topic Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment in ArcGIS Enterprise Portal Questions

Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

FraserHand1 — Sat, 11 Dec 2021 10:58:26 GMT

I am looking for a bit of clarification on the privatePortalUrl setting in ArcGIS Enterprise / Portal for ArcGIS and the Server Admin Url in federation in a Cloud Builder context

The description of the setting in the API reference says

privatePortalURL—Informs the portal that it has a front end load-balancer/proxy reachable at the URL. This property is typically used to set up a highly available portal configuration.

In this thread Portal Best Practices for setup? this comment is made

"In Portal HA, you'd also set the private portal URL for Portal, (the URL used by Server to talk to Portal) to go through a load balancer as well to make sure that even if one of the Portals go down, you can still reach the Portal." Jonathan Quinn

so is this url just for internal traffic only and doesn't need to be resolved externally? When deploying through Cloud Builder this is set to be one of the internal load balancers in front of Portal, but behind a public reverse proxy (using IIS with ARR).

The second part of this is also when deploying with Cloud Builder, the Portal / GIS Server federation has the public DNS for the services url and the internal load balancer in front of the GIS servers for the admin url.

What I see is that when using ArcGIS Pro it is very slow to share web layers etc and you can see this internal IP being exposed - there are multiple timeouts as ArcGIS Pro attempts to connect to the load balancer ip (on the admin url) - it eventually does bring up the sharing tool and does share ok but makes the experience in ArcGIS Pro very slow.

Looking at the AWS documentation it states that the services and admin url should be the same public DNS - is this the same for Azure? And why is Pro connecting to the federated admin URL anyway? Shouldn't this be faciliated by Portal? What happens if this is disabled as per portalscan / serverscan recommednations? I had thought that the admin url was another back end channel for comms between Portal and the GIS server?

So the question is if this is a private "backend" communication channel why does ArcGIS Pro attempt to connect to it? Should this setting be an external DNS?

If anyone could provide some insight into the actual mechanics of ArcGIS Pro and the federated admin url that would be appreciated.

Thanks

Fraser

EDIT:

Deploy Portal for ArcGIS on AWS—ArcGIS Enterprise on AWS | ArcGIS Enterprise

{"localHttpPort":"80","localHttpsPort":"443", "portalLocalHostname" : "awsportal.esri.com", "privatePortalURL" : "https://awsportal.esri.com/arcgis" }

There is another linkwith the federation whihc also has the external public DNS

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JonathanQuinn — Fri, 28 Jul 2017 18:31:25 GMT

Hm, interesting observation. I would be surprised if a client would need access to those internal URLs; like you, I imagine Portal would facilitate that communication. I'll do some testing and reply back.

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

FraserHand1 — Mon, 31 Jul 2017 03:49:28 GMT

Hi Jon,

Rereading the online doc Federate an ArcGIS Server site with your portal—Portal for ArcGIS (10.5.x) | ArcGIS Enterprise

Administration URL—The URL used for accessing ArcGIS Server when performing administrative operations on the internal network, for example, http://gisserver.domain.com:6080/arcgis. If your organization requires HTTPS for all communication (such as when using Integrated Windows Authentication), use https://gisserver.domain.com:6443/arcgis.

It definitely says internal network so interested to how that IP leaks. Wondering if it may have something to do with certs not being right?

Fraser

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JonathanQuinn — Tue, 01 Aug 2017 22:27:55 GMT

It doesn't have anything to do with certificates, but more so what information Pro or other clients request while publishing. Currently, it seems like that information is required, as you're able publish once those requests fail, but it's not a good user experience. I'm bringing this up to the teams here to discuss on how handle those situations.

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JTessier — Fri, 06 Apr 2018 17:00:38 GMT

Any more word on this Private Portal Url and what it is and isnt used for?

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JonathanQuinn — Fri, 06 Apr 2018 17:03:41 GMT

It's used for internal communication from Server to Portal. You'd set this in the event that the Server can't reach the Portal through the machine name, (so you'll use a URL that is accessible), or you'll use it when you're setting up a highly available Portal. If you're setting up an HA portal, you want to make sure that if one of the portal machines goes down, the federated Server machines can still reach the other portal machine.

