topic Re: Problem with 10.1 Web Adaptor in ArcGIS Enterprise Questions

Problem with 10.1 Web Adaptor

Anonymous User — Tue, 03 Jul 2012 18:48:12 GMT

Original User: cspurlock

I have done the 10.1 Server install and the Web Adaptor. In Server Manager I have set up the server to use Windows Authencation. Here is my problem. I have published a service. I remote into the server where I have ArcGIS 10.1 installed. I log into Server Manager and go to Manage Services. I see the service I created. Here is a screen shot:

[ATTACH=CONFIG]15732[/ATTACH]

If I select the Rest URL or Soap URL I get the following error:

[ATTACH=CONFIG]15733[/ATTACH]

I have ArcGIS Server and the Web Adaptor installed on the same server.

Re: Problem with 10.1 Web Adaptor

IainCampion — Thu, 05 Jul 2012 03:39:38 GMT

I have had some problem with this as well ...

one solution u need to check is ..

make sure the IIS arcgis virtual directory has

Authentication
+nt auth enabled
+ anonymous disabled

also check out the providers once you have selected the windows authentication ... and select providers ..

make sure the NTLM is first ...

The rest service via IIS worked after I did this, but the non web adaptor port still doesn't for me ...

plus I have a few issues .. trying to publish map services now ..

hope this helps ...

Coomsie 😛

Re: Problem with 10.1 Web Adaptor

Anonymous User — Thu, 05 Jul 2012 17:26:20 GMT

Original User: cspurlock

I have had some problem with this as well ...

one solution u need to check is ..

make sure the IIS arcgis virtual directory has

Authentication
+nt auth enabled
+ anonymous disabled

also check out the providers once you have selected the windows authentication ... and select providers ..

make sure the NTLM is first ...

The rest service via IIS worked after I did this, but the non web adaptor port still doesn't for me ...

plus I have a few issues .. trying to publish map services now ..

hope this helps ...

Coomsie 😛

My authentication and providers are set up correctly.

Re: Problem with 10.1 Web Adaptor

IainCampion — Thu, 05 Jul 2012 19:29:44 GMT

And you have entered the shared key in both the web adaptor setup and the security dialog ..?

Re: Problem with 10.1 Web Adaptor

Anonymous User — Thu, 05 Jul 2012 20:55:35 GMT

Original User: cspurlock

And you have entered the shared key in both the web adaptor setup and the security dialog ..?

Yes I have.

Re: Problem with 10.1 Web Adaptor

PF1 — Sat, 11 Dec 2021 12:44:19 GMT

Have you granted permissions to any services (or the root) for the 'users' role/group? I've had similar issues and solved it like coomsie did. We followed this basic procedure and can get it to work ok.

ArcGIS Manager->Security->Settings: Configure the GIS 'SITE' for 'Windows Domain' user/role store.

Restart IIS

http://localhost:6080/arcgis/admin/security/config

ArcGIS Manager->Security->Roles: Configure an AD group to have 'User' access

ArcGIS Manager->Services->Site(root) Security: Add the AD group (above) to the 'Allowed roles'
To generate the random chars we wrote a real simple pythons script:

import random
random.seed()


def listToString(_list,delimiter):
 try: 
  return delimiter.join(_list)
 except:
  return delimiter.join(["%s" % el for el in _list])

def getRandChars(num):
 chars=["'","1","2","3","4","5","6","7","8","9","0","-","=","q","w","e","r","t","y","u","i","o","p","[","]","\\","a","s","d","f","g","h","j","k","l",";","'","z","x","c","v","b","n","m",",",".","/","~","!","@","#","$","%","^","&","*","(",")","_","+","Q","W","E","R","T","Y","U","I","O","P","{","}","|","A","S","D","F","G","H","J","K","L",":","\"","Z","X","C","V","B","N","M","<",">","?"]
 out_chars=[]
 i=1
 while i<=num:
  indx=random.randint(0,len(chars)-1)
  out_chars.append(chars[indx])
  i+=1
 return out_chars
 

print listToString(getRandChars(16),"")

We do have some minor issues publishing services from ArcMap or ArcCatalog following procedures like these here: http://resources.arcgis.com/en/help/main/10.1/#/Tutorial_Publishing_a_map_service/0154000003vt000000/

We get an error that 'Packaging Succeeded, but publishing failed.' and further 'Error: unable to connect to the publishing tools service'. We did verify that te 'publishing tools service' is started and permissions are granted to the 'Publishers' and 'Administrators' roles. We can however create a .sd file and use the web manager to create a web-service from the .sd file. We've got an open trouble ticket with ESRI on that issue. Similar thread post here: http://forums.arcgis.com/threads/56212-Cannot-publish-services-to-Prerelease-10.1-Server

Best of luck!

