Enterprise: single sign-on working for web apps but not web maps

[Amylewislakecountymn]

This is all taking place within our Enterprise Deployment. Whenever I am in a web map that has a web app developed with it, I am asked to log in again and again. It will typically pop up repeatedly whenever I zoom in or out. Otherwise the single sign-on works for web apps and web maps that do not have a web application developed from it.

 The other exception is one user is getting the same sign in prompt within the web apps. Do know what could be causing this? It’s really stumping the IT department and I.

[ZachBodenner]

I had a similar thing happen but before I share what fixed my problem I have a couple questions: so the login prompt occurs when using the actual Enterprise Portal Web Map viewer? Or actually the app that is referencing the map? Are your apps developer edition (so self-hosted) or just portal-item style web apps?

[Amylewislakecountymn]

The login prompt will occur when I am using the Enterprise portal map viewer (beta and classic). The web apps used are just portal-item style web apps. However for one user within our entire organization, they're getting the log-in prompt when using portal-item style web apps and when viewing maps in map viewer.

[ZachBodenner]

Hm, alright so that's outside the scope of what happened to me. One other thought though, is this all web maps with an app build from them? Even if so, is it possible there's something else lurking behind the scenes, like the services or items are coming from a server with a rest endpoint that's only available to some users? 

[Amylewislakecountymn]

I believe there is something else behind the scenes. How would I check rest endpoints and their availabilities? These maps use almost entirely referenced feature layers, not sure if that is worth mentioning. 

[ZachBodenner]

In your web map itself, you can hover over the layer to get the three-dot, then hit Description:

That will take you to the data source. If it's a rest endpoint, it will be something like htpps://domainname/webadaptorname/rest/services... if it's a federated server using a web adaptor. You might also see someting like ...:6443/arcgis/rest/service..., which means it was added not using the web adaptor, which (depending on your user configuration) could cause some login issues. 

I also forgot to ask: Portal or AGOL?

[Amylewislakecountymn]

Okay I went to the rest endpoint. Once I get to this point, I get lost as to where to find user availability. The ArcGIS REST Services Directory URL doesn't have the port number exposed, so the web adaptor is functioning. This is for Portal.

[ZachBodenner]

Okay, so then do you know how your users login in to access web maps and data and things? I'm guessing if it's supposed to be single-sign on, you have some kind of externally managed user data store (Windows AD FS for example). And the server where the data is published is federated with your Portal? 

[Amylewislakecountymn]

Windows is used to manage user data (windows managed user data store)

I attached the following incase it helps. 

Our deployment consists of 4 server machines, we have a hosting server and a separate server for the data store.

[ZachBodenner]

Well I guess I'm no troubleshooting professional but it kind of sounds like you have everything in what should be working order. I hope someone else can provide some more assistance!