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JTessier — Fri, 06 Apr 2018 17:50:26 GMT

Thanks Jonathan, we are in an HA configuration and thus will be setting that value. So is the workflow in HA?:

1) AGS tries a machine name of the primary Portal server first.

2) If that doesn't respond it uses this Private Portal Url to try a second time (to get to the HA server)?

Or if this value exists, AGS always uses it to communicate to a Portal in an HA config?

Next, how critical is it for this from the doc: (Step 8 - http://enterprise.arcgis.com/en/portal/10.5/administer/windows/configuring-a-highly-available-portal.htm)

Note:

Do not set the X-Forwarded-Host header for this URL.

Finally, per this thread, does Pro or desktop use this url too?

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JonathanQuinn — Fri, 06 Apr 2018 18:00:01 GMT

The communication goes through the URL configured for the privatePortalURL and it's the responsibility of the component creating the URL, (load balancer, for example), to check the health of the machines it's load balancing requests to make sure the request reaches a machine that is up.

So, if it isn't set prior to federating, it uses one of the portal machines. If that machine goes down, then your federation is broken.

If it is set prior to federatng, then Server will communicate to the Portal through the URL, and the URL will either load balance the requests to the two portals or only send the request to the active portal if one is down.

It's important as the presence of the X-Forwarded-Host header tells portal that the request should be sent back using host and context of the WebContextURL. If the privatePortalURL is the same as the WebContextURL, you won't see a problem. If it's different, though, you'll see issues.

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JTessier — Fri, 06 Apr 2018 18:07:09 GMT

Thanks Jonathan, anyway to change the Private Portal Url after the AGS site has already been federated? In a config file or registry somewhere on the ags servers?

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JTessier — Fri, 06 Apr 2018 18:18:20 GMT

Also, the doc specifically mentions this step for a hosted server, but I would now think based on your details above that it would apply to a non-hosted federated site as well, thus my next question below (came before this comment and replied incorrectly to full item).

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JonathanQuinn — Fri, 06 Apr 2018 18:51:38 GMT

We can update the documentation to indicate it's for all federated servers, including hosting server. Yes, under the Security page for the Server in the Admin API, you can update the privatePortalURL property within the JSON of the configuration. I would make sure you can reach the Sharing API in a browser through the URL you're going to use prior to updating it:

Ex.

<privatePortalURL>/sharing/rest == https://lb.domain.com:7443/arcgis/sharing/rest

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JTessier — Fri, 06 Apr 2018 19:13:35 GMT

Excellent, thanks Jonathan!

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

SebastianStey — Wed, 08 Aug 2018 13:28:09 GMT

Hi!

Publishing Web-Scenes (3D) I see the same behaviour as described above for Web-Layers ("Copy All Data" + "Feature").

What I see in 10.6:

Publishing a Web-Scene (3D) [works]

ArcGIS Pro tries to contact the hosting server via the administration URL several times
it fail each time (as the administration URL is not reachable from that client machine)
finally, publishing succeeds even though the client machine can't reach the hosting server's administration URL

So far, it looks like described above.
However, publishing a Web-Map (2D) looks different.

Publishing a Web-Map (2D) [fails]

ArcGIS Pro tries to contact the hosting server via the administration URL several times
it fail each time (as the administration URL is not reachable from that client machine)
finally, publishing fails - it will only work if administration URL is reachable from the client machine

Can we have ArcGIS Pro ignore that administration URL?

While publishing, we encounter one additional problem. When Portal WebAdaptor in IIS is configured to use Integrated Windows Authentication (to have single sign on):

publishing a Web-Map works (if administration URL is reachable from client machine)
publishing a Web-Scene fails. It works as soon as I turn off Integrated Windows Authentication

Is there a way to publish Web-Scenes while Integrated Windows Authentication is switchend on?

