nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

ArcGIS Server 10.1 with Forest with Multiple Domains

dimesv

Hi,

Is it possible to configure ArcGIS Server for 10.1 with AD authentication in a organization with a forest made of multiple domains?
If so, is there any help guide on how to accomplish that?

Thanks,
Jose

Find more posts tagged with

Accepted answers

All comments

RandallWilliams

That's correct. The domains need to be in the same forest, and you'll need to update the security config JSON to point to your global catalog server.

LakshmananVenkatesan

Hi Folks,

Sorry for late into the party, does any one has resolved this issue or has any documentation on this?

Even at 10.4 - It seems if domains (A and in different forest ArcGIS server does not support this config.

Lynchburg_GISDivision

We are also looking into ADLDS as an option. If anyone can provide details and additional information, we'd truly appreciate it!

JoshuaDalton

Jose, I'm not a domain admin, and I'm not sure how this nested group you mention would be configured. Do you recall how you laid this out and can you explain further?

JoshuaDalton

Matej, were you able to deploy AD LDS to resolve this issue? If so, can you explain how you went about configuring ad-lds and some instructions that helped you do so?

MatejVrtich1

Hi Justin,

Thank you for the tip using the AD LDS.
As I understand this, the AD LDS will be the central repository of users and groups which will be replicated from Domain A and Domain B. ArcGIS for Server will use the AD LDS as the identity provider.

Using this AD LDS, do you think it should be possible to use the Integrated Windows Authentication instead of Token authentication to authenticate users of ArcGIS for Server?

Thanks,
Matej

JustinRodriguez

Hi Justin,

Sorry for the delay but I was gathering more information about the underlying configuration.

The configuration is as follows:
Domain A and Domain B are not in the same domain forest.
Eeach domain serves as a global catalog for themselves.
There is one way selective trust between Domain A and Domain B.

Is there any way how to use this configuration with ArcGIS for Server?

Thanks,
Matej

Hello Matej,
Unfortunately our product requires the Domain Controllers to be Global Catalog Servers of each other. If this is not done, our Software cannot support this configuration.

With that being said, there is a Microsoft Domain Tool that may allow you to get around this issue.. The tool is call ADLDS. This workflow would not be supportable by ESRI Tech Support, but I know that some clients have successfully used it to correct the issue in an environment with two way or one way trusts. I hope that helps you. Take care-

Justin Rodriguez

MatejVrtich1

Hi Justin,

Sorry for the delay but I was gathering more information about the underlying configuration.

The configuration is as follows:
Domain A and Domain B are not in the same domain forest.
Eeach domain serves as a global catalog for themselves.
There is one way selective trust between Domain A and Domain B.

Is there any way how to use this configuration with ArcGIS for Server?

Thanks,
Matej

JustinRodriguez

Thank you for the reply,
Based on your description, there could be a couple of problems going on here.

1. Can you just grant a security group from Domain B privileges directly from ArcGIS for Server? From an ArcGIS Security standpoint, there shouldn't be any need to nest security groups the way you are doing it (I understand there might be other reasons though). It would be an excellent test.

2. Is your Domain Controller for Domain A a global catalog server for Domain B? This would be a requirement as well.

-Thank you very much

Justin R

Hi Justin,

Yes, we configured ArcGIS Server to use the AGSMembershipProvider.AGSADMembershipProvider and AGSMembershipProvider.AGSADRoleProvider according the web help.
However, having done that, we still cannot login to ArcGIS Server using credentials from the second domain.

Let me describe our configuration.
We have AGS running in domain A.
Users from domain A can login to ArcGIS Server (using either Windows authentication or the membership and role providers mentioned above).
We have domain B and we need to allow users from domain B to login to ArcGIS Server.
So we created group A in domain A with nested group B from domain B.
Users from domain B which need access to ArcGIS Server are members of group B which is member of group A.
Using this configuration, users from domain B still cannot login to ArcGIS Server.

Thanks,
Matej

MatejVrtich1

Hi Justin,

Yes, we configured ArcGIS Server to use the AGSMembershipProvider.AGSADMembershipProvider and AGSMembershipProvider.AGSADRoleProvider according the web help.
However, having done that, we still cannot login to ArcGIS Server using credentials from the second domain.

