topic Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ? in ArcGIS Enterprise Portal Questions

Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate — Tue, 09 Nov 2021 20:32:01 GMT

We are having problems getting two web adaptors working with our Enterprise Portal and want to confirm if what we want to do is even possible. One web adaptor inside the firewall is set to use Windows authentication and we have the portal identity store configured to automatically create accounts using your Windows login. It works. The problem is when we wanted to put another web adaptor in our DMZ to allow external users such as those using Field Maps. We are using the same URL for both of these web adaptors which resolves correctly depending if you are inside the firewall that has a different DNS server.

When accessing the DMZ web adaptor, there are 403 errors where dojo.js cannot GET other resource files and the web page is blank. When trying to open the resources that had the 403 error, they come up in the browser.

Any ideas on how to get this working or if this is even possible?

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

ABishop — Tue, 09 Nov 2021 21:14:15 GMT

Hello Marc,

What version of Enterprise Portal?

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate — Wed, 10 Nov 2021 14:58:48 GMT

10.9

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

ABishop — Wed, 10 Nov 2021 15:19:22 GMT

I found this information for installing multiple web adapters at 10.9 (IIS)

https://enterprise.arcgis.com/en/web-adaptor/latest/install/iis/install-multiple-arcgis-web-adaptors-iis.htm

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate — Wed, 10 Nov 2021 16:20:51 GMT

Thanks. We saw that article, but still have the specific question if it is possible to have one web adaptor using Windows Authentication for the IIS website inside the firewall and portal configured to use Windows identity store, and the other in the DMZ using anonymous authentication in IIS.

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

ABishop — Wed, 10 Nov 2021 16:47:13 GMT

According to this thread from 2019, could possibly be the security configuration or the ports.

https://community.esri.com/t5/arcgis-enterprise-questions/login-link-fails-when-accessed-from-web-adaptor/td-p/149270

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

JonathanQuinn — Thu, 11 Nov 2021 00:20:04 GMT

So when the request is set to the home application, for example, and the home application is making requests to dojo.js and other pages, the response is a 403. But if you take that same request on the same browser, (new tab, for example), the request returns a 200?

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate — Thu, 11 Nov 2021 19:56:58 GMT

That's correct.

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

JonathanQuinn — Thu, 11 Nov 2021 22:57:53 GMT

Have you inspected the traffic for differences in headers or other information to see if the presence of a header, or value set for one, is causing the 403?

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate — Mon, 22 Nov 2021 16:15:18 GMT

We were able to sign in through the DMZ firewall with Field Maps.

However, we still get 403 errors when accessing the enterprise site through the DMZ in a browser. I tried going to /arcgis/home/webmap/viewer.html and it loads, but several css and js files it uses are throwing 403 errors and the browser is empty. I feel we have to be close to getting this working

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate — Wed, 17 Nov 2021 15:15:48 GMT

Any chance this is related to compression? I assume since I have Esri web adaptors on the DMZ and internal IIS that it would handle such things, but I'm wondering if I need to make some changes in IIS

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate — Wed, 24 Nov 2021 15:48:47 GMT

Here is the list of requests from the viewer.html. When clicking on any of the 403 resources, they appear a new browser tab so they can be accessed. I'm not sure what headers can be added and to which IIS (DMZ or internal)..

Re: Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate — Thu, 03 Feb 2022 14:29:48 GMT

We decided to start fresh with the 9.1 release, and it works. We have anonymous IIS access on the DMZ web adaptor and windows authentication with automatic account creation on the internal web adaptor. I'm leaning towards naming and DNS issues being to blame, or having different IIS on the DMZ and internal web adaptor servers initially when we tried with 9.0