Community
Select to view content in your preferred language

Federation - Administration URL: machine name/FQDN vs DNS - inconsistent behavior across installations

126
2
a week ago
denniszammarchi
by
Emerging Contributor
a week ago

Hi everyone,

We've run into inconsistent behavior when federating ArcGIS Server with Portal for ArcGIS, and I'd like to get some input from the community.

Our standard approach:

  • Services URL: we use the URL configured through the Web Adaptor, matching the DNS name registered for the environment.
  • Administration URL: as a first choice, we try to use the machine name (or FQDN, when available) on port 6443

denniszammarchi_1-1786006226697.png

 

 

The issue:
In some installations, using the machine name (or FQDN) for the Administration URL doesn't work correctly, and we're forced to fall back to using the same DNS name we use for the Services URL (just on port 6443) instead. Interestingly, this happens even on single-machine deployments, where we wouldn't necessarily expect name resolution or certificate issues to come into play. We've seen this behavior recur across multiple versions (11.0 through 12.1), not tied to one specific release.

Is there a recommended best practice for choosing between machine name/FQDN and DNS name for the Administration URL during federation?

What typically causes the machine name/FQDN approach to fail — could this be related to wildcard certificate SAN/CN matching, internal DNS resolution, or hosts file configuration? We use wildcard SSL certificates in PFX format across all our installations

Any insights, best practices, or documentation pointers would be greatly appreciated. Thanks in advance!

 

0 Kudos
2 Replies
JakeSkinner
by Esri Esteemed Contributor
Esri Esteemed Contributor
a week ago

Hi @denniszammarchi,

I always recommend federating with the same URL you use for your Services URL.  This is a requirement when you have a multi-machine ArcGIS Server site.  You want Portal to be able to communicate to the ArcGIS Server instance if one of the servers is down.  I realize you may not have a multi-machine site, but if you do join another machine to your ArcGIS Server site, you won't have to worry about updating the federation URL.

As for why it's failing, are you importing any certificates into ArcGIS Server's internal tomcat web server, and configuring ArcGIS Server to use this (steps in link below)?

https://doc.esri.com/en/arcgis-enterprise/latest/administer/configuring-https-using-an-existing-ssl-...

0 Kudos
OlaIHamed
by
Occasional Contributor
a week ago

Hello @denniszammarchi, 
To confirm this is a certificate issue, temporarily revert both to self-signed:

  1. Revert ArcGIS Server to its default self-signed certificate (https://machine:6443/arcgis/admin/machines/<machinename>/sslcertificates)
  2. Revert Portal to its default self-signed certificate (https://machine:7443/arcgis/portaladmin/security/sslCertificates)
  3. These steps will restart the services of Portal and Server 
  4. Attempt federation using the machine name

If federation works -> then this might be a wildcard certificate naming issue. 

0 Kudos