Help finding a mysterious Portal service?

[bsklafloh]

Hi everyone, as the title suggests, we have a warning in our Portal logs almost every ten minutes for a sign in error, for a service we cannot find in our Portal. Does anyone have any suggestions on where to look? Thank you! 

[AJohnson_HFHI]

Are you able to share what the error message is? (hiding sensitive information of course)

When I've seen error messages like that, typically it means there is an application or map using a service that no longer exists, hence ArcGIS Server generating an error like that. However, if it's on a consistent check every 10 minute interval, it could be something else.

[bsklafloh]

Hello, yes, please see this screenshot. It's not on a consistent check, but it is happening constantly.

[AJohnson_HFHI]

@bsklafloh if this is related to a service that you can't find, it could be related to a service that was set as a Secured Service where these credentials were stored. It could be that this service was deleted but at some point was used in an ArcGIS Application like Dashboards, Experience Builder, etc. Then when that application loads, it's trying to access the secured service and generating that sign in error.

I would look to see if there are any widely used apps that are requesting to sign in when initially loading.

[AJohnson_HFHI]

.

[CalvinHarmin]

Did you ever set up any external application/integration that previously authenticated with an AppID/secret? Maybe someone with privileges to create a new 'Application' under their user account attempted to set something up, had trouble, removed the application in Portal, but the <external thing> is still trying to connect?

I wonder if there is nothing preventing any rando/service on the internet from attempting to authenticate with your Portal if it's exposed to the internet.

I had a case in particular where an integration with our GIS through a secured feature service required us to create an AppID/secret for use by their cloud-based web config menu. At some point, something broke, and although it still requires us to enter the AppID, the 'actual' authentication happens via a popup window for Portal login in order to get the system to see the feature service. Before figuring out the method to get the popup login to show up, we would get exactly this format of login error showing the AppID as the 'username' everytime it tried to connect. 

I'm curious about this: 

a sign in error, for a service we cannot find in our Portal

Are you saying you can see that this is trying to access a particular service? Or are you just saying you don't recognize whatever is shown as the 'username'? At least in my case, the errors you are seeing are 'normal' generic login warnings. 

lol @ my poor user trying to remember his credentials

[GIS-Chris]

Hi @bsklafloh
This sounds an awfull lot like the problem described here. You can see if that's the case by running the "describeDatastore.bat" on the Data Store machine. If the Portal URL is missing in one of youre stores there's your culprit.

Alternatively I have also seen such behaviour if you set up your system using Powershell DSC. If that is the case make sure you set the DSC Configuration Mode to "ApplyOnly" instead of the default "ApplyAndMonitor".