Print secure services using Web Tier Authentication

[RavinHasseea1]

Hi I am using Portal 10.4 and have configured the portal printing tools to an ArcGIS 10.3.1 printing service. We have IWA set up for both the portal and ArcGIS Server. We have also set up trusted servers in portal.

When using the default print widget in portal, I am getting the error message "Error, try again"

In ArcGIS Server log, I get

"Error executing tool. Export Web Map Task Job ID: j150b832f961f4960833c46084e3ba118 : Layer "My Map": Unable to connect to map server at https://servername/arcgis/rest/services/Basemaps/OSBasemaps/MapServer. Failed to execute (Export Web Map). Failed to execute (Export Web Map Task)."

I have also tried running the print service from its rest end point. It comes up with the same error message.

We have tried the default ArcGIS Server printing services and also a custom service with embedded credentials (Printing maps that contain secured services—Documentation (10.3 and 10.3.1) | ArcGIS for Server ). All the services are currently accessible to everyone.

Any suggestions ?

[MichaelRobb]

Are you using a Proxy?

[RavinHasseea1]

No we are simply using the print widget available in Web App Builder in portal and configure the utility services to AGS printing service.

[MichaelRobb]

Hi Ravin,

It should all work.  I have a document with explicit details, I cant post it, but can provide snippets and direction.

Summary:

Create a custom Geoprocessing Print service which holds Preconfigured secure connections which are set using a User name that has access to ALL Secure Services to allow secure services print through using Windows Authentication / Web-Tier

In IIS - WIndows Authentication enabled on the ArcGIS Server Web Adaptor.

Have Web-Tier authentication enabled on ArcGIS Server (using manager or admin)

1. Create a new Toolbox under My Toolboxes using ArcCatalog
2. Copy Export Web Map GP Tool from System Toolbox >> Server Tools >> Printing TO the newly created toolbox.
3. Create new AGS Connection

This connection will be a User that will have access to ALL ArcGIS Server Services that are locked.

This connection MUST be a USER type connection with ArcGIS Server

4.     Name the AGS Connection Appropriately

5.     Right t click on new GP >> Edit

6.     Add the newly created AGS Connection File

7.     Validate the URL and AGS Connection

8.     Repeat steps for multiple servers (in this case, I do only 1 as we have traffic go through a NLB)

9.     Open an ArcMap Session and Add the custom toolbox

10.  Add some data to the mapdoc (which the server has visibility to - registered)

11. Double click the custom Print GP

12. Double click the custom Print GP

13.  In the results dialog, right click on the successful print and share as >> Geoprocessing service

14. Publish the service

15. name the service

16. Configure the custom GP Service in the service editor

     (e.g. Asynchronous execution mode) custom templates etc...

17.Analyze

18. Publish

When you create the custom Geoprocessor, the connection used MUST be a USER type connection with ArcGIS Server, not Publisher or Admin.  Please ensure this.

[simoxu]

Hi Michael, thanks for the detailed steps, It works!

[SrikanthKusam1]

I tried to publish the GP Service to ArcGIS Server 10.5.1 using above steps, But ArcMap crashing while publishing.

[EricJackson1]

Thanks!  This worked for me too with a fresh setup of 10.5.1, Portal, Federated Server and Data Store Server all in separate boxes. 

Odd thing was the out of the box print service worked with map services on the federated server, but not Hosted feature services from the federated server/data store server.  All of the services were shared to Everyone.  

Eric

[arunepuri1]

Hi Robb,

How we can mimic the same with ArcGIS pro. As pro "Export Web Map" is script tool, when right click => edit clicked=> it's showing python script. Is there any code block needs to be included to include ArcGIS user connection with credentials.

We are using default utility print service in Portal web app builder application=> print widget

Printing is working fine for external (ESRI) or other sample services. when we are using internal ArcGIS Server hosted services we are getting below error message in console and ArcGIS Server log. 

{"error":{"code":400,"extendedCode":-2147467261,"message":"Unable to complete operation.","details":["Error executing tool. Export Web Map Task : Failed to create layer from service at https://XXXXXXXXXXXXXXx/_Map/MapServer.\nFailed to create layer from service at https://XXXXXXXXXXXX/plate/FeatureServer/2.\nFailed to execute (Export Web Map).\nFailed to execute (Export Web Map Task)."]}}

Thanks in Advance.

Thanks,

Arun E

[JonathanQuinn]

Is your ArcGIS Server Windows Service running as a domain user that has access to the services?  That account should be the one actually making the request to the services within the web app, and since you're using IWA, see what account Server is running as.  As a test, you can try to run it as your own account and then try to print, as it seems you have access to the services.

[RavinHasseea1]

My ArcGIS Server service is running as a domain user with access to the services. I have also tried my own account, but it makes no difference.