webgisdr backup failed with "Unable to generate token"

[JonathanBailey]

Attempting to do a site backup using webgisdr:

webgisdr --export --file c:\propfiles\mywebgis.properties

I'm getting the following error:

==================================================
Starting the WebGIS DR utility.
==================================================

Unable to generate token. Check the the WebGIS DR utility logs and the portal logs for more information.

Exiting the WebGIS DR utility.

Unfortunately, the logs don't provide any additional information.

Using version 10.6.1.

[JonathanQuinn · Accepted solution]

If the PORTAL_ADMIN_URL you're using is set to the 7443 portal, put in your browser, and append /sharing/rest, does the URL redirect anywhere?

Ex.

https://portal.domain.com:7443/arcgis/sharing/rest

If it redirects, use the URL it redirects to.

If you're not using the 7443 URL, is the URL configured with Windows Authentication? You can enable more verbose logging within the logback.xml file.

[JonathanBailey]

Hi Jonathan,

Thanks, that helped.First, I changed the URL to the redirected URL, then I got an error that said that 7443 was an invalid port. Then, I changed the logging level in logback.xml file, and the next error was that my SHARED_LOCATION was inaccessible. I fixed a typo in that, and now it can't access my Data Store URL.

Past the initial roadblock thanks to your help.

Jon.

[JonathanQuinn]

Hm, 7443 is definitely a valid port to use. Changing the log level shouldn't fix that problem.

Are your machines on different domains? Can you reach the Data Store Configuration Wizard from your Portal machine?

Ex.

https://ds.domain.com:2443/arcgis/datastore

Could be a firewall issue.

[JonathanBailey]

That was it -- we hadn't opened port 2443. Looks like it's running now. About how long should it spin for before it's complete?

[JonathanQuinn]

Depends on how much content you have. With a new install, no custom content, it'll take under 20 minutes. Portal takes the longest to backup.

[JoeHershman]

I have this same issue in 10.5 trying to do a backup.

If I use the  domain.com:7443/arcgis I get the 'Unable to generate token' error.  I have tried with our siteadmin user and with a administrator in the Windows identity store.

If I try the domain.com:7443/arcgis/sharing/rest it redirects to the internal url (which is not a public Url so does not have a cert).  If I use this Url I get an ugly java error (I assume because no cert)

If I try the domain.com/portal Url without 7443 I also get an ugly java error.

I have changed logging to DEBUG level and still have nothing in the logs associated to the issue

Thanks

-Joe

[JonathanQuinn]

If you sign into Portaladmin, go to the Machines API, grab the machine listed there and then use that in place of domain.com, (ex. https://portal.domain.com:7443/arcgis), what do you get? Can you expand on what you mean when you say "it doesn't have a cert"? Do you mean it's not a certificate from a root certificate authority, (such as your domain certificate authority or a CA like Digicert or Verisign)? The DR tool can connect to a Portal URL that uses a self-signed certificate.

The only time I've seen a Java error is when the URL you're trying to use goes through IWA. The DR tool doesn't support connecting directly to IWA secured URLs until 10.7, but the internal machine name should work fine. If the Services URL is secured with IWA, that is going to be a problem as well.

[JoeHershman]

Looks like the issue was the IWA setup.  Turned IWA off in IIS and also used the https://machine.loc:7443/arcgis instead of the https://domainname.domain.com:7443/arcgis and it is processing as I type...

Thanks

-Joe