Apps in App Launcher asking for users to Log in (ArcGIS Enterprise Portal 11.1)

Question

Hello - our ArcGIS Enterprise 11.1 deployment has started asking users to log in when they access apps from the app launcher - so if a user is logged into the Portal, and then goes to access Dashboards, Field Maps, Experience Builder etc through the app launcher, they are challenged for their credentials again.

This is a new behaviour - anyone have any idea why this might be happening?

Note this is universal - for users with all license types.  Is there something I'm missing?

alexgeer · Answer

Hi Jeff and Timo - thanks for replying!  Your comments definitely helped us out in our troubleshooting.  Now, I'm not the technical person (anymore) so apologies if I don't explain this well.

We're actually working with two separate clients with very similar deployment patterns - and we noticed this actually happened to both.. (we're still in build mode for both - not in prod yet).  What had we done or changed that had actually been done for both clients?

The only thing we'd done consistently was to implement the recommendations of the ArcGIS Enterprise Hardening Guide.

The team has identified that one of the changes - specifically enabling this setting:

So whatever this is doing (as I said not technical person!) is causing us to be prompted again.  We have unchecked the box on test environment to test, and the usual expected behaviour of not being prompted again is back.  So, this will end up being a conversation with our client about their preference - security or user experience!

TimoT · Answer

I had this occur once in 11.1. I do not utilise Web Adaptors in my deployment.

Every time a new tab was opened within an existing browser session, you would be prompted to sign in again regardless of user type or choice of web browser. This includes apps in App Launcher as they open in a new tab.

Further investigation found that logins weren't persisting over new tabs only when using the load balancer Portal URL, but login sessions would persist over a new tab when using port 7443 Portal URLs.

In the end, Portal machine restart resolved the issue. I didn't get to the bottom of it, but it appeared to be some temporary issue between Portal's cookies and our load balancer.

Timo

JeffSmith · Answer

If your deployment is on Windows, have you installed the Web Adaptor Reliability Patch?  One of the issues addressed in the patch is related to cookies and sounds similar to the behavior you are seeing.

Most of those apps rely on the esri_aopc cookie for authentication.  Do you see that cookie in your browser developer tools?