topic Re: Secure SSL services in Web App builder failing. in ArcGIS Web AppBuilder Questions

Secure SSL services in Web App builder failing.

MichaelRobb — Sun, 26 Jul 2015 00:24:16 GMT

What I want:

Have a Secure Service on ArcGIS Server and add it to Web app builder ultimately in a web service where that little prompt comes up. (Easy right?)

This process has no issue if NOT SSL.

1. http://MACHINE:6080/arcgis/rest/services/TEST/TEST/MapServer

2. Create New Web Map

3. Web Map prompts user for credentials for the secure service

4. Save Web Map

5. Create Web App .. the prompt again appears when loading

Now... I want SSL so...

on IIS, I create a Redirect for all HTTP traffic to go HTTPS (443).

1. Server admin >> changed to HTTPS only

2. Change Portal to SSL

3. Create new Web Map

4 Web Map prompts user for credentials for the secure service - SO far this looks promising

5. Save Web Map

6. Create Web APP - and..... no layers...

same thing happens both with ONLINE and Portal.

How does one properly have Secure Map Services from ArcGIS Server show up in a web application HTTPS only??

I have tried going through the web adaptor...

I have tried HTTP and HTTPS blend

I have tried all kinds of things... I can only seem to get this to work with HTTP.

Has no problem using ?jsapi from ArcGIS Server to push the prompt..

Why does Web APP BUILDER NOT SHOW THIS when using HTTPS?

IT works as expected with HTTP...

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Sun, 26 Jul 2015 00:26:05 GMT

I should add..

I have Zero problems manually obtaining token from ArcGIS Server and seeing the HTTPS secure service...

when changing to HTTPS for server I would go to https://Machinename:6443/arcgis/rest/services//TEST/TEST/MapServer

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Sun, 26 Jul 2015 01:10:09 GMT

and Another question. I found that Online Embeds the credentials when creating the WEB APP with HTTP, how does one DISABLE this?

Re: Secure SSL services in Web App builder failing.

QunSun — Mon, 27 Jul 2015 07:00:44 GMT

Hi Michael,

Because I can't access your service url, so I can't look into it.

To find the problem quickly, my suggession is you can create an app using a template insteadof Web AppBuilder.

Here are the steps:

1. Create a new web map

2. Add your service into the web map

3. Save the web map

4. Click "Share" and the share dialog shows up

5. Click "MAKE A WEB APPLICATION" button, another dialog shows up

6. Select the "Configurable Apps" dialog and select any template, such as "Basic Viewer", then click "Publish"

7. Input the title and click "SAVE & PUBLISH" button

8. You can check the newly created app can show IdentifyManager dialog or not.

If it shows the IdentifyManager dialog and Web AppBuilder doesn't, it means it shoule be a bug of Web AppBuilder. If it also can't shows the IdentifyManager dialog, it maybe something else wrong...

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Mon, 27 Jul 2015 23:54:53 GMT

Hi,

thank you for responding.

Unfortunately, i have went through the outlined process already.

The dialog shows up during the WEB MAP creation.. but does not when creating the web APPLICATION, regardless if choosing web app builder or 'basic templates'. The same as I had outlined using Portal in the above posts.

do you have contact information to troubleshoot this in detail?

https://gis.arrayis.ca:6443/arcgis/rest/services/TEST/TEST/MapServer - But I cant have you see that stuff.. so i added another..

https://gis.arrayis.ca:6443/arcgis/rest/services/SampleWorldCities/MapServer

User: PleaseWork

Password: Test

Or is there a precise step to ensure SSL works from start to end?

-Server set to HTTPS ONLY - CHECK

-Server Authentication Tier - GIS_SERVER

- ive tried services through both Port 6443 OR web adaptor

-all items under 'default website' / arcgis - has Redirect rule set (HTTP to HTTPS) - CHECK (alternatively, can set the 'Require SSL') (but then Redirect does not occur).

- Portal set to SSL only. - CHECK

-Portal uses: https://gis.arrayis.ca:7443

-IIS - Binding 443

It is funny, I have a working start to end (secure services and HTTPS) if I use Windows Authentication, add the Windows Authentication to Server and have the Browser challenge the user. But to get this web app builder to do it.. Ive never seen it happen.. yet.

Re: Secure SSL services in Web App builder failing.

JonathanQuinn — Tue, 28 Jul 2015 00:06:18 GMT

Are you ensuring you're not mixing content at all? For example, a service accessed over https can only be consumed in the web map, web app builder, and resulting web app over https. If you know you're adding the service to the original webmap over https, the first thing to do is make sure that you're accessing the web app builder and web app over https. Next, a browsers developer tools can provide more insight into why layers fail to load. If you try to open the web app that fails with the developer tools open, can you check the Console tab to see what errors, if any, are returned?

Ex.

I find the developer tools with Chrome are the easiest to work with, and can be accessed by pressing F12 or going to the Settings > More tools > Developer Tools.

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Tue, 28 Jul 2015 00:11:10 GMT

I cannot guarantee Im not mixing, if I am, I fail to see where I would be...

Ive been using Fiddler.. and see nothing, but let me try with Chrome F12

Were you able to successfully get a prompt in WAB for the secure service (to obtain a token)?

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Tue, 28 Jul 2015 00:29:16 GMT

Okay, I have it working through AGOL, I see it through the Web App builder in Online..

progress! But then I download it, add it to my IIS... and no prompt ??

https://gis.arrayis.ca/SSLTest/

But then I noticed.. I reload the webappViewer in Online.. and No prompt there either...

