topic Re: arcgis server administration issue in ArcGIS Enterprise Questions

arcgis server administration issue

AnthonyCalderon — Thu, 29 Nov 2012 17:05:45 GMT

Hi All -

We are having an issue connecting to arcgis server 10.1 from arc catalog. We are able to log into web manager interface but arc catalog returns: "Access to this resource is forbidden, regardless of authorization." I had it working on one workstation right after the server was installed but now none of our workstations are able to connect through catalog. We are running 10.1 SP1 on the server and clients.

Additional note, we are able to connect from catalog if we choose "use" but both publish and administer return the error above. I have tried both internal auth and windows auth and both return the same error. I have searched the interweb and have not found any one else reporting this issue.

Any help would be greatly appreciated.

Re: arcgis server administration issue

DamianoMontrasio — Mon, 03 Dec 2012 08:36:22 GMT

Hi,
I have the same problem... in the past I solved by turning off the windows firewall, but now it still does not work.

In other installations had no problems, it may be due to the installation of some Windows update that has restricted permissions to web requests made �??�??by internal applications?

Thanks in advance...

Damiano

Re: arcgis server administration issue

RobertJones2 — Tue, 04 Dec 2012 08:50:34 GMT

Have you checked authorisation settings for the relevant ArcGIS Server services?

Re: arcgis server administration issue

nicogis — Wed, 05 Dec 2012 05:36:46 GMT

where you have licenses: program files or program files (x86) ? Are the folders esri license accessible? When do you have register the license ? In june it's (row) with 5 values with comma separator, now it's 6 values with comma separator (rows in keycodes)

Re: arcgis server administration issue

RachelS — Sat, 08 Dec 2012 06:52:03 GMT

Hi,
I'm receiving the same error message trying to connect to service in ArcCatalog. Did you ever resolve this issue?
Rachel

Re: arcgis server administration issue

nicogis — Sat, 08 Dec 2012 16:00:35 GMT

Excuse me I have confusion with another question. Are you in this situation:
"...If your server administrator has configured the Web Adaptor to block administrative access to the server, you will not be able to connect to the server in ArcGIS for Desktop through the Web Adaptor URL using an administrative or publisher connection. Alternatively, you can connect directly to the GIS server by using the URL format http://<GIS server>:6080/arcgis ..."

Re: arcgis server administration issue

RachelS — Sun, 09 Dec 2012 07:34:04 GMT

Domenico,
I have adminstravtive access to my own GIS Server, but I'm trying to use the services from an external GIS server, it keeps giving me the error that permission is forbidden, although if I type the same path into a url I do have access it's only when I connect to it in ArcCatlog.
Rachel

Re: arcgis server administration issue

JasonKolbow — Mon, 10 Dec 2012 17:07:35 GMT

Hey Rachel,

It sounds like your shop is unable to reach the URL that you're requesting...Are you able to hit the external ArcGIS Server's REST Endpoints for the services that you're attempting to use from Internet Explorer/Chrome/Firefox/Safari etc? If you are unable to hit those directories, I would only assume that it's blocking the same request from your ArcCatalog session.

Jason

Re: arcgis server administration issue

JasonKolbow — Tue, 11 Dec 2012 14:14:17 GMT

Hey Rachel,

Is this URL that you're attempting to utilize inside of Catalog a public URL that I can try to load on my end?

Thanks,

JMK

Re: arcgis server administration issue

RachelS — Wed, 12 Dec 2012 07:04:07 GMT

HI JMK,

No it's not public it requires a secure token for my server, I'm starting to think maybe Flex has issues with tokens?
I've now added the path and token straight into the config of my flexviewer and when I load the viewer it brings up the Sign in with Username and Password of the map service I'm trying to access.
However when I type in the credentials it gives an error #2032.
I googled this and Adobe says the 'error appears to occur when the url or file is blocked or not found by HTTPService call'.
I'm using AGS 10.1 and Flex 3, I've logged a call to ESRI and they seem slightly baffled by it also.

Rachel

Re: arcgis server administration issue

nicogis — Wed, 12 Dec 2012 09:33:48 GMT

Rachel, what do you see in fiddler (www.fiddler2.com) when you connect with arccatalog?

Re: arcgis server administration issue

JasonKolbow — Wed, 12 Dec 2012 14:47:34 GMT

Hey Rachel,

Unless you have that token set to never expire with that particular user, you're going to run into major problems accessing the service with that method. I've got a secure service that I have access to on my GIS Server, and when using Fiddler in Catalog to preview, I just get pushed to our load balancer machine /arcgisoutput.
Ex: maps.production.com/arcgisoutput/xxxxxxxx

Is this the behavior that you're observing for other services? I noticed it to be the same on a secure or non-secure service when connected as an administrator of the GIS Server through ArcCatalog.

