topic Re: User name enumerations in ArcGIS Enterprise Portal Questions

User name enumerations

htsubaie — Thu, 18 Sep 2025 06:47:36 GMT

Hello,

I want to share with you our cybersecurity team concern about user name enumerations for the directory of /portal/sharing/rest/community/users/(The name of the user),

we want to deploy our portal to be accessed from outside the local network but the cyber team did a penetration testing before authorizing posting the site on the internet.

We would like to lock anonymous access so the user names cannot be found by this method we have tried to create a rewrite rules by setting conditions to be met when trying to access the directory it works with the portal it self but not with ArcGIS pro the app crashes when trying to login, And ArcGIS field maps faces a problem after the login regarding the certificate, when the rule is disabled everything works normally.

Here is the report about the penetration testing

Penetration testing

Url rewrite Rule

Rewrite Rules

ArcGIS Field Maps Error

ArcGIS Field Maps

Any solution or suggestion would be appreciated.

Re: User name enumerations

CodyPatterson — Thu, 18 Sep 2025 11:45:39 GMT

Hey @htsubaie

This is something that I actually wasn't aware of, and trying it out, it gave out quite a bit of information and ability to outside users that I had not considered! Looking around I did find this here:

https://enterprise.arcgis.com/en/server/latest/administer/linux/disabling-the-services-directory.htm

But it still allows for JSON access, which is said to be possible to restrict as well. I found a Reddit post that had mentioned this access is required for some WebGIS related items, but I'm not sure it was specifically mentioning this. I'm not able to test the disabling of the service directory until the weekend as I don't want it to have any adverse affects during the workday, but if you don't have an answer by then I can definitely check. I'll be opening a ticket with Esri support as well so they can guide me through this next week hopefully, thanks for bringing this up!

Cody

Re: User name enumerations

MichaelVolz — Thu, 18 Sep 2025 12:31:25 GMT

Do you have single sign-on enabled for your Portal? Wouldn't this prevent anonymous access to /portal/sharing/rest if it is to be accessed outside your network?

Re: User name enumerations

htsubaie — Fri, 19 Sep 2025 05:07:47 GMT

Hey @CodyPatterson

Thanks for the reply,

It is concerning since the portal mentioned would not be possible to access without an employee credentials.

And we will try to disable the service directory and update regrading any findings.

Good day

Re: User name enumerations

htsubaie — Sat, 20 Sep 2025 07:34:22 GMT

Hello @MichaelVolz

Unfortunately it is possible to try different user names in the mentioned directory until you find an existing user without the need to be signed in, our cyber team didn't have any user names given to them and they gave us a screen shot for the information regrading the user, and there is no option in the portal that can prevent it.

Good day

Re: User name enumerations

htsubaie — Mon, 22 Sep 2025 04:31:24 GMT

Update:

The method used to disable the service directory is:

https://enterprise.arcgis.com/en/portal/11.4/administer/windows/disabling-the-arcgis-portal-directory.htm

Disabling the service directory doesn't help at all it only disables the html format of viewing so the page will be a blank html page, but it can be recalled using json format, you can check it out by entering the directory of portal/sharing/rest/community/users/(the name of the user)?f=json. it will show the information of the user in json format so it doesn't help at all.

Re: User name enumerations

htsubaie — Thu, 16 Oct 2025 15:55:31 GMT

Update:

Sorry for the late update,

The only way that we tested and worked is through a proxy where when the directory /portal/sharing/rest/community/users/ is triggered you make a rule to redirect to 403 Forbidden Access.

So far the rule is working well with ArcGIS Pro and ArcGIS Field Maps.

I hope this helps other concerned about the findings.