Creating webhooks without admin role

vaishalikulkarni00

I am working in an Enterprise 11.1 environment with an Azure AD login. I don't have an admin role but I have a custom publisher role with feature service and geoprocessing privileges which should allow me to create non-organizational webhooks. The webhooks have to be created on the admin site for the feature service which I don't have default access to. I get taken to a website to either login as an administrator or generate a token. I am not an admin and I am not able to create a token with my login since I have an Azure AD login. Do I have any other recourse to create webhooks without asking an administrator of my portal?

ArchitSrivastava

Hello @vaishalikulkarni00 ,

I assume that your assigned role is a built-in role, not a custom one, and by default, the Webhooks capability is only available to the Administrator role.

Please refer to the documentation below for more details:

Full Document: Privileges granted to roles—Portal for ArcGIS | Documentation for ArcGIS Enterprise
Webhooks Section (Geoprocessing): https://enterprise.arcgis.com/en/portal/11.1/administer/windows/privileges-for-roles-orgs.htm#ESRI_S...
Webhooks Section (Organization webhooks) : https://enterprise.arcgis.com/en/portal/11.1/administer/windows/privileges-for-roles-orgs.htm#ESRI_S...

Depending on the type of webhook you want to create, I recommend configuring a custom role, as assigning the default Administrator role may not be feasible for the Organization Admin.

For Geoprocessing service webhooks: assign the following privileges to the custom role.
For Organization webhooks: assign the following privileges to the custom role.

Hope it helps!

vaishalikulkarni00

@ArchitSrivastava I have been assigned a custom publisher role with feature service and geoprocessing privileges so I should be able to access those services, but I am not able to go to the admin page for them. I am rerouted to a login page to either login as an admin or to generate a token. I don't have an admin login and I am not able to generate a token because of our Azure AD login system. For those of us that are not admins but have custom roles to have the privileges needed to create webhooks, what is the procedure to do it? Are webhooks only available on the admin page? And should I be able to access it without a login or token?

ArchitSrivastava

Hello @vaishalikulkarni00,

I ran some tests on my side by configuring a similar role on version 11.1 and 11.3 (with and without Azure AD config) both and followed the workflow mentioned in the document below:

Create (Webhooks) | ArcGIS REST APIs | ArcGIS Developers

Key point being update the URL to Rest Admin API, I am sharing a sample below:

REST API URL: https://sampleserver6.arcgisonline.com/arcgis/rest/services/CommercialDamageAssessment/FeatureServer
ArcGIS REST Admin URL (added the bold section)
https://sampleserver6.arcgisonline.com/arcgis/rest/admin/services/CommercialDamageAssessment/Feature...

The above URL should allow you to reach to "Update Definition" option and then follow the documentation mentioned above.

Furthermore, I also noticed the following:

If you are owner of the "Feature Layer" (Hosted and Referenced both): No redirect occurs
If the item is owned by another user (Hosted and Referenced both): Redirect occurs and tries to generate token

Hence, I think that the redirect has nothing to do with the "Azure AD" configuration. It is to validate the access of the item (assumption).

Furthermore, can you try taking the ownership of the item or try doing the workflow on an item owned by your username?

Please let me know how it goes, in the meantime I will try to find any other workaround.

Hope it help!

vaishalikulkarni00

@ArchitSrivastava I am the owner of the services I'm trying to create webhooks for.

I am able to get to the Update Definition page through https://<Portal>/server/rest/admin/services/<serviceName>/FeatureServer. But, if I put in {"syncEnabled": false}, I get "Service <serviceName>.FeatureServer does not exist in folder 'FOLDER'".

I know that the service definition is OK though because I asked someone with an admin role and he was able to create a webhook.

I can't get to the webhooks page myself.

I am going to https://<Portal>/server/rest/admin/services/<serviceName>.FeatureServer and am getting "Invalid URL"

If I go to https://<Portal>/server/admin/rest/services/<serviceName>.FeatureServer I get the Primary Site Administrator Login screen.

ArchitSrivastava

Hello @vaishalikulkarni00 ,

As the Admin is able to create Webhook, I would also assume that the SD (Service Definition) is OK. However, let's try to cover all our bases and try the following:

Try by updating some other capability as "Sync" would require other checks on the data configuration end, can you try disabling "editing" capability or pick any other example from the below document:
- https://developers.arcgis.com/rest/services-reference/enterprise/update-definition-feature-service/
Try publishing a "Hosted Feature Service" with a very small data and try the Webhook creation workflow on that.
Check the "Sharing" setting of the service (Shouldn't matter as you are the owner but still a check wouldn't do harm)
Check how the "Custom Role" was created as I use the default publisher role as base and then just add "webhooks" capability (as shown in the video) maybe some required capability is missing from the role.
(view in My Videos)

In the meantime, I will try to search more on this and share details.

Hope it helps!

vaishalikulkarni00

@ArchitSrivastava Thank you for your help. I did try to update the editing and it didn't work for a referenced service. I can update definitions on a hosted service but still not get to the webhooks page.

The admin did tell me they created the custom role as you described. Started with the Publisher role and added webhooks. If I look at my licenses it does say "Create, edit and delete feature service and geoprocessing webhooks". Everything should technically be in order. I think the only issue is how ESRI has set up the creation of webhooks. That it has to be on the server admin page and not the service admin page. Am I correct in this? Seems stupid to do that if you're going to create custom roles that are not admin.

ArchitSrivastava

@vaishalikulkarni00 ,

It does seem to be a different behavior than expected. However, I think that the configuration being on the Admin page is correct and the documentation for 11.1 does say the same, kindly find the details below:

Create a geoprocessing service webhook: https://enterprise.arcgis.com/en/portal/11.1/administer/windows/create-webhooks.htm#ESRI_SECTION1_A9...
Create a feature service webhook: https://enterprise.arcgis.com/en/portal/11.1/administer/windows/create-webhooks.htm#ESRI_SECTION1_A3...

Where as the documentation for 11.4 suggests different workflow:

Configure service webhooks: https://enterprise.arcgis.com/en/portal/latest/administer/windows/create-webhooks.htm#ESRI_SECTION1_...

My guess is that with new releases the behavior has been made user friendly as expected.

Additionally, I think we should not be looking for "Create Webhook" option on the REST Admin API.

I would try to look for a way which can allow you to create a Webhook with the custom role configuration and keep you posted if I find anything.

Furthermore, I think reaching out to ESRI support at this point would also be a good idea.

Hope it helps!

vaishalikulkarni00

@ArchitSrivastava Yes, please keep me posted if you find anything. I haven't seen any documentation on creating webhooks with only privileges but not admin role/going on admin site.

ArchitSrivastava

Hello @vaishalikulkarni00 ,

I wanted to provide a quick update. I have not been able to identify any viable workarounds for this issue so far. However, I’m continuing to explore possible solutions.

I’ll keep you informed of any progress.