One secured map service will not print, two will???

[Scott_Tansley]

Hi, I'm working with a client who is having print service problems.  Background.  They are using ArcGIS Enterprise 10.8.1 which is fully patched.  They have a public (anonymous) base map and a public print service.  They have many secured map services.  It's a new environment and all items are published with ArcGIS Pro.

They have a secured Web App Builder Application with many themes, each being a map service.  All but one is turned off by default.  If they print to a custom print service then they only see the base map in the PDF.  If they turn on a second theme (service) then both services, plus the base map, print.  If they turn off either service then it only prints the base map.

The customer and I are using ArcGIS Portal Token accounts.  SAML2 accounts give us the same problem.

I went back to basics and created a new Web Map in Portal.  I use the default base map, and press 'print with the legend' in the Web Map application (default print service), then I get an HTML output of the base map.  I add one secured service, and print, I only see the base map.  I add a second secured service, and print, I see the base map and two map services.  If I remove either operational map service then I can only print the base map.  Adding more than two services always gives me the correct result. 

The issue only presents when I print a single secured service over the base map.

All requests are HTTPS, TLS1.2, and fully certified throughout.  

Taking a deeper dive.  If I use developer tools then I can see that the Web_Map_as_JSON is properly formed.  A token is passed with the operational map service.  The token is the same as the token that I am using in my header for all requests to ArcGIS Enterprise.  It's new, valid and working.  If I request two map services then the same token appears in both operational map service requests in the Web_Map_as_JSON.

I have two ArcGIS Servers.  One hosts the print service.  When I review the logs (in debug) mode, there are no warnings created.  The map service(s) are on my second ArcGIS Server Site.  Using the debug logging there I can see what I believe is the problem:

When my print service request has one service in it, the request from the print service appears approximately 2 seconds after I request the print operation.  I see the message:

   "Request user: Anonymous user, Service: {SERVICE1}"

shortly after I see:

   "A request was made for service {SERVICE1} but it did not have adequate credentials."

When my print service request has two services in it, the request from the print service appears approximately 2 seconds after I request the print operation.  I see the following messages:

   "Request user: {User1}, Service: {SERVICE1}"

   "Request user: {User1}, Service: {SERVICE2}"

In this latter case, the {User1} user is the correct portal user.  Both map services execute normally and I get a PDF from the Web App Build application, or I get an HTML output from the Web Map Print tool.  It's just fine.

Looking at the JSON sent via the "Web_Map_as_JSON", the only difference between the print one or print more than one options, is the presence of more than 1 layer IDs.  The syntax of the layer ID that doesn't print by itself is the same for both.

I'm lost.  All services are coming from the same ArcGIS Enterprise, and nothing 'hybrid'.  The sharing is correct, the service work as expected, and it doesn't matter what combination of services (from about 30) that I use, I get the same results.

Thanks for persevering with such a long message.

Scott

[TanuHoque]

we fixed a similar bug in 10.9. Please give 10.9 a try when that is available to you, and let us know if you still see the same issue you are reporting here.

Since it is security related I will highly recommend you to call Esri Support and have them take a look first.

https://support.esri.com/en/bugs/nimbus/QlVHLTAwMDEzNjI3Nw==

[Scott_Tansley]

Thanks for this. 

Unfortunately, the client won't be able to upgrade to 10.9, although it would be a nice solution.  Budgets only allow for an upgrade every ~18 months and this is a greenfield deployment, that is only partially live.    An upgrade would not be a good topic at the moment. 

I'm going to cross-check this deployment against another client with an equal build.  The problem does not exist for them.  If that doesn't work then I'll put the issue through the support desk with my local distributor.

Thanks for the timely response.  It's very much appreciated.  It's also good to know that I'm not the first one to see this.

[BenWalker1]

Hi Scott, did you get anywhere with this? We have a similar log, but it is related to syncing data with Field Maps.

[Scott_Tansley]

Hey Ben.  We put it through official support channels and was told to upgrade to 10.9.  So we got some more disk and used a copy of the cache to duplicate the services.  We then had an anonymous service and a secure service.  When everything was secure in the internal apps, it just worked.

[MattiasEkström]

Hi @Scott_Tansley 

I'm having problem with printing secured services, somehow the problem changed from can't print secured services at all to the problem you described that it requiers 2 or more secured services to show up in the printed map. And now it's back at can't print at all... But I'm curios on teh security configuration the solved it for you.

I our case we used to have almost all basemaps and operational layers shared with our organisation, and just some layers shared with specified groups. That's the layers causing problems. Recently I shared many of the layers and basemap to public, maybe that caused problem?

When it just worked did you have the same security for all basemaps and layers? or did you share some layers only to some groups as well? 

[Scott_Tansley]

So we found that if we published with an 'everyone' base map, and one secured layer we got the issues.  If we used an 'everyone' base map with two or more secured layers then it worked.

The solution we followed was to use the existing tilecache as the data source (so we store it only once) but created a second tile cache Map service and secure it.  

Then for those secure print, we used a secure base map with a single layer and it worked.  Not the best having two web services for the same thing, but having everything secured made it work nicely.  At least we didn't have to store the data twice. 

Hope this helps

[MattiasEkström]

Thanks, that could be a workaround, if we'll end up with that problem consistently.

Now it feels like we're having different variants of the print problems from day to day.