JMK

Re: arcgis server administration issue

olivierthomas — Wed, 12 Dec 2012 14:54:40 GMT

Hi,

Maybe you must reconfigured the web adaptator using a shared key

Olivier T.

Re: arcgis server administration issue

RachelS — Thu, 13 Dec 2012 08:12:30 GMT

Thanks for your replies,
I just installed Fiddler on my server and tried to connect to the service in ArcCatalog, when I look back at Fiddler I don't see any error messages in stats.
The token is set for a years use. I wonder before I connect to the web service in ArcCatalog should I do something with the token first?

In Flex Builder I added it to my config xml along with the token path and when I open the viewer it brings up the Sign In window but when I add credentials it gives error 2032 which Adobe says it occurs when the url or file is blocked or not found by HTTPService call and to check it in an url. I have done this and it works fine.

I see other agencies are using the same service on public viewers that I'm trying to access so there must be some way around it.

I Use the Services on another non secure external server and I have no problem connecting to it and using it in Flex, I then use WMS from the same agency I'm trying to connect to the secure services, the WMS connected fine, it must have something to do with the fact that it's a secure service.

Oth how do I reconfigured the web adaptator using a shared key?

Rachel

Re: arcgis server administration issue

Anonymous User — Thu, 03 Jan 2013 14:31:06 GMT

Rachel,

Did you ever get to the root cause of your forbidden access issue. I am running into the same problem but nothing is obvious is starting at me & forum responses on the topic are both rare & also vague on root cause of issues.

Brad

Re: arcgis server administration issue

RachelS — Mon, 07 Jan 2013 07:55:06 GMT

Hi,
I've found the problem to my issues, it's because my server wasn't public, I hadn't realised the IP needs to be open for the map service. You learn something new everyday!
Rachel

Re: arcgis server administration issue

AnthonyCalderon — Wed, 23 Jan 2013 19:54:17 GMT

Hi all -

We still haven't been able to resolve this on our end. Our GIS folks have been just saving the .sd file to the server and then publishing through the web interface for now, but this is starting to become more of a nuisance.

We are not connecting through the web adapter, we are connecting to http://<serverName>:6080/arcgis We can successfully open this url in a web browser without error from the same workstation that is receiving the error in arcgis. Both server and workstation are on the same subnet and joined to the same domain. The arcgis server service is running as a domain account. All windows firewalls are turned off.

Any other thoughts?

Re: arcgis server administration issue

AnthonyCalderon — Wed, 23 Jan 2013 21:56:13 GMT

Found solution to our issue. I finally ran a wireshark packet capture to figure out what was going on. basically, it comes down to the fact that it needs port 6443 open as well as port 6080. Catalog uses port 6080 for http traffic and 6443 for httpS traffic (which I have not seen documented anywhere). Turns out that catalog uses the proxy settings configured for IE. In our case, we require our users to go through a proxy server for httpS traffic only and our proxy server was not allowing the connection to the internal server. Unfortunately, catalog does not give you an option to use any other settings unlike most normal programs. Once we disabled the proxy settings in IE we were able to administer our server, but then our users are unable to access httpS sites on the internet.

Hopefully this helps others out there and maybe ESRI will add the feature to not use IE's proxy settings in their next patch.

Cheers!

Re: arcgis server administration issue

MarkChilcott — Mon, 22 Apr 2013 22:27:58 GMT

Thanks Anthony. Same problem, and this was the solution.

Re: arcgis server administration issue

AndrewBrown1 — Wed, 06 Nov 2013 16:37:12 GMT

I'm having the same problem, but I'm not using a proxy server. Our AGS is set up for token authentication via web adapter, but the adapter is on a separate machine.

Tried to connect via http://server:6080/arcgis - access denied. forbidden
Tried to connect via https://server:6443/arcgis - our certificate is currently questionable, but still access denied. forbidden.

I also cannot connect to the AGS Server Manager from my machine. I try http://server:6080/arcgis/manager, and the scrollbar appears, but it doesn't move past that page. Console messages relay error 403 - forbidden.

I looked into the firewall rules on the server. All traffic from my machine is allowed on all ports, nothing is blocked. My user on the server currently has admin access, as well as being in the agsadmin group.

No clue why I cannot access the AGS box from my machine. I also cannot create services using service definition files, but that is another issue.