Using IIS Application Request Routing (ARR) to proxy GeoEvent Stream Services

RJSunderman · ‎02-05-2016

Technical Support is available on this topic. Please contact Esri Technical Support and mention Article ID 000011685 and Article ID 000011689

See also: Geoevent WebSockets in 10.6 with ARR‌ and Windows/IIS Reverse Proxy for GeoEvent WebSocket

I received a second request recently for the information below, provided to me originally by Javier on the GeoEvent Server development team, so I thought I’d post it in case others are looking for the information.

After installing ARR, double-click the URL Rewrite icon and create a similar rule (replacing the hostname of the Rewrite URL to match your environment):

After applying the rule confirm you are able to access GeoEvent Manager through IIS:

Configuring your SSL certificates will be important. You can use IIS to create and export a Domain Certificate with a private key and then configure ArcGIS Server and GeoEvent to use that certificate. An alternative would be to get IIS to trust the certificate that is configured with your ArcGIS Server/GeoEvent installation.

It was discovered that, using the 10.3.1 release of GeoEvent Server and IIS version 8.5 with WebSockets enabled, with ARR configured to create a reverse proxy for GeoEvent that StreamService connections did not work. This issue was addressed in the 10.4 release of GeoEvent Server.

10.3.1 deployments can create a reverse proxy similar to WebAdaptor specifically for WebSockets using NGINX. Steps outlined below provide some detail on installing and configuring NGINX. A sample nginx.conf configuration is attached which you can use as a reference.

Please note: Esri tech support cannot help troubleshoot reverse proxy configurations - whether they be NGINX, IIS, or Apache. If you do plan on deploying a reverse proxy as part of a systems solution, make sure you have someone with appropriate experience available to you for help troubleshooting. Esri tech support has a KB article you can refer to:

http://support.esri.com/cn/knowledgebase/techarticles/detail/40680

Install a WebSocket reverse proxy server Nginx.
Enable HTTPS on the proxy server and configure it to use a certificate issued by a trusted 3rd party CA (Thawte, VeriSign, DigiCert).
Configure the proxy server to forward requests to GeoEvent Services. Attached is an example of an Nginx configuration file. You will need to change the following settings:
- server_name <your Web Socket reverse proxy server name>
- ssl_certificate <your CA-cert certificate file>
- ssl_certificate_key <your CA-cert certificate key file>
- server <list of servers that GeoEvent Extension is running on>. In this example, the server names are dev01014.esri.com, dev01015.esri.com, and dev01018.esri.com

Note: The WebSocket reverse proxy server is set to use HTTPS, but it connects to HTTP on the backend. In the example configuration file, the proxy_pass for port 443 is set to http: //skivmHTTP; not https: //skivmHTTP.

In a web browser, navigate to http: //<ServerName>:6080/arcgis/admin to access the ArcGIS Server Administrator Directory.
Login and click system -> properties-> update.
Enter a property called WebSocketContextURL to point to the Web Socket reverse proxy.

For example:

{"WebSocketContextURL": "wss://skivm.esri.com"}

In a browser, navigate to:

https: //<WAMachineName>/<context>/rest/services/<StreamServiceName>/Streamserver/subscribe

Click Subscribe to verify data is streaming. You can also verify data is streaming by navigating to:

https: //<WAMachineName>/<context>/rest/services/<StreamServicename>/StreamServer?f=jsapi