Re: Problem with 10.1 Web Adaptor

Anonymous User — Mon, 09 Jul 2012 15:34:27 GMT

Original User: cspurlock

I have followed your steps except for the following:

I have the web adaptor installed on the same server as ArcGIS server. The documentation says this is okay.

When I go IIS > Default Web Site > arcgis > Authentication > Windows Authentication, I enabled Windows Authentication but I don't have an option to select 'Providers'. Under 'Advanced Settings', the 'Enable Kernel-mode authentication' is checked.

Re: Problem with 10.1 Web Adaptor

PF1 — Mon, 09 Jul 2012 16:20:54 GMT

I have followed your steps except for the following:

I have the web adaptor installed on the same server as ArcGIS server. The documentation says this is okay.

When I go IIS > Default Web Site > arcgis > Authentication > Windows Authentication, I enabled Windows Authentication but I don't have an option to select 'Providers'. Under 'Advanced Settings', the 'Enable Kernel-mode authentication' is checked.

Hi Curtis,

It *should* be ok that the web-adaptor/IIS is on the same server as your GIS server.

If you go to 'IIS > Default Web Site > arcgis > Authentication' and highlight the 'Windows Authentication' item then there should be a 'Providers...' link that you can select in the 'Actions' pane on the right. Then you should see the 'providers' window pop-up that allows you to move 'NTLM' to the top of the list.

See attached picture with the red box [ATTACH=CONFIG]15872[/ATTACH]

Re: Problem with 10.1 Web Adaptor

Anonymous User — Mon, 09 Jul 2012 16:28:35 GMT

Original User: cspurlock

Here is what my IIS screen looks like:

[ATTACH=CONFIG]15873[/ATTACH]

Here is the IIS version on my server:

[ATTACH=CONFIG]15874[/ATTACH]

Re: Problem with 10.1 Web Adaptor

PF1 — Mon, 09 Jul 2012 16:53:05 GMT

Here is what my IIS screen looks like:

[ATTACH=CONFIG]15873[/ATTACH]

Here is the IIS version on my server:

[ATTACH=CONFIG]15874[/ATTACH]

Hi Curtis,

I am using the web-adaptor with IIS7. You might find these articles useful (for IIS6):
How to configure IIS to support both the Kerberos protocol and the NTLM protocol for network authentication

Setting NTAuthenticationProviders at an Application level in IIS 6

Just heed the important warnings: Important This article contains information about how to edit the metabase. Before you edit the metabase, verify that you have a backup copy that you can restore if a problem occurs. For information about how to do this, see the "Configuration Backup/Restore" Help topic in Microsoft Management Console (MMC).

I'm not sure if enabling NTLM will solve your problem or if it is even required. I just know that it took me 2-3 days to get the web-adaptor with WINDOWS OS user/role and web authentication working properly and I did move the NTLM setting to the top. Best of luck!

Re: Problem with 10.1 Web Adaptor

Anonymous User — Fri, 14 Sep 2012 19:58:14 GMT

Original User: tagiles

Hi Pat,

I've been reading your posts and you seem to be working through this really well - I hope you'll be able to provide some info for me.

I have the same setup as your post above...
- iis w webAdaptor is on same machine as ags
- NTLM is top provider, with Anon disabled and Windows Auth enabled
- using domain accounts for users and ArcGIS store for roles
- using web tier security, as we want our site content (flash) blocked by the login (this works, generally)

So the issue is that we cannot figure out how to assign a ROLE to a Web Adapter - we have multiple web adaptors (ie web sites with completely different content) and we want to assign X role to X site. We cannot find anywhere in the config pages to accomplish this.

