topic Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy? in ArcGIS Enterprise Questions

How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Tue, 25 Jul 2017 06:38:28 GMT

Hi,

we have a single machine deployment and want to easily use the new web mapping applications (and maybe extent them later). Own services must be secured due to copyright issues by the own Portal, so AGOL is not an option.

This all runs on a virtual machine with WinServer and IIS.

I have installed

ArcGIS Server 10.5.1 federated by Portal

ArcGIS Portal 10.5.1

WebAdaptor (arcgis) configured for both above

All SSL certificates are running and Reverse Proxy Server is working

Now, Webapplication from the Portal with content from ArcGIS online is running on a different webserver, but I cannot add services from ArcGISServer to Portal and thus to any webapplication. Likewise, I want to use specific services without Portal in small web applications. Thus, I need somehow to get the rest connection but this is currently hidden in the company network.

What to do? What might be wrong?

EDIT: Do I need two Webadaptors and two reverse Proxy forwarding, as internally in the company everything is working?

Kind regards.

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

JonathanQuinn — Tue, 25 Jul 2017 17:26:29 GMT

You can't use the same Web Adaptor for Portal and Server:

Common problems and solutions—Portal for ArcGIS (10.5.x) | ArcGIS Enterprise

I'd say that's the first thing to fix before continuing.

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Wed, 26 Jul 2017 13:23:51 GMT

Yes, that was my mistake. Now the basic deployment is working with a Federated Server and a Portal with Reverse Proxy!

However, there is still the question of having a web service on the arcgis server, which is available and set to public in Portal, but still not available outside the companies network. Likewise, how to get to services from the server by JS-Applications, such as this here. Does the ArcGIS Server with Webadaptor (https://.......com/arcgissrv/) also need a Reverse Proxy for that?

Kind regards.

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

Anonymous User — Wed, 26 Jul 2017 14:27:08 GMT

Dear Dirk

Did you checked this entry:

Using a reverse proxy server with ArcGIS Server—ArcGIS Server Administration (Linux) | ArcGIS Enterprise

Can you access to the ArcGIS Server REST entry point?

Regards

Jesús de Diego

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

JonathanQuinn — Wed, 26 Jul 2017 15:56:54 GMT

You'll need a web server sitting somewhere accessible by the public where your reverse proxy will run. Then, you'll configure a Web Context URL following the link in Jesús Manuel de Diego Alarcón‌'s post. Users can reach the reverse proxy, (https://myserver.domain.com/arcgisrv/rest), which will send the request to the backend server.

Single-machine deployment with reverse proxy server—Installation Guides (10.5) | ArcGIS Enterprise

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Thu, 27 Jul 2017 06:57:18 GMT

Thanks. It was not so clear if I need a second reverse proxy (first on portal) for the server itself.

I will check.

Kind regard.

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Tue, 01 Aug 2017 11:24:08 GMT

Dear all,

current status is that the portal is running with the federated server as it should.

Now we have :

Portal (https://arcgis.internalsubdomain.domain:7443/arcgis/home) > Web Adaptor (called "arcgis", thus https://arcgis.internalsubdomain/arcgis/home) > ReverseProxy (https://arcgis.domain.com) all working with SSL, Web Context URL set to subdomain "https://arcgis.domain.com/arcgis"

Problem are services directly started on the server, which are still only available inside the company.

Server (https://arcgis.internalsubdomain.domain:6443/arcgis/rest) > Web Adaptor (called "arcgissrv", thus https://arcgis.internalsubdomain.com/arcgissrv/rest) > Reverse Proxy (NOT WORKING COMPLETLY) (https://arcgissrv.domain.com) with SSL, Web Context URL set to "https://arcgissrv.domain.com/arcgissrv"

Problem is that the latest webpage (server Rest webpage by reverse proxy) shows the REST starting page, but without images and links are wrong. The links lead to REST sites with an invalid URL with Code 400. Path of a service looks like: https://argissrv.domain.com/arcgissrv/rest/services/

Might there be any port blocking internal problem??

Kind regards.

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

JonathanQuinn — Tue, 01 Aug 2017 22:18:23 GMT

What path to the links lead to? Do they match the Web Context URL you set?

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Wed, 02 Aug 2017 06:59:06 GMT

Yes, they do.

Web Context URL set to "https://arcgissrv.domain.com/arcgissrv"

Invalid path looks like: "https://argissrv.domain.com/arcgissrv/rest/services/testservice"

Internal working path: "https://arcgis.subdomain.domain.com:6443/arcgis/rest/testservice"

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

JonathanQuinn — Wed, 02 Aug 2017 18:10:38 GMT

By setting a Web Context URL, you're telling Server to always send back that URL when clients reach the REST endpoint. The behavior you see is expected. Is https://argissrv.domain.com/arcgissrv only resolvable outside of your network? Does it work externally and not internally?

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Wed, 02 Aug 2017 19:27:09 GMT

It works internally and externally not fully.

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Thu, 03 Aug 2017 13:18:48 GMT

What seems to be weired is the listing under Server Admin Directory > system > webadaptor > KEY :

URL:	https://ARCGIS/arcgissrv
Machine name:	ARCGIS

Is that correct? Or should be something like https://arcgis.domain.com/arcgissrv ?

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

JonathanQuinn — Fri, 04 Aug 2017 00:28:51 GMT

Is "arcgis" your machine name? The web adaptor will list the URL you used to register the web adaptor with the Server, but Server will still use the web context URL, (which I assume in your configuration will forward requests to the web adaptor).

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Fri, 04 Aug 2017 08:21:14 GMT

Ok. Does the Reverse Proxy of the server need to forward to the Webadaptor adress (https://arcgis.subdomain.domain.com/arcgissrv/rest/services) or the internal one (https://arcgis.subdomain.domain.com:6443/arcgis/rest/services) ?

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

JonathanQuinn — Fri, 04 Aug 2017 18:19:23 GMT

The only time you're required to use a web adaptor is if you want to use IWA. You can go from the reverse proxy straight to the Server over 6443/6080 if you're not planning to use IWA.

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

DirkHoffmeister — Mon, 14 Aug 2017 14:47:10 GMT

So should I deinstall the Webadaptor of the Server?

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

MichaelRobb — Mon, 14 Aug 2017 19:01:58 GMT

Not quite correct. you CAN and I have made it work on 10.4 10.5 and 10.5.1, but it is not standard practice nor is it a supported workflow.

Re: How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

ChadKopplin — Tue, 24 Oct 2017 17:34:16 GMT

Is this issue still open? If so, we have a webadaptor, with a Federated Arcgis Server/Portal. We imported an SSL cert on the webadaptor (to both the root and the site), then we imported the same Cert to the Portal, both the root/intermediate. This was fine to pull our map services, but we were not able to use the process services in portal like "Generate". We had to import the cert onto the ArcGIS Server Manager as well, then we were able to have a clear path all the way through. Also, we had to create a cert with the CN = <the server name>, and the Subject Alternative names = <qualified URL name>

= <fully server name>

= <short server name>

I hope this helps.

Chad