Failed to return user store. For input string: "8997:266::8997:266"

[RandallClark2]

So i came in to work today and try to log on to my ArcGIS server site with my domain account and got the following error

"Failed to return user store. For input string: "8997:266::8997:266"

So i log on with my primary psa account and to see whats up...after poking around it seems for some reason the site can not find any of the users in the our domain.

So i go to the Config Store in the security settings and test the connection.

what i get now is

"Testing the connection failed. Please verify that you can connect to the Windows domain outside of ArcGIS Server using the username and password values you entered in the input boxes below.

For input string: "8997:266::8997:266"

So some where between last night and this morning i can not connect to the domain and can not bring and users in.

Any thoughts as to what is going on?\

ArcGIS for Server 10.3, Server 2012 R2

Edit:

From the logs...

</Msg>

<Msg time="2015-08-06T11:35:58,528" type="SEVERE" code="6581" source="Admin" process="2948" thread="1" methodName="" machine="AFGIS.AD.FULLERTON.EDU" user="" elapsed="">Failed to validate user credentials for the user 'AD\raclark'. Failed to return user store. For input string: "8997:266::8997:266"

</Msg>

<Msg time="2015-08-06T11:36:04,323" type="SEVERE" code="6619" source="Admin" process="2948" thread="1" methodName="" machine="AFGIS.AD.FULLERTON.EDU" user="" elapsed="">Failed to return user store. For input string: "8997:266::8997:266"

This is my current error code. it comes up when i try to switch to the windows domain for users....

<Msg time="2015-08-06T12:05:14,665" type="WARNING" code="7270" source="Admin" process="2948" thread="1" methodName="" machine="AFGIS.AD.FULLERTON.EDU" user="" elapsed="">Unable to connect to the identity store using the supplied parameters. Verify that you can connect to the identity store outside of ArcGIS Server using the same parameters. For input string: "8997:266::8997:266"

Edit: 8/10/15

And today when i come in an test it. It works. So i am guessing something on the IT side and not ESRI but i would still love for ESRI or anyone to weigh in on what is going on.

#ESUI Support

Edit: 8/11/2015

So still every thing seems to be working. Best guess is that it was something on the IT side and problems with the AD server.

[RandallClark2]

So it started up again, right after a name password reset for the user names.

So i came back to this thread and was looking through stuff and i saw your post.

When  run ipconfig i do see a reference to Tunnel Adapter 6TO4so i am guessing it has something to do with that.

My question is what did you do you resolve this?

[AaronCohen]

Sorry for my tardy reply.

My Net Admin folks disabled the Windows Tunnel Adapter 6TO4 on the map server.

How they did that I do not know.

From what I can determine it is a setting in Device Manager on that specific server.

[NicolasGIS]

Same problem here ...

Fresh install as well of ArcGIS Server 10.3.1 with webadaptor 10.3.1 on Windows Server 2008 R2 Enterprise SP1 running on IIS 7.

ArcGIS Server is configured to use Windows Domain with ArcGIS Server token authentication.

Failed to validate user credentials for the user 'XXX'. Failed to return user store. For input string: "1458:210:40::100:e"

Any progress made on this subject ?

Cheers

[RandallClark2]

Yes, was something on the IT side, they were doing something to the machine that was running the AD. But what ever it was they stopped and its been working fine.

[NicolasGIS]

All right thanks.

After talking with our IT they have disabled IPV6 on the server and since then we do not have the problem anymore.

The thing is, according to our IT, "disabling IPV6 in Windows 2008 R2 is not recommended and not tested\supported by Microsoft" ... So I wish there were a better solution because we might have soon bad surprises.

But ArcGIS Server is supposed to be fully IPV6 comptatible :

38707 - Does ArcGIS Server support IPv6?

Another interesting thing that our IT underlines is that it seems like the IP of DC (Domain Controler) is truncated by ArcGIS Server  and this is the reason why I guess it is not able to connect.

An example from our log :

- Failed to return role store. For input string: "1459:201:b56e::150:2d"

while the IP adress of our DC is : 2001:1459:201:b56e::150:2d

Food for thought !

Cheers

[RandallWilliams]

I'm curious to see if explicitly defining your global catalog using IPv4 helps anyone on this thread encountering this issue:

http://server.arcgis.com/en/server/latest/administer/windows/configuring-the-domain-controller-used-...

[NicolasGIS]

Esri support asked us to try. We did and did not solve the problem for us. Also it is better if it is dynamic as a dc can be under maintenance.

[NicolasGIS]

FYI, ESRI opened a BUG regarding this issue :

BUG-000093484

"When trying to connect to domain controller to user store in ArcGIS Server using IPv6, this will not connect properly"

[Anonymous User]

I would also like to confirm that disabling IPv6 on a testing VM running ArcGIS for Portal 10.4 and ArcGIS Server 10.4  has fixed my issue connecting to an AD user store within Portal for ArcGIS.

https://support.microsoft.com/en-us/kb/929852

Thank you for this thread I wasted enough time trying to get this to work.

[NicolasGIS]

Yes same issue with Portal for ArcGIS !

I confirm that I was having the same problem with Portal 10.3.1 when trying to configure it to use Windows Active Directory.

But with Portal, the error  message was not talking about IPV6 which make it even more difficult to debug :

"Failed to update identity store. Cannot connect to user store using supplied configuration. Verify the user store configuration is correct and try again."

After deactivating IPV6 on W2K8 server, it worked ! Hopefully, I had already struggle with ArcGIS Server to find out this !