ArcGIS Server Manager Unauthorized Access 10.2.2

[DaveTenney]

All,

    so something we have experienced now for a 2nd time is randomly losing access to the server manager...

when we try to log into the server manger site for 10.2.2 the screen shows "Unauthorized Access" at the time. nothing has changed in the environment, no one has changed any settings to the ESRI server, 100% random. this happened once before and with the help of ESRI support the best solution was to completely remove the installation of server and reinstall everything...completely unacceptable in my book.

well here we are again, so i wanted to ask on here first if anyone has experienced this before and has a better solution than just uninstalling and reinstalling server?

we are able to access the admin site and work through that, it seems isolated to the manager site. i checked the status of the machine and everything is listed as "running".

thanks

Dave

[RebeccaStrauch__GISP]

Things to check...

• how are you accessing manager....I find   http://<machinename>:6080/arcgis/manager works best, i.e. don't use the web adaptor, especially if you disabled this option for remote admin access
• did the password change on the account that you might be using for AD or LDAP authorization
• have you tried to access with the primary admin account

edit.... oh, and try a different browser

[MichaelVolz]

What specific browser were you using when you generated this error?

Could this be a certificate issue?

[DaveTenney]

Internet Explorer 11 & Google Chrome v55.0.2...

[DaveTenney]

1) we use that same path to access the manager - unauthorized access

2) password we have set to use is set to never expire

3) cannot access with primary admin account - unauthorized access

4) we have tried different browsers - unauthorized access

     i am looking at the server logs and it seems to be stuck in an infinite loop of recycling services, and here are a few of the errors were seeing in the logs:

"Unable to connect to the identity store using SSL.  ArcGIS Server will revert to using a non-SSL connection to the identity store and credentials will be sent in clear text.  In order to use SSL, verify that your identity store has SSL enabled."

"Recycling is configured for service..." -  are seeing this error repeat itself many times for each service on the server

"Error while processing catalog request. AutomationException: Unspecified error"

"ServiceCatalog failed to process request. AutomationException: 0xc00cee3a" 

     the above two errors are always paired together

so we see that paired error followed by trying to restart each service again, and it seems stuck in this loop.

Dave

[RebeccaStrauch__GISP]

you are specifying HTTP and not HTTPS when using, correct?  I use HTTP    ...but because I disable the remote access of admin thru the web adaptor, I need to be within our firewall anyway.

[DaveTenney]

started to dig into the windows even logs....

    seems that machine hit some critical errors and crashed...

its a VM not on site but through a client, i wouldn't think that a crash of the machine would cause the server to become so corrupt that the only option would be to completely reinstall.

dave

[JohnBrockwell]

Any success? I have the same exact issue on 10.6.1. on a VM that failed thanks to a Cisco switch failing.

[DeanMoiler]

I've had the same problem with a crash that caused an AGS site config xml to be wiped which I was able to fix.

This "unauthorised" issue started occurring after upgrade to 10.6.1 with 2 x federated AGS sites and all in HA.

Seems like trust between servers and portal has been lost, or is timing out somehow.

Any suggestions welcome!

Ta

[DeanMoiler]

I seem to have fixed it in my setup by changing the ArcGIS Server protocol to 

   Protocol: HTTPS Only

My Portal for ArcGIS was previously already setup  to

   Allow access to the portal through HTTPS only.

I also switched off Allow anonymous access to your portal.

I have a feeling that sometimes when an anonymous request is made that it don't attempt to authentication IWA credentials and sticks with it being anonymous?

Best of luck,

Dean