- An admin user (Any domain user configured in Roles in AGS Store as admin) can view any websites (through WA) and any REST service pages just fine.

- Users cannot access REST pages directly at all - even if a role is specifically granted for said service with error "Error: User does not have permissions to access this folder. Code: 403"

- Users CAN access ANY website content (flash), through ANY web adaptor, however the REST feeds fail with a (in our case) flash error message box "Web Sample layer failed to load: Fault Code: null; Fault Info: Unable to get token service url from (http://[server]/[webAdaptor]/rest/info) Version 10.01+ required.; Fault details: null"

Note: We are not using token authentication, since our security is on the web tier. (Authentication Tier: Web, Authentication Mode: Web)

In the REST info page:
Authentication Information:
Is Token Based Security: false

Could this token error be the result of not having a proxy - even though we didn't set up token auth?

Do you or anyone else know if it is possible to assign a role to a web adaptor? Or are we limited to Yes/No authentication for the entire website/AGServer? Seems like what we are trying to do - assign X role to X website (ie web Adaptor security) - is very logical.

Cheers
Tom

Re: Problem with 10.1 Web Adaptor

DennisGeasan — Tue, 02 Oct 2012 05:17:01 GMT

I just worked thru solving the web adapter problem this thread has described and solved. However, I found this thread after I solved it and thus wasted a bunch of time. I was using the wrong search criteria. For other folks trying to locate this solution I'm adding the following error message that others might be searching on:

Error: WEB_ADAPTOR Authentication, User Credential is not set by the web adaptor for this request, check if the web adaptor is secured
Code: 403

Let's hope the ESRI Forums search engine finds this post.

D. Geasan

Re: Problem with 10.1 Web Adaptor

Anonymous User — Wed, 27 Mar 2013 20:24:36 GMT

Original User: aviris

Thanks D. - found this right off and it answered my question about the web adapter.

I just worked thru solving the web adapter problem this thread has described and solved. However, I found this thread after I solved it and thus wasted a bunch of time. I was using the wrong search criteria. For other folks trying to locate this solution I'm adding the following error message that others might be searching on:

Error: WEB_ADAPTOR Authentication, User Credential is not set by the web adaptor for this request, check if the web adaptor is secured
Code: 403

Let's hope the ESRI Forums search engine finds this post.

D. Geasan

Re: Problem with 10.1 Web Adaptor

BubbaHey — Tue, 02 Apr 2013 15:56:17 GMT

Cool stuff. In my experience, I get this error when switching to windows authentication in Server manager, but forgetting to change authentication in IIS. By default it is set to anonymous enabled and everything else disabled. when you make this change you need to change anonymous to disabled and windows authentication to enabled. Frankly one of the great things about ArCGIS 10.1 is it doesn't need IIS unless you use Web Adaptor.

Re: Problem with 10.1 Web Adaptor

Anonymous User — Wed, 24 Apr 2013 15:07:33 GMT

Original User: dur3511

Excellent response solved the issue (disable initially and enable later anonymous to get the web adaptor set up again). Somewhat application seem to remember old settings - especially security and tokens issues - go figure after all reinstalls/uninstalls/reinstalls again (never ending pancake) !!! one reminder, token in the load balanced environment appera to have an issue (I think this is a bug soon to be reported by ESRI and hopefully soon to be taken care off)

Re: Problem with 10.1 Web Adaptor

YimanSong — Fri, 06 Sep 2013 13:47:15 GMT

I'm in 10.2, token still doesn't work

Re: Problem with 10.1 Web Adaptor

Anonymous User — Mon, 09 Sep 2013 17:51:54 GMT

Original User: bubbahey25

What error are you getting?

Re: Problem with 10.1 Web Adaptor

SaurabhGupta5 — Tue, 02 Dec 2014 06:59:09 GMT

Hi Tom,

I have also stucked in similar issue as you mentioned here , can you please help me in getting out of it.

I am using Arcgis 10.2 with web adaptor. I am using LDAP users and built-in roles. Also, set up the proxy page to use authentication from my flex page while accessing the services.

Unfortunately , i am getting this error message :

Working View layer failed to load: Fault info: Unable to get token service url from (http://sgj-srv-pub/arcgis/rest/info) Version 10.01+ required.

Please help

Regards,

Saurabh