topic Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token in ArcGIS Enterprise Portal Questions

Portal for ArcGIS Publish Exception - Could not Decrypt Token

EricMahaffey1 — Wed, 07 Dec 2016 15:20:31 GMT

Has anyone had to troubleshoot an error when publishing to Portal for ArcGIS that reads: Publish exception 'Could not decrypt token. Token may not be valid'

I see an entry on both Portal and ArcGIS Server logs when trying to publish a feature service within Portal

Any advice would be much appreciated.

Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token

JonathanQuinn — Wed, 07 Dec 2016 16:46:21 GMT

What version are you using? Can you validate the federated Server?

Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token

EricMahaffey1 — Wed, 07 Dec 2016 17:15:18 GMT

Hi Jonathan. We're running v10.3.1 (both Portal and ArcGIS Server), and have configured a single server with dual web adaptors. The instance of ArcGIS Server validates, and is also the hosting server.

Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token

EricMahaffey1 — Thu, 08 Dec 2016 20:42:37 GMT

Another thing that's puzzling me is that I'm not using Portal's built in identity store token based authentication. I'm using Windows Active Directory and PKI to secure access. So why is the error referencing an issue with token decryption?

Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token

JonathanQuinn — Thu, 08 Dec 2016 21:29:34 GMT

Internally, the communication between Server and Portal will still use tokens. Can you try to login to the Server Admin API using a portal token? Go to the Admin API and then instead of using the PSA, follow the instructions below that to use a Portal token instead.

Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token

EricMahaffey1 — Fri, 09 Dec 2016 13:45:43 GMT

Thanks for the suggestion Jonathan. I didn't see any instructions in you message. Is this what you meant?

Accessing the Administrator Directory on a federated server—Portal for ArcGIS (10.3 and 10.3.1) | ArcGIS for Server

I'm using Windows Active Directory Authentication with PKI for both ArcGIS Server and Portal. When I hit the ArcGIS Administrator Directory the browser prompts me to select PKI certficate and PIN in order to authenticate. I can't find an option to login using a Portal Token. The admin page won't even let me "Signout".

Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token

JonathanQuinn — Tue, 13 Dec 2016 18:36:16 GMT

Sorry for the late reply. Does it matter if you go through 6443, or is that what you're doing already? I think it may be best to reach out to Technical Support so they can take a closer look at the setup and see what could be wrong.

Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token

EricMahaffey1 — Tue, 13 Dec 2016 20:00:17 GMT

I ended up figuring out the problem. It's a long story so I'll try to explain all that I found and resolved. It goes back to your original question of whether or not I could validate the federated server. Apparently the instance of ArcGIS Server was not completely federated with Portal in my case. Even though I could validate it through the Portal Home page ( i.e. /home/organization.html and selecting the "Servers" tab).

(Pardon the rambled dump of information that is about to follow, but I pulled it from my notes which aren’t written as a well-developed story.) I think it stems back to some issues I was having with getting certificates loaded properly on the server. At that time I was getting an error "Invalid SSL certificate found. PKIX path building failed..... ". We ended up having to enable client certificates using a NETSH command (our resident server admin took care of it so I don't know all the details). After which federating through the Portal Home page still wasn't working, so I dug into it a bit more. In the Portal logs there was a 403 "not accessible" error associated with a link to the ArcGIS Portal Directory (i.e. /sharing/portals/self/servers/register). On a whim I tried navigating to that link within a browser. I noticed that it gives all of the same options to federate a server as the Portal Home page did. I entered the information, checked "is hosted" to true, and clicked "register". When I went back to the Portal Home federation page the server was now federated and listed as the hosting server. Clicking "Validate Server" verified that all appeared to be configured properly. Well when I tried a test in portal (add a zipped shape file and publish as feature layer), another error occurred. This time it was “Failed to publish item…….exception. Hostname in certificate didn’t match”. To get past this I had to export the certificate used to configure https site bindings within IIS (root certificate with the private key), then import the certificate through the ArcGIS Server Administrator Directory (Home>machines>”machine name”>sslcertificates>importexistingservercertificate). After that I was able to finish configuring the server to use the new certificate for SSL. This finally brings us to the error that I originally posted. The site wouldn’t publish a feature layer (Failed to publish item….. .zip …… could not decrypt token. Token may not be valid”. While doing some digging I found out that it’s possible to import all services within a federated server using the ArcGIS Server Administrator Directory (Home>Services>Supported Operations>federate). However, this wasn’t an option on my page. This is what lead me to believe that the server wasn’t completely federated. So I then unregistered the server federation through the ArcGIS Portal Directory (REST endpoint). Then going back to the Portal Home page I was finally able to federate the server properly. Testing proved that a feature layer could now be published.

Again apologies to all for the long winded info dump. I just wanted to throw it out there in case anyone else runs into the same problem.

Re: Portal for ArcGIS Publish Exception - Could not Decrypt Token

JohnPlunkett — Mon, 08 Jan 2018 02:21:27 GMT

Thanks had the same issue on 10.6 pre-release unfederated and federated fixed it