topic Re: Web Adaptor automatically redirecting to Portal (7443 url) in ArcGIS Enterprise Portal Questions

Web Adaptor automatically redirecting to Portal (7443 url)

Sergio_Galindo — Mon, 02 Apr 2018 22:02:17 GMT

After struggling while trying to federate an ArcGIS Server Site deployed in Azure, my Web Adaptor for Portal for ArcGIS ended up always redirecting to the internal Portal url (with the 7443 port).

Everytime I try to browse my portal home at: https://vgis06.eastus.cloudapp.azure.com/waportal (through web adaptor), It automarcally re-directs to https://vgis06.eastus.cloudapp.azure.com:7443/arcgis/home/ , which is the internal Portal url.

I've tried even reinstalling web adaptor for portal with no success; somehow, Portal takes control an makes the redirect.

I've tried in every browser available, I've deleted all cookies, history and downloaded files, InPrivate tabs, etc. Same result.

Anyone have experienced something similar?

Thanks in advance

Sergio G

Re: Web Adaptor automatically redirecting to Portal (7443 url)

JonathanQuinn — Mon, 02 Apr 2018 22:39:01 GMT

If you were to go to https://vgis06.eastus.cloudapp.azure.com/waportal/portaladmin/system/webadaptors/<waID> does the URL property match https://vgis06.eastus.cloudapp.azure.com/waportal? If not, you'll need to set the Web Context URL to https://vgis06.eastus.cloudapp.azure.com/waportal.

Re: Web Adaptor automatically redirecting to Portal (7443 url)

RamlaShihab1 — Tue, 03 Apr 2018 04:30:59 GMT

it could be also to the SSL Certificate issue ,if you have a generateed a wildcard certificate you need to add the alternate DNS name to that certificate applying the wildcard certificate will cause this error , for the time being you can use selfsigned certifcate , and check the behaviour

Re: Web Adaptor automatically redirecting to Portal (7443 url)

Sergio_Galindo — Tue, 03 Apr 2018 15:18:34 GMT

Hi Jonathan,

Yes, the url set on the web adaptor config page is the same:

Re: Web Adaptor automatically redirecting to Portal (7443 url)

JamesGustine — Tue, 10 Apr 2018 22:50:28 GMT

Anymore input from Esri on this? I configured everything via the ArcGIS Enterprise Builder and it was working great. After I installed SQL clients and rebooted it started redirecting to 7443/arcgis when I hit the web adaptor?

Re: Web Adaptor automatically redirecting to Portal (7443 url)

JamesGustine — Wed, 11 Apr 2018 13:39:45 GMT

Here is the request to the web adaptor and response when it switches to 7443.

Re: Web Adaptor automatically redirecting to Portal (7443 url)

Sergio_Galindo — Wed, 11 Apr 2018 20:24:32 GMT

Hi James,

I also tried installing new SSL certificates without any success.

I ended up uninstalling, deleting every Portal folder and reinstalling again.

Still have no idea about what caused the redirecting or how to avoid it nor fix it.

Re: Web Adaptor automatically redirecting to Portal (7443 url)

JonathanQuinn — Wed, 11 Apr 2018 21:16:38 GMT

Are there multiple hostnames associated with the machine? Did you use the etc\hosts file to set an alias?

Re: Web Adaptor automatically redirecting to Portal (7443 url)

Sergio_Galindo — Thu, 12 Apr 2018 22:08:49 GMT

hi again

nope,

There is no internal azure weird name.

Just ____.eastus.cloudapp.azure.com

Thanks in advance,

Sergio

Re: Web Adaptor automatically redirecting to Portal (7443 url)

RubénPérez_Planillo — Wed, 06 Jun 2018 08:37:44 GMT

Hello,

I had the same issue two times and finally I fixed it. Don't know exactly why, but it works.....

Reconfigure webadaptor using IP address instead FQDN and configure webcontexturl.

Re: Web Adaptor automatically redirecting to Portal (7443 url)

MuneerMajid — Mon, 05 Nov 2018 20:02:51 GMT

I am seeing that this behavior might have to do with the local hostname file. I have had two deployments now, one on Azure and one on a local VM where the portal web adaptor keeps defaulting to :7443/arcgis IF YOU ARE USING THE LOCAL HOSTNAME FILE TO CONFIGURE YOUR DNS

Re: Web Adaptor automatically redirecting to Portal (7443 url)

MuneerMajid — Mon, 05 Nov 2018 20:04:40 GMT

@jonathan quinn, can you please provide more details on this observation of your ? Whats the role of the hostname file here in relation to this issue ?

Re: Web Adaptor automatically redirecting to Portal (7443 url)

JonathanQuinn — Mon, 05 Nov 2018 23:50:19 GMT

If you install Portal with an entry in the etc\hosts file that associates the local IP address to an alias, Portal will pick up that hostname. When you create the portal site, it'll use the hostname.

There are rewrite rules that are monitoring whether certain headers are in the request, (X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Server, or a header the WA uses, and whether the URL is a certain format. For the URL piece, it checks whether the hostname matches either the Web Context URL host if you're using a reverse proxy or load balancer, or the web adaptor hostname. Next, the context must match the context used for the Web Context URL or web adaptor name. If no expected headers exist or the URL isn't correct, it'll redirect.

Re: Web Adaptor automatically redirecting to Portal (7443 url)

MuneerMajid — Wed, 07 Nov 2018 15:18:59 GMT

Wow, great info Jonathan. This was exactly what was happening. Luckily these were fresh deployments and we didn't have any concerns uninstalling & reinstalling the Portal. I had the etc/hosts entry prior to installation, and the webadaptor is now working as expected.