Let me describe our configuration.
We have AGS running in domain A.
Users from domain A can login to ArcGIS Server (using either Windows authentication or the membership and role providers mentioned above).
We have domain B and we need to allow users from domain B to login to ArcGIS Server.
So we created group A in domain A with nested group B from domain B.
Users from domain B which need access to ArcGIS Server are members of group B which is member of group A.
Using this configuration, users from domain B still cannot login to ArcGIS Server.

Thanks,
Matej

JustinRodriguez

Hello Matej,
Have you checked out this web help?

Using nested groups in a Windows Active Directory identity store
http://resources.arcgis.com/en/help/main/10.2/index.html#/Using_nested_groups_in_a_Windows_Active_Directory_identity_store/01540000067t000000/

Thanks-
Justin

Hi,

We have ArcGIS Server 10.2.1 now and it should support nested groups and domain forest since version 10.2.

We have tried the configuration with nested groups, but did not succeed.
What is the recommended configuration to allow logins to ArcGIS Server 10.2.1 from multiple domains?

Thanks,
Matej

MatejVrtich1

Hi,

We have ArcGIS Server 10.2.1 now and it should support nested groups and domain forest since version 10.2.

We have tried the configuration with nested groups, but did not succeed.
What is the recommended configuration to allow logins to ArcGIS Server 10.2.1 from multiple domains?

Thanks,
Matej

JustinRodriguez

I don't think it works as nested. I tried to add domain local group into Administrator role type, it didn't work. It didn't populate Role Members if you add a domain local group. but it works if it is global group. (all in Windows)

You can make this work, but the solutions are NOT SUPPORTED by ESRI.

1. For Domains that are 2003 and before, Microsoft ADAM
2. For Domains that are 2008 and above, ADAM is called ADLDS

3. For LDAP users, you can create a new LDAP, Sync all of the users from your other LDAP Servers, and then point to the New LDAP ser for Authentication.

There might be others, but these are the ones that I know about. The reason these aren't supported is that they are too heavy into Domain/LDAP Administration. Also, no one from ESRI has officially tested these, so there could be some unexpected results, but from what I have seen it seems to work without issue.

MuryadiOey

Hi Tony,

Unfortunately ArcGIS Server does not seem to support a forest with multiple domains (unless there is a workaround that I am not aware).

I suggest you have a talk with the System Administrator to create a nested group and load all domains to that group. You will require an account of a member that can see them all. That account is then used in ArcGIS Server Manager for accessing the nested group.

Regards,
Jose

I don't think it works as nested. I tried to add domain local group into Administrator role type, it didn't work. It didn't populate Role Members if you add a domain local group. but it works if it is global group. (all in Windows)

Esri_Sverige_SupportSweden

Hi Jose,

Ah alright, thanks for the info!

Regards, Tony

dimesv

Hi Tony,

Unfortunately ArcGIS Server does not seem to support a forest with multiple domains (unless there is a workaround that I am not aware).

I suggest you have a talk with the System Administrator to create a nested group and load all domains to that group. You will require an account of a member that can see them all. That account is then used in ArcGIS Server Manager for accessing the nested group.

Regards,
Jose

Esri_Sverige_SupportSweden

Done.

Could solve it at the DB level but have done it creating a superstructure hosting all the users and groups from multiple domains.

Regards,
Jose

Hi Jose,

Think you could explain a bit more how you did that?

Regards, Tony

dimesv

Done.

Could solve it at the DB level but have done it creating a superstructure hosting all the users and groups from multiple domains.

Regards,
Jose

dimesv

Hi Bubba,

I am not interested in allowing the setups to become available to the several domains in the forest. I just want AGS Manager 10.1 to stablish a connection with the entire forest and retrieve their users and groups to enable AD security not just those ones of a particular domain.

Regards,
Jose

BubbaHey

I've never done it, but here are some links that may help:

http://support.esri.com/en/knowledgebase/whitepapers/view/productid/194/metaid/1896

http://resources.arcgis.com/en/help/main/10.1/index.html#//0154000005qz000000

http://resources.arcgis.com/en/help/main/10.1/index.html#//0154000005n9000000

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.