Field Maps (ArcGIS Online) unable to view Portal layers

[AndrewRitchie_CoL]

I have create a webmap in ArcGIS Online, that reference a Map Image layer in our Portal. If I access the map from an iOS device, all layers are visible in Map Viewer.

However, if I open the map in the Field Maps App (connected to ArcGIS Online) on the same device - the Portal layers won't load. The error is:

Domain: com.esri.arcgis.runtime.error

Code: 6004

Description: JSON parser invalid start of JSON.

I expect this is because my Portal is behind a firewall, only accessible through an Azure AD Application Proxy. The browser is able to navigate this, but not Field Maps.

I'm also unable to connect Field Maps to my Portal (10.9.1 - so app should be registered automatically) - just gives a generic server connection error.

Is there going to be a way to work around this - are there extra ports or domains that need adding to the proxy?

Unfortunately I can't publish the layers to AGOL, as I need the map image layer, not a tile layer.

[GlenShepherd · Accepted solution]

Hi Andrew,

This might be something that needs to be put back to your IT team.  Are they utilising any MDM solutions to manage mobile devices within your organisation? The following resources might be of assistance when configuring Esri Mobile App access:

• ArcGIS Field Maps: Mobile device management - https://doc.arcgis.com/en/field-maps/ios/help/deploy-your-map.htm#ESRI_SECTION1_CC53DED5869D43EA8357...
• ArcGIS Field Apps and MDM Support: https://downloads.esri.com/Support/downloads/other_/ArcGIS%20Mobile%20Apps%20and%20MDM%20support%20t...
• ArcGIS Secure Mobile Implementation Patterns: https://downloads.esri.com/resources/enterprisegis/Esri%20Whitepaper%20-%20ArcGIS%20Secure%20Mobile%...
• Additional discussion in this space can also be found on Esri Community. For Example: https://community.esri.com/t5/arcgis-survey123-blog/configure-survey123-properties-in-your-mdm-with/...

However - do be aware that the 'pre-authentication' parameter for the Azure Application Proxy must currently be set to "Passthrough" in order for mobile apps (e.g. ArcGIS Field Maps, Survey123, etc...) to connect to their Portal instance.

This is currently an active enhancement request and you might like to also throw your 'kudos' behind this ArcGIS Idea, also requesting the functionality: https://community.esri.com/t5/arcgis-enterprise-ideas/azure-application-proxy-add-support-pre/idi-p/...

[AndrewRitchie_CoL]

Thanks Glen,

No MDM, but I'm following up with IT -  I'm pretty confident it will be the pre-authentication parameter, which we probably won't be able to change in our environment.

Rather than providing a proxy for Portal - which needs to remain secure - would I instead be able to create a second proxy for ./apps/fieldmaps and set the pre-authentication parameter to pass-through just for this one?

My thinking is: once the user has authenticated through the app, they would then be able view portal items through the app as well?

Otherwise, it looks like I'm just waiting on that Idea 🙂

Edit: That idea won't work - Field Maps needs to connect to /portal - not to the /apps/fieldmaps location 😞

[AndrewRitchie_CoL]

I've been able to work around the immediate issue, only by publishing to a public standalone ArcGIS Server - that I was hoping to decommission.

[PatOBrien]

Hello @GlenShepherd 
Our information security team have issues with applying 'pre-authentication' parameter for the Azure Application Proxy must currently be set to "Passthrough".

Given it has been a year since your last response, I would like to know if there are any new work arounds or if is still the suggested method in order for mobile apps to connect to portal?

Thanks,

Pat

[GlenShepherd]

Hi Pat, I submitted an enhancement request for this to Esri Inc back in 2020 as follows:

ENH-000134188 - Allow ArcGIS Field Apps to use the Azure Application Proxy with pre-authentication configured to "Azure Active Directory" to connect to Portal.

My only advice here would be to reach out to technical support, explain how many users this affects within your organisation (i.e. your use case) and ask for your organisation to be attached to the ENH code referenced above.

[PatOBrien]

Thank you @GlenShepherd. Appreciate the repsonse and I will follow your recommendation.
Until this is solved by ESRI Inc we will have 2 x environments, one for mobile products (Survey123/Field Maps etc...) and the other for non-mobile products. Which means environment complexity to meet a common Azure AD security profile. 

@Aneel_Kumar_M @CoreyFields @GISCoordinator2 @AndrewRitchie_CoL - I note you have similar issues mentioned in the community forum, it may also be worth followings Glen's advice above to get some steam behind it.

[PatOBrien]

Hello @LizArmstrong 

Are you able to provide insight as to when this Enhancement will be implemented?

ENH-000134188 - Allow ArcGIS Field Apps to use the Azure Application Proxy with pre-authentication configured to "Azure Active Directory" to connect to Portal.

It forms a critical part of our infrastructure planning and impacts 100s of users.

Thanks