topic Re: Portal Login Issues or Limitations? in ArcGIS Enterprise Portal Questions

Portal Login Issues or Limitations?

AdamRepsher — Wed, 11 May 2016 11:26:20 GMT

Hello All,

I am trying to set up Portal to accept both Active Directory and Portal Authentication users. The problem occurs when I try to log in as a Portal user. I can't do it. I am logged into my machine through Active Directory, but when I browse to the portal homepage, I have no option to log out. I can't get an interface to log in.

I am afraid that there will be an OR in this statement:

You either set up an Active Directory, automatic login environment, OR, an Active Directory/Portal Authenticated set up where you must manually sign in every time with your credentials.

Am I correct, or is there a special way to set up a way to log in with a Portal Authenticated User while set up for AD auto-login?

Thank you,

--Adam

Re: Portal Login Issues or Limitations?

JacobBoyle — Wed, 18 May 2016 19:44:31 GMT

I think to get the duel login option, you have to use ADFS/SAML, Otherwise it just passes the creds from IWA.

Re: Portal Login Issues or Limitations?

RandallWilliams — Wed, 18 May 2016 19:55:28 GMT

@Jacob Boyle above is correct. When you use IWA the assumption is that you're going to want Single Sign-On. SAML is the way to go in this case.

Re: Portal Login Issues or Limitations?

AdamRepsher — Wed, 25 May 2016 16:30:57 GMT

Update:

I talked to Matt at Esri Support. He explained that I could set up another Web Adaptor specifically for Anonymous and Portal based users - call that "/open". That adaptor would just have anonymous access enabled. The adaptor for Single Sign-On is set up for Windows Authentication only - call that "/portal"

Give the anonymous and portal based users the https://company.com/open link.

Give the Single Sign-On users the https://company.com/portal link.

Thank you all!

--Adam

Re: Portal Login Issues or Limitations?

PaulDavidson1 — Fri, 27 May 2016 17:33:51 GMT

Hey Adam:

I'm a bit confused by this. It's my understanding that you can only install & setup one Web Adapter (WA) per Portal instance.

Plus the WA for AGServer, which can have multiple WAs (one for normal usage and one for admin for instance.)

So while AGS can have multiple WAs, I though Portal could only have the one.

Have you been able to install a second one for Anon access?

Re: Portal Login Issues or Limitations?

JacobBoyle — Tue, 31 May 2016 14:03:16 GMT

I agree with Paul.

AGS can also only have multiple WA's if you do not federate. Unless something has changed, portal cannot be configured with Multiple WA's.

Derek Law, your thoughts?

Re: Portal Login Issues or Limitations?

RandallWilliams — Tue, 31 May 2016 15:01:40 GMT

Yup. The process of registering a Web Adaptor with a Portal will fail if another web adaptor has been previously registered. The registration screen will throw an error indicating the issue. The Server Web Adaptor must set at anonymous if federating through that web adaptor.

Re: Portal Login Issues or Limitations?

AdamRepsher — Tue, 31 May 2016 17:53:45 GMT

Everyone contributing to this thread:

This has nothing to do with the AGS Web Adaptor and Federation. That WA is already set up and working with anonymous login specifically for AGS.

This is for users accessing Portal.

Configure multiple ArcGIS Web Adaptors -- (notice the "s" at the end of the word "Adaptor")

After seeing that link, I just needed a little help provided by Esri Support.

I now have two web adaptors for incoming Portal users. One for Single Sign-On and the other for Portal Based accounts/anonymous users. It works - really, it does.

Re: Portal Login Issues or Limitations?

PaulDavidson1 — Tue, 31 May 2016 18:02:29 GMT

Very interesting... and useful

Thanks Adam

Looking at that link, this must be new in 10.4 because the "other versions" link at 10.3 is greyed out.

Re: Portal Login Issues or Limitations?

RandallWilliams — Tue, 31 May 2016 18:04:48 GMT

Whelp, color me schooled!

Re: Portal Login Issues or Limitations?

AdamRepsher — Tue, 31 May 2016 18:28:04 GMT

No - really... I just got lucky in that this is the first version that I have used when implementing Portal. This setup has given me the biggest schooling in my AGS career! I still don't completely grasp the relationships to each server in my setup with the Domain Certificate configured with the WA server, but with a friendly URL....