ArcGIS Web Application

I am fully aware that HTTPS only can talk to HTTPS and not HTTP...

and Now I went back to the Web MAP, and now not able to add https://gis.arrayis.ca:6443/arcgis/rest/services/SampleWorldCities/MapSer…

it gives me this...

Ghosts I tell ya!

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Tue, 28 Jul 2015 00:41:59 GMT

Side note, I thought about the Cert being the issue, and having a hell of a time with Comodo obtaining one in a timely manner...

I fear that this is the root of my problem.

Re: Secure SSL services in Web App builder failing.

QunSun — Tue, 28 Jul 2015 06:31:43 GMT

By test, I can't add the service https://gis.arrayis.ca:6443/arcgis/rest/services/SampleWorldCities/MapServer into mapviewer of AGOL or Portal. I should be certificate issue. When I try to add this service into mapviewer, Chrome console shows the following error.

It indicates the https request to your server is blocked because the https request is insecure.

To make it more clear, you can paste the service url into a new Chrome tab, you can get the following screenshot.

I think maybe your server is using a self-signed certificate. You'd better use a signed certificate.

Re: Secure SSL services in Web App builder failing.

JonathanQuinn — Tue, 28 Jul 2015 15:55:29 GMT

By default, ArcGIS Server has a self signed certificate on port 6443. I secured the SampleWorldCities service using GIS Tier authentication and built-in users and roles, and added it to a webmap. I created a web app from the webmap using the web app builder, shared it with everyone, and when I opened the web app, I was prompted to sign in. I believe what Qun is saying is valid, as my self signed certificate for my Server had already been trusted by my browser. I opened the web app up in IE on a separate machine that didn't trust my certificate and it first asked for me to trust the cert, and once I did, I could refresh the browser and it prompted me to sign in. Typically, we don't see people exposing 6443 or 6080 to the public, see the diagram at this link. Instead, you have that port sitting behind your DMZ with the web adaptor or another reverse proxy in the DMZ.

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Tue, 28 Jul 2015 23:28:14 GMT

Yes, I only exposed 6443 to try to determine why I could not get this to work by simplifying things and Bypassing the Web adaptor. Reason is IIS has a Redirect in place to redirect to HTTPS (URL Rewrite installed). I was and still not sure if having a redirect was causing issues on the gis.arrayis/ca/arcgis/home or the server gis.arrayis.ca/arcgis/rest/services....

by GIS Tier I am guessing you mean GIS_SERVER ?

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Wed, 05 Aug 2015 04:35:40 GMT

not a cert issue.. still have issue regardless of being EV trusted now

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Wed, 05 Aug 2015 04:42:38 GMT

Now have EV SSL from Comodo.

Create web map via Portal - Prompt for Secure web service from ArcGIS Server - prompt shows up

Create Web APP via Portal - FAILS - no prompt from the above web map (F12 only shows 'invalid Token' - um okay, where is my prompt? No prompt... as stated original post

Same process via ONLINE - web map - WORKS - I get the secure service prompt

Web APP - IT WORKS! I get the prompt!

Is there something wrong with my Portal?

Re: Secure SSL services in Web App builder failing.

JonathanQuinn — Wed, 05 Aug 2015 16:25:38 GMT

Is your Portal and Server federated? Are they on separate machines, or are they accessed via the same host? If they're unfederated, it may be that it's using a Portal token and appending it to the service URL, which is why you may see a token appended to the service URL and the "invalid token" error. There have been a few bugs logged for that behavior. The workarounds for that behavior are to federate Portal and Server or make sure that they're accessed via separate FQDN's.

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Wed, 05 Aug 2015 17:06:37 GMT

Oh my.

No Not Federated.

Portal and ArcGIS Server are on same server machine...

Re: Secure SSL services in Web App builder failing.

NickAlexandrou1 — Thu, 07 Jul 2016 17:01:51 GMT

I'm running into the same issue. Create the web map, our Windows Domain login credentials request pops up and everything works fine.

Try and consume the web map into a web application, no prompt, no data.

I'm getting with our IT department now who set up our DMZ and Web Adaptor so we can look at the certificate that is being used as I suspect that is the root of my problems.

Once you got yours fixed, when an end user opened the web application, it would prompt them to put in their Enterprise login to continue? Man that's sweet... I'm hoping to get to this point soon.

Were there any other obstacles that came about?

Re: Secure SSL services in Web App builder failing.

MichaelRobb — Thu, 07 Jul 2016 17:54:50 GMT

I've come a long way since.

Certs are handled by the following: IIS Requires a valid cert. ArcGIS Server also ROOT/Intermediate and a signed cert. (to be proper but not mandatory) there is a whole process to create the CSR, then upload the signed cert from that CSR under admin>> machine>> [machine name] >> SSLCertificates create a cert or use self signed. Generate CSR ... Import SignedCert once your organization has given back .cer Import Intermediate / Root/ then EDIT machine to use new Web Server SSL Cert under server machine properties.

you can also replace the two self generated certs for WABde with signed certs. (another strange process).

As far as what had happened for this posting, id have to go back to my notes.. was some time ago.

I am a fan of non-federated Portal (to avoid that user name costs) use Web authentication on the adaptor, enable Web Tier authentication... makes for a seamless user experience.