Re: Web Adaptor automatically redirecting to Portal (7443 url)

balajireddi — Thu, 28 Mar 2019 04:59:14 GMT

Yeah its because of host entries in etc\hosts file, Remove the host entries and restart the portal for arcgis service. Put your host entries back. it worked for me. thanks Jonathan.

Re: Web Adaptor automatically redirecting to Portal (7443 url)

JoshKing — Wed, 24 Apr 2019 18:14:07 GMT

Removing the web context url and setting it to nothing {} did the trick on my 10.7 set up.

Re: Web Adaptor automatically redirecting to Portal (7443 url)

pfoppe — Fri, 20 Dec 2019 01:02:48 GMT

We had this issue today in a portal environment that has some complexities. The FQDN for the portal resolves to a firewall up the network stack and ultimately gets routed to this server. Removing the etc\hosts entry for resolving the FQDN to the local IP + restarting the portal was successful.

However, we then had issues with the portal server unable to validate the federated servers since it was validating them on the FQDN. Basically the server has a hard time talking to itself on the FQDN since it resolves up the stack (we call this the notorious "U-Turn" problem). Adding the etc\hosts entry back in to resolve the FQDN to the local IP (without a restart) allowed the servers to properly validate again.

Restarting the portal (with the etc\hosts entry) was then causing the re-direct again. So...... we have a little conundrum...

Options:

1) Disable etc\hosts so the server can startup correctly, but ANY server side requests to the FQDN will fail

2) Enable the etc\hosts after the server is started so that server side requests to the FQDN are successful, but future reboots will cause an outage

3) Fix the notorious U-Turn problem (no confidence in this as this has been present for over 5 years with no acceptable resolution)

#2 is not palatable as there are many patches that get sent in the middle of the night, multiple times a week, and some of those cause the OS to restart.

Unsure why this started happening. This portal has been running for over 2 years already and this is the first time we have experienced this. We did recently add a new federated arcgis server site. We are running 10.6.1

Thanks!

Re: Web Adaptor automatically redirecting to Portal (7443 url)

JonathanQuinn — Mon, 30 Dec 2019 19:58:30 GMT

Can you describe the original purpose of setting up Portal with the etc\hosts entry set?

I think you should be able to remove the etc\hosts entry, check where Portal redirects to when you go to https://localhost:7443/arcgis/sharing/rest, (when you're on the machine), and then update the privatePortalURL in the System properties for Portal to point to the URL it redirected to. This should be pushed to the Server. If it's not, you can update the server privatePortalURL property manually, (see step 9 in the doc here)

Re: Web Adaptor automatically redirecting to Portal (7443 url)

pfoppe — Thu, 09 Jan 2020 00:48:09 GMT

Hi Jonathan Quinn‌,

The Esri portal for arcgis product sometimes makes server side requests to its fully qualified domain name (FQDN). Things like map printing, validating federated servers, etc. We also register our web-adaptors using the FQDN and setup server federation with the FQDN.

With our agencies DMZ configuration, we have issues when the server in the DMZ needs to talk to itself (or other apps in the DMZ) on the FQDN. The FQDN resolves to an external IP address hosted on a content inspection web-application firewall (WAF) WAN interface. Traffic is terminated, then inspected. Validated traffic is then routed through a back-end internal (LAN) interface on that WAF. I dont have the full technical details/knowledge here, but I reached out to the network team, and they provided me this information:

DMZ Application would like to access other DMZ application but using the DNS gives the IP address of the application Virtual interface on the Web Application Firewall. This can causes an issue with the Traffic reaching the external interface of the WAF but having the "client" residing on the internal interface. This create what is call asynchronous routing where the flow back and forth does not follow the same path and can cause issue (in this case the WAF receive on one interface IP and send on another thus looking like two different people ).

So, as a work-around to this "asynchronous routing" issue, we typically did 1 of 2 things:

Option 1 - Add a local etc/hosts entry on the 'client' server to resolve the FQDN to the actual server in the DMZ (usually to just itself, but sometimes to other applications/services hosted in the same DMZ). We also had to upload SSL Certificates to the DMZ servers with their FQDN as a SAN to deal with SSL trust issues. We do have issues with option 1 if there are routing rules sending traffic on a certain FQDN to multiple back-end servers (since these routing rules are not on the actual DMZ servers themselves).

Option 2 - Add a local route on the 'client' server to resolve the FQDN to the private interface of the WAF. This was the preferred approach, but was only discovered a short time ago (so most legacy applications were still using option 1).

For this specific environment, we actually moved it to a new DMZ environment that no longer has the same async routing issue (different story there). So our etc\hosts entry is no longer required. I do have a few other apps in the legacy DMZ environment (with the async routing issue), but this issue in this thread (re-direct to 7443) has not popped up there yet. Crossing my fingers it doesnt...

---

From the local machine, When I access the https://localhost:7443/arcgis/sharing/rest, it re-directs me to the https://machine.domain:7443/arcgis/sharing/rest

I do NOT currently have a privatePortalURL property set, and I think I'm going to keep it empty for now. Per the System properties—ArcGIS REST API: Administer your portal | ArcGIS for Developers -

privatePortalURL—Specifies the internal URL that ArcGIS Server should use to communicate with the portal. This property is typically used when you have a highly available ArcGIS Enterprise deployment, or if the server cannot communicate directly with the portal machine.

We do not have a highly available deployment, and our server machines can communicate with the portal on its FQDN.

I'll look at this again if this (or another issue) crops up. Thanks!!

Re: Web Adaptor automatically redirecting to Portal (7443 url)

OmerBen-Asher — Mon, 27 Jan 2020 10:23:36 GMT

Hi,

i Have the same iisue 10.7.1, did anybody resolved it?

Thanks.