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

VishApte — Tue, 17 Sep 2019 01:07:49 GMT

Hi Jonathan,

Can you please elaborate on <privatePortalURL>/sharing/rest == https://lb.domain.com:7443/arcgis/sharing/rest

I have setup ArcGIS Enterprise 10.7.1 with privatePortalURL as https://dnsforportal.company.com:7443/arcgis and WebContextURL as https://portaldmz.company.com/gisportal and have restarted Portal service after. Portal machine has ssl certificate including root and intermediate matching dnsforportal.company.com and browsers seems to happy when accessing https://dnsforportal.company.com:7443/arcgis/p ortaladmin and does not give any SSL warning. However, if I browse to https://dnsforportal.company.com:7443/arcgis/sharing/rest, it redirects to https://portalsvr.domain.com:7443/arcgis/sharing/rest where portalsvr.domain.com is the FQDN of the portal server. Same for https://dnsforportal.company.com:7443/arcgis/home, redirects to https://portalsvr.domain.com:7443/arcgis/home . I would expect that because of the privatePortalURL property, portal's web server will stay on https://dnsforportal.company.com:7443/*

I am not sure X-Forwarded-Host setting is required in DNS as the documentation says not to set-it. Besides I am not sure how this can be set in DNS. Is anything else required to use DNS based url as privatePortalURL?

May be because of this redirect to FQDN, when I attempt a federation with a ArcGIS Server, server cannot register items with portal. https://dnsforportal.company.com:7443/arcgis/sharing/rest seem to be inaccessible to the ArcGIS Server.

Thanks,

Vish

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JonathanQuinn — Tue, 17 Sep 2019 18:14:31 GMT

Was it working prior to the restart? Try to set the system properties again and see if it still redirects. You don't need to make any changes, just go to Portaladmin > System > Properties > Update > Update Properties. Once Portal restarts, check if it redirects still. If it doesn't, restart Portal again and see if it starts redirecting. If it does, I'd suggest you contact Technical Support so they can take a look, but you have a workaround to just "update" the system properties without making any changes.

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

VishApte — Thu, 19 Sep 2019 01:52:39 GMT

Thanks for your reply Jonathan. But couldn't get it going.

I first federated without privatePortalURL property set. Federation between server and portal worked fine. I could see SampleWorldCities and other GP services in Portal under My Contents. Server admin showed ArcGIS_Portal as a authentication provider with portal properties showing portal machine's FQDN name and not DNS name. Everything looked as it should be.

I then unfederated the server using portaladmin. Unfederate was successful. Manually removed SampleWorldCities and other GP services in Portal under My Contents as these will be orphaned. Confirmed ArcGIS server has gone back to "GIS Server" as a security provider. Everything looked as it should be.

I then went to portal admin and added privatePortalURL property set to portal's https://dnsname.domain:7443/arcgis. Manually restarted Portal service after this, though I believe update of the portal property does it. Confirmed privatePortalURL is still set to DNS.

I then federated the server again with Portal. No error but the "status" glyph beside server admin url remained as "?" even after validate. Went to My Contents in Portal and found nothing there. Was expecting SampleWorldCities and other GP services in there. Went to ArcGIS Server Manager and found that Sharing icon was not available for the SampleWorldCities and other GP services. Went to server admin and found that server has ArcGIS_Portal as a authentication provider with portal properties showing DNS name for the portal and not FQDN name. Server and Portal log had nothing meaningful.

Restarted Portal and Server services. Still no sign of federation of services. ArcGIS Server still had ArcGIS Portal as authentication provider. Browsed to https://dnsname.domain:7443/arcgis/home Got redirected to https://servername.domain:7443/arcgis/home Browsed to https://dnsname.domain:7443/arcgis/portaladmin/ and this time no redirect. So somewhere Portal has not registered privatePortalURL.

Am I missing a step here?

Support ticked is logged. ArcGIS Enterprise 10.7.1 and all Windows 2016 Datacenter servers.

