I am running a internal intranet only single machine install of ArcGIS Server 10.3.1. I have both a production install and a separate development install on another virtual machine. Recently we switched the access control from IP filters in IIS to Windows Authentication. I have a geoprocessing service Export Map Task to allow end users to create PDF maps from the web applications running in Flex. I followed the instructions at Printing maps that contain secured services—Documentation (10.3 and 10.3.1) | ArcGIS for Server to setup a secure connection to allow access to the web services. On the development system everything works correctly. On the production system the Export Map Task fails with the message "esriJobFailed". The server log shows:
"Error executing tool. Export Web Map Job ID: j409e1f0490c94335b4c9d07bc645595a : Layer "Customer Service": Unable to connect to map server at http://<server name>/ArcGIS/rest/services/CustSvsDynBase/MapServer. Layer "Overlay": Unable to connect to map server at http://<server name>/ArcGIS/rest/services/CustSvsOverlay/MapServer. Failed to execute (ExportWebMap). Failed to execute (Export Web Map)."
When I turn off all the map layers hosted on the production machine and only turn on layers coming from an open image server, the geoprocess works perfectly.
What is truly bizarre is if I host the geoprocessing service on the development machine and point it to the services on the production machine it works perfectly. Both systems are using the same user accounts and passwords, and every setting anyone can think of is set identically. The only difference I know of is the two virtual machines are hosted on different host machines.
I have been wrestling with this for about two weeks now and simply cannot find a resolution. I realize the Flex application is no longer supported, but this is actually not an issue with Flex, it is with the geoprocessing service. Does anyone have any suggestions?
If you remote into the machine as the user running the ArcGIS Server service and you're able to reach that URL, then there's no reason why it's inaccessible when running the GP service, as the traffic is essentially identical. The user running the ArcGIS Server service will be making connections to any services you're trying to access within the GP task. If your production environment is more locked down in a way that prohibits outbound connections, then that's likely your problem. If you are able to run Fiddler on that machine as the same user running the ArcGIS Server Windows service, that's just another way to see what outbound requests are being made.
Sometimes it is the simplest things. Proxy settings! All I had to do was login as the Windows user account ArcServer was using, open Internet Explorer, go to internet options, connections, and update the LAN settings to match our network. Boom, everything worked.