Also - Randall - You may want to look over the docs on federation with AGS again too - since this is more toward the point that I think you were trying to get across. I have a setup that is "like" the setup documented in the Spatiotemporal Big Data Store Tutorial. It has two AGS installs - one for WebGIS and the other for RealTime GeoEvent Extension use. Both of mine are federated with Portal - but only one is set as the "Hosting Server" (WebGIS).

Re: Portal Login Issues or Limitations?

JacobBoyle — Tue, 31 May 2016 19:42:26 GMT

All I know is that I've learned way more about SSL and security than I ever thought I would as a geographer.

Re: Portal Login Issues or Limitations?

JacobBoyle — Tue, 31 May 2016 20:06:49 GMT

That's a really great option going forward, I can see all kinds on scenarios where you'd want to have a secure external WA using IWA and an internal one for viewing only.

Kudos to Esri for allowing this model.

Re: Portal Login Issues or Limitations?

PaulDavidson1 — Tue, 31 May 2016 20:13:41 GMT

Absolutely, +1

Re: Portal Login Issues or Limitations?

DerekLaw — Wed, 08 Jun 2016 17:18:52 GMT

Hi Jacob,

Apologies for the late reply, I had to check into this item with some folks on the Portal Dev team.

Portal for ArcGIS is only designed to work with one Web Adaptor as an entry point. In some cases, such as deploying Portal high availability, you could use multiple Web Adaptors - but you would need to have a 3rd party load balancer in front of this deployment. FYI, help topic: Configuring a highly available portal—Portal for ArcGIS (10.4.1) | ArcGIS for Server

@Adam: I know you've said that you got your deployment working properly, but I am not certain that is the case. I suggest you please check and verify that everything is working correctly, as I am told this is not a supported deployment.

Regarding your reference to the 'Web Adaptor" help topic (where you note the 's') - we've found some inconsistencies and are working to correct its content to make it more clear and concise.

Hope this helps,

Re: Portal Login Issues or Limitations?

DanMallett — Fri, 03 Feb 2017 19:23:34 GMT

Adam, I want to believe that you have 2 web adaptors working (one anonymous and one with IWA) but I can't see how this is possible. When I go to install the 2nd one I get:

So I could setup a reverse proxy and then add another web adaptor but the reverse proxy is going to load balance between the 2 web adaptors (for high availability purpose). Unless you can add multiple WebContextURLs (e.g. /open and /iwa) I don't know how you accomplished this.

Any chance you could provide some more details?

Re: Portal Login Issues or Limitations?

AdamRepsher — Mon, 06 Feb 2017 12:30:10 GMT

Dan,

Actually, I cannot. Since this thread was active, I am sad to say that many of the features have failed and are not currently working. There were a few bugs found in the software, but honestly, I am convinced now that the way we set this up is the main reason for the failure. I will be talking to esri very soon about implementing 10.5 along with anonymous access to publicly available content.

There are instructions on adding multiple Web Adaptors via multiple Web URLs. The two that I have working right now are /arcgis and /realtime, like in the link I mentioned above: https://community.esri.com/external-link.jspa?url=http%3A%2F%2Fwww.arcgis.com%2Fhome%2Fitem.html%3Fid%3D870b1bf0ad17472497b… .

Re: Portal Login Issues or Limitations?

JonathanQuinn — Tue, 07 Feb 2017 21:58:09 GMT

Multiple web adaptors for Portal will only work if you have something in front of the web adaptors load balancing traffic to them.

Ex.

It's only designed to allow for redundancy at the web tier level, not to have two entry points into the portal. If multiple entry points were possible, the problem is that when an item is created, the URL for the item is built using the URL (https://myportal.domain.com/secure/...) and will not update depending on if you access the portal through a different URL, (https://myportal.domain.com/open/...). If you only have people that can sign into the portal creating content, (they will likely use the "secure" entry point), then those items will only reference the "secure" URL, and nobody with access to the "open" URL can reach the items, as they'd require authentication or require access to some internal web adaptor or reverse proxy. The only way to achieve anonymous and single sign on experiences is, as mentioned, using SAML

Re: Portal Login Issues or Limitations?

AdamRepsher — Thu, 16 Feb 2017 14:30:11 GMT

Just for clarification, I am not using multiple web adaptors for one portal installation, I am using one WA for Portal, one WA for AGS/GeoEvent and one WA for the non-GeoEvent AGS (federated with portal).

Granted, my whole installation is going to change soon. Sorry for the mess that this thread may have started.