Public access to internal Enterprise deployment with anon access enabled, setup strategies

[DavidPersson]

Hi, our org has deployed an Enterprise 10.8.1 base setup with a SAML idp.

The web adaptors for the federated hosting server as well as the Portal are installed on a machine in the DMZ part of the org network (though not publicly available). We've currently evaluating the environment for internal use but have preliminary hopes of using one Enterprise deployment for both organization users, in the field and on the company network, as well as making everything shared with "everyone" and Public available to the general public.

When attempting to research how one would setup the following, if it's at the minimum case enough to expose the Portal web adaptor url, I've found the high availability setup scenarios ( https://enterprise.arcgis.com/en/portal/latest/administer/windows/ha-scenarios-web-gis.htm ) as well as the Security Best Practices ( https://enterprise.arcgis.com/en/portal/latest/administer/windows/security-best-practices.htm ) that mention that anonynous access is best left off.

So being aware that we would obviously need to make sure the right users/roles had "share things to the Public" and that we are planning to start small in terms of users and data, having a part exposed externally is nevertheless going to need following one of the HA scenarios I think, as the Enterprise deployment possibly/probably becomes mission critical; correct?

Our initial plan was for an unfederated ArcGIS Server to supply AGOL with services for the general public but we have initially rejected that idea in order to administer only one Portal environment and also because there are currently some not entirely resolved questions regarding GDPR.

Thanks for reading and for any pointers on further (mandatory) reading : )

[CraigRussell]

...we are currently transitioning away from said environ however and I understand from your post that it's better to not use the fweb adaptor adress for the admin url when fedearing for security purposes

It shouldn't use the same web adaptor as the one being used for end user access.  You can have a separate web adaptor for admin traffic with elevated security in some circumstances, but for what you're proposing, the 6443 direct one is probably the way to go.

They are installed in the dmz server with a public certificate domain, so "public.domain.se" -> 6443/7443 -Enterprise base install machine via the web adaptors. Theres a firewall behind and in front of this DMZ machine so nothing is exposed publicly yet but it should be theoretically prepared, as I parse your reply. Can this be considered realistic for a small-scale start?

Should be fine, provided that your IT security team has no qualms about using third party components like the web adaptors in your DMZ, this sort of thing comes up sometimes and ultimately you have to work within your organizations IT principles.  What's important to note is that if for some reason you end up putting a gateway/reverse proxy between the internet and your web adaptors, the public URLs/DNS entries must be the same as what you've used for the web adaptor URLs to avoid having to unfederate/refederate.