nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Internal web adaptor with Windows authentication and one without in DMZ pointing to one Portal ?

MarcBate

We are having problems getting two web adaptors working with our Enterprise Portal and want to confirm if what we want to do is even possible. One web adaptor inside the firewall is set to use Windows authentication and we have the portal identity store configured to automatically create accounts using your Windows login. It works. The problem is when we wanted to put another web adaptor in our DMZ to allow external users such as those using Field Maps. We are using the same URL for both of these web adaptors which resolves correctly depending if you are inside the firewall that has a different DNS server.

When accessing the DMZ web adaptor, there are 403 errors where dojo.js cannot GET other resource files and the web page is blank. When trying to open the resources that had the 403 error, they come up in the browser.

Any ideas on how to get this working or if this is even possible?

Find more posts tagged with

Accepted answers

All comments

MarcBate

We decided to start fresh with the 9.1 release, and it works. We have anonymous IIS access on the DMZ web adaptor and windows authentication with automatic account creation on the internal web adaptor. I'm leaning towards naming and DNS issues being to blame, or having different IIS on the DMZ and internal web adaptor servers initially when we tried with 9.0

MarcBate

Here is the list of requests from the viewer.html. When clicking on any of the 403 resources, they appear a new browser tab so they can be accessed. I'm not sure what headers can be added and to which IIS (DMZ or internal)..

MarcBate

We were able to sign in through the DMZ firewall with Field Maps.

However, we still get 403 errors when accessing the enterprise site through the DMZ in a browser. I tried going to /arcgis/home/webmap/viewer.html and it loads, but several css and js files it uses are throwing 403 errors and the browser is empty. I feel we have to be close to getting this working

JonathanQuinn

Have you inspected the traffic for differences in headers or other information to see if the presence of a header, or value set for one, is causing the 403?

MarcBate

That's correct.

JonathanQuinn

So when the request is set to the home application, for example, and the home application is making requests to dojo.js and other pages, the response is a 403. But if you take that same request on the same browser, (new tab, for example), the request returns a 200?

ABishop

According to this thread from 2019, could possibly be the security configuration or the ports.

https://community.esri.com/t5/arcgis-enterprise-questions/login-link-fails-when-accessed-from-web-adaptor/td-p/149270

MarcBate

Thanks. We saw that article, but still have the specific question if it is possible to have one web adaptor using Windows Authentication for the IIS website inside the firewall and portal configured to use Windows identity store, and the other in the DMZ using anonymous authentication in IIS.

ABishop

I found this information for installing multiple web adapters at 10.9 (IIS)

https://enterprise.arcgis.com/en/web-adaptor/latest/install/iis/install-multiple-arcgis-web-adaptors-iis.htm

MarcBate

10.9

ABishop

Hello Marc,

What version of Enterprise Portal?

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.