Occasional blank map when loading from Portal using IWA with 100.3

BjørnarSundsbø1 · ‎12-20-2018

Hi,

We occasionally experience an issue where the map is blank when loading from portal, using Integrated Windows Authentication. I do not know if this is the actual culprit, but it is the best lead I have. Unfortunately I do not have a lot of information to go on, and no direct access to production logs.

Graphics in GraphicsOverlays are drawn, but the map itself is blank, and my layer list is empty. My map has spatial reference, however I am not not sure which one. I assume 4326, since that is the reference system of my graphics. I am unable to locate any exceptions related to loading maps in my client log.

The problem seems to occur when starting application immediately after logon, but this is in no way consistent. Restarting the application resolves the issue.

Based on the time this occurs, I can find the following in the web server logs (error 401), but unfortunately I am not 100% sure if these messages actually relate to the user who experienced the issue, but it is the only iffy thing that could be found at the actual time the problem occurred

2018-11-22 09:37:29 10.163.24.55 GET /portal/sharing/rest/portals/self f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 1
2018-11-22 09:37:29 10.163.24.55 GET /portal/sharing/rest/community/users/ABC123@DOMAIN f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 2
2018-11-22 09:37:30 10.163.24.55 GET /portal/sharing/rest/content/items/d79f5f97ce8d40c2994ebd4c7307edcc f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 2
2018-11-22 09:37:30 10.163.24.55 GET /portal/sharing/rest/content/items/d4cc357bf7ae4063b9f605fc1bfb917c f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 1
2018-11-22 09:37:30 10.163.24.55 GET /portal/sharing/rest/content/items/b561528f264b49d98a231db6502750ed f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 0
2018-11-22 09:37:30 10.163.24.55 GET /portal/sharing/rest/content/items/5fe32ae4389f446d9a2c5737a191ccff f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 0
2018-11-22 09:37:30 10.163.24.55 GET /portal/sharing/rest/content/items/d3bf554220c949ec858a8bc2f3834422 f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 2
2018-11-22 09:37:30 10.163.24.55 GET /portal/sharing/rest/content/items/05b13feaee42419ba0302b77a02c4520 f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 2
2018-11-22 09:37:30 10.163.24.55 GET /portal/sharing/rest/content/items/0d80403a114a40a1873ff31265fe553c f=json 443 - 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 401 2 5 2
2018-11-22 09:37:30 10.163.24.55 GET /portal/sharing/rest/content/items/b561528f264b49d98a231db6502750ed f=json 443 DOMAIN\ABC123 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 200 0 0 134
2018-11-22 09:37:31 10.163.24.55 GET /portal/sharing/rest/content/items/05b13feaee42419ba0302b77a02c4520 f=json 443 DOMAIN\ABC123 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 200 0 0 151
2018-11-22 09:37:31 10.163.24.55 GET /portal/sharing/rest/content/items/8691e1f36bfc413789f9585c94c5ebe0 f=json 443 DOMAIN\ABC123 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 200 0 0 223
2018-11-22 09:37:31 10.163.24.55 GET /portal/sharing/rest/content/items/7121939e6ee54730bdf3a44bd0c64fa4 f=json 443 DOMAIN\ABC123 10.11.12.13 ArcGISRuntime-NET/100.3+(Windows+6.3.9600;+Win64;+.NET+4.7.1) http://myApplication.app/ 200 0 0 269

I do not have single sign on in my development environment, so I have tried to recreate the issue by changing permissions for a Web Map, or individual layers, but that result in exceptions in my logs, and example message from the server (HTTP status 200)

{"error":{"code":403,"messageCode":"GWM_0003","message":"You do not have permissions to access this resource or perform this operation.","details":[]}}.

Does anyone have any suggestions on where to start investigating, or what this issue might be?

JenniferNery · ‎12-26-2018

On sign-out, you may need to also clear authorization cookies.

in WPF

 new ArcGISHttpClientHandler().CookieContainer.GetCookies(requestInfo.ServiceUri)?.Cast<Cookie>()?.ToList().ForEach(c => c.Expired = true);‍

in UWP

new Windows.Web.Http.Filters.HttpBaseProtocolFilter().ClearAuthenticationCache(); ‍

We have an issue logged for this and another to support invalidating OAuth login.

BjørnarSundsbø1 · ‎12-26-2018

Thanks, Jennifer Nery I will give that a go.

We don't have any sign-in logic in our application, as we leave it all to windows authentication etc. So clearing cookies should help make a difference?

With my symptoms with empty layer list and blank map, is it likely that what we experience a single-sign on issue? Is there a way that I can manually prove this is the case, such as modifying existing cookies somewhere in an attempt to recreate the issue, and be confident this is the issue we experience?

JenniferNery · ‎12-26-2018

When map fails to load, you will get a blank MapView.

For example this points to a secured webmap and invalid login or login that has no access to portal item is used.

AuthenticationManager.Current.ChallengeHandler = new ChallengeHandler(async(info) =>
{
    return await AuthenticationManager.Current.GenerateCredentialAsync(info.ServiceUri, "<username>", "<password>");
});
MyMapView.Map = new Map(new Uri("http://www.arcgis.com/home/item.html?id=ebda00bd24264cfabe2a269cae28e309"));‍‍‍‍‍

Could the token-secured credentials have expired?I suspected clearing cookies since new session works for you again.

You can subscribe to Map.Loaded/LoadStatusChanged or MapView.LayerViewStateChanged to see whether map or any of its layers failed to load; perhaps, you'll get more information if it's credential issue.

BjørnarSundsbø1 · ‎01-02-2019

Jennifer Nery‌ I will review error handling tomorrow to see if I can get more details. However, as I only experience the blank map rarely, and only in production, I'm trying to gather more details in regards to possible causes.

- I use Integrated Windows Authentication (I've clarified in the original post)

- Are cookies involved with IWA (I imagine they are)?

- What is their default duration?

- When clearing cookies, do i clear the cookies for individual layer URI or the Portal URI?

- I do not have IWA in development environment, and test environment where IWA is enabled I am not able to develop.

Prokop_Kuranda · ‎06-20-2022

Hello @JenniferNery ,

one customer is experiencing this behaviour in Portal for ArcGIS 10.8.1. May I ask you what is the status of the issue mentioned in your original post? Is there a BUG number or anything I can follow?

Thank you,

Prokop