh.webapp.SiteMeshFilter.obtainContent(SiteMeshFilter.java:129)
at com.opensymphony.sitemesh.webapp.SiteMeshFilter.doFilter(SiteMeshFilter.java:77)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at com.esri.commons.web.AppFilter.doFilter(AppFilter.java:265)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at com.esri.arcgis.portal.admin.rest.filters.AdminFilter.doFilter(AdminFilter.java:87)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at com.esri.arcgis.portal.util.TomcatValve.invoke(TomcatValve.java:43)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:442)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1083)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:640)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.net.ConnectException: Connection timed out: connect
at java.net.DualStackPlainSocketImpl.connect0(Native Method)
at java.net.DualStackPlainSocketImpl.socketConnect(DualStackPlainSocketImpl.java:79)
at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:172)
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
at java.net.Socket.connect(Socket.java:589)
at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:668)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:524)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:403)
at com.esri.arcgis.portal.admin.core.util.HttpClient$b.connectSocket(HttpClient$b.java:479)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:177)
at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:304)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:611)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446)
at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:106)
at com.esri.arcgis.portal.admin.core.util.HttpClient.get(HttpClient.java:136)
... 52 more
</Msg>
<Msg time="2018-04-04T12:22:07,710" type="WARNING" code="207051" source="Portal Admin" process="2620" thread="13" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">Validation failed for federated server 'https://prdgisapp-nlb.domain.local:6443/arcgis'.</Msg>
<Msg time="2018-04-04T12:22:07,710" type="FINE" code="207051" source="Portal Admin" process="2620" thread="13" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">Validation failed for federated server 'https://prdgisapp-nlb.domain.local:6443/arcgis'. Validation steps. Step1: Error: java.net.ConnectException: Connection timed out: connect.
</Msg>
<Msg time="2018-04-04T12:22:29,50" type="INFO" code="216003" source="Portal" process="1728" thread="1" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">HA: Node prdgisweb1.domain.local is configured to be master.</Msg>
<Msg time="2018-04-04T12:22:29,50" type="INFO" code="216004" source="Portal" process="1728" thread="1" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">HA: Monitoring the standby nodes.</Msg>
<Msg time="2018-04-04T12:23:29,701" type="INFO" code="216003" source="Portal" process="1728" thread="1" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">HA: Node prdgisweb1.domain.local is configured to be master.</Msg>
<Msg time="2018-04-04T12:23:29,701" type="INFO" code="216004" source="Portal" process="1728" thread="1" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">HA: Monitoring the standby nodes.</Msg>
<Msg time="2018-04-04T12:24:30,193" type="INFO" code="216003" source="Portal" process="1728" thread="1" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">HA: Node prdgisweb1.domain.local is configured to be master.</Msg>
<Msg time="2018-04-04T12:24:30,194" type="INFO" code="216004" source="Portal" process="1728" thread="1" methodName="" machine="PRDGISWEB1.domain.local" user="" elapsed="">HA: Monitoring the standby nodes.</Msg>

Re: Registering server with Portal prior to federation?

JonathanQuinn — Wed, 04 Apr 2018 16:06:52 GMT

Do you have a privatePortalURL set for Portal? If not, on the Server machine, can you reach https://portal.domain.com:7443/arcgis/sharing/rest/?

Re: Registering server with Portal prior to federation?

AhmadAwada1 — Wed, 04 Apr 2018 16:14:01 GMT

Hi Jonathan, yes I have a privatePortalURL set for portal and the webcontext URL looks as follows:

{"WebContextURL":"https://publicname.domain.com/portal","privatePortalURL":"https://prdgisweb-nlb.domain.local:7443/arcgis"}

Regarding whether I can access sharing/rest from arcgis server, the answer is yes.