Cheers,

Vish

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

VishApte — Wed, 23 Oct 2019 05:27:56 GMT

Hi Jon,

We got it worked out. It seems that the privatePortalURL must be set first and then WebContextURL should be added. If we set both in one go, somehow, privatePortalURL doesn't get registered completely. We could repeat this in 3 environments. So the steps are;

1. Install SSL certificate on port 7443 that matches DNS name for the portal.

2. Change the default self signed certificate to above.

3. Set privatePortalURL to DNS based URL using portaladmin.

4. Test privatePortalURL based URL for Portal Home in a browser and confirm it does not redirect to a server name based URL.

5. Configure Web Adaptor for Portal.

7. Add WebContextURL that matches Web Adaptor using portaladmin

8. Test Portal home via WebContextURL and via privatePortalURL and confirm it works without redirection.

9. Perform federation.

Not sure if this is as designed or a bug.

Cheers,

Vish

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

Anonymous User — Wed, 24 Jun 2020 06:06:06 GMT

Hi Vish,

Could you please help me with this information... We have high available setup with 2 portal machines

Your Comment above

"We have setup ArcGIS Enterprise 10.7.1 with privatePortalURL as https://dnsforportal.company.com:7443/arcgis and WebContextURL as https://portaldmz.company.com/gisportal and have restarted Portal service after"

Questions??

1) What does this url in your load balancer points to https://dnsforportal.company.com:7443/arcgis

Does it point to 7443 port of high available portal machines or it points to 443 port of arcgis webadaptor of portal machines??

In our case privateportalurl points on 7443 ports as shown? Is it right or we should point it to webadaptor instead with 443 port?

2) What does this url in your load balancer points to https://portaldmz.company.com/gisportal

Does it point to 7443 port of high available portal machines or it points to 443 port of webadaptor of portal machines??

If in both cases above you're routing requests to webadaptor of highly available setup then can we use same url for both when we only have single load balancer ????

Please help we are very confused with these 2 urls

Saurabh

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

JonathanQuinn — Wed, 24 Jun 2020 16:06:06 GMT

There are a variety of different deployment scenarios for an HA portal. The WebContextURL will always be set to 443, but the privatePortalURL can be set to either 443 or 7443, or any other port, in reality. All that matters is that it can send traffic to the backend portal machines, and check the health of those machines. Our cloudformation templates set the WebContextURL and the privatePortalURL to the same URLs. On the other hand, if you configure your environment with Windows Authentication, that would be set at the web adaptor tier. In this case, the privatePortalURL can't be set to a URL that hits the web adaptors, because it can't authentication against the 401 challenge.

Deployment scenarios for a highly available ArcGIS Enterprise—Portal for ArcGIS (10.8) | Documentation for ArcGIS Ente…

Ultimately, your decision to use the same URL or different URL can come down to:

1) Security - do you need to bypass the 401 challenge at the web tier

2) Network traffic - do you mind if internal traffic between Server and Portal goes through the same endpoint as client side traffic?

There is no right answer. Your requirements will dictate what your topology looks like.

Re: Portal privatePortalUrl and Federation Admin Url from Cloud Builder deployment

VishApte — Wed, 24 Jun 2020 23:30:18 GMT

Hi Saurabh,

Re Questions

1) What does this url in your load balancer points to https://dnsforportal.company.com:7443/arcgis

Does it point to 7443 port of high available portal machines or it points to 443 port of arcgis webadaptor of portal machines??

In my case, we use 7443 based URL. The load balancer dnsforportal.company.com:7443 redirected to HA portal's port 7443. I short, load balancer's 7443 port to portal server's 7443 port redirect. As Jon mentioned, you could base it on port 443 or any other port of the load balancer as long as redirect configuration on LB uses portal server's 7443 port. From my understanding, privatePortalURL is never used by end-users, it is used by ArcGIS server to communicate to portal (and vice versa). Hence it cannot negotiate 401 challenge as Jon mentioned.

2) What does this url in your load balancer points to https://portaldmz.company.com/gisportal

Does it point to 7443 port of high available portal machines or it points to 443 port of webadaptor of portal machines??

https://portaldmz.company.com/gisportalwill typically redirect to 443 port of web adaptor if you have it in front of portal. If you don't have web adaptor (best practice says we should), it will point to port 7443 of the portal server.

Hope this helps.

Cheers,

Vish