Errors in survey123.arcgis.com when using Portal 10.7.1

[PeterT_Brisbane]

We have a newly established 10.7.1 portal - behind a firewall and I'm having trouble connecting it to survey123.arcgis.com

I've followed the instructions Use Survey123 with ArcGIS Enterprise—ArcGIS Survey123 | Documentation 

I've managed to publish a demo survey from Connect to the portal.  

I can login to the survey123.arcgis.com and I can see the survey on my Portal.

But as soon as I get into any of the tabs it just sits there and sometimes gives errors.  Tracking the traffic I'm getting a few requests failing. That when those requests are opened independently they work. 

We've added https://survey123.arcgis.com/ to the cross domain in the ArcGIS Server admin

Restrict cross-domain requests to ArcGIS Server—ArcGIS Server | Documentation for ArcGIS Enterprise 

We've added https://survey123.arcgis.com/ to the "Allow Origins" in Portal settings.

Anything I'm missing?

[ZhifangWang]

Hi GIS Unit PSBA‌,

It seems that when connecting to your 10.7.1 portal on the Survey123 website, the website can get information from your portal, e.g. the form item's details, but it cannot get information for the underlying feature service of the form item.

Can you please provide more information to help us investigate?

1. Just to confirm, the machine that the browser works on can access the behind ArcGIS Server, right? "That when those requests are opened independently they work. ", did you mean just double click the red request in the screenshot and open it in a new tab of the browser can return correct result?
2. Does the survey use a hosted feature service in the portal or a non-hosted feature service directly from the behind ArcGIS Server?
3. Does this issue occur just after 10/15 (we had the 3.11 release deployed on 10/15) and the workflow works as expected before 10/15 or you just set up the environment on 10/15 and we cannot know if it works with the previous 3.10 release?

Thanks,

Zhifang

[PeterT_Brisbane]

Hi Zhifang Wang

We're running a clean install of GIS Enterprise 10.7.1 Dev Portal and I've just created that Hydrant Inspection app using the template provided.

The issue above was that the CORS settings url was slight wrong.  Restrict cross-domain requests to ArcGIS Server—ArcGIS Server | Documentation for ArcGIS Enterprise 

We also added https://survey123.arcgis.com to the cross domain settings within the Portal security settings.

So we got the survey123.arcgis.com web app working successfully with our behind the firewall Dev Portal.

Our next problem we hit was that the Survey123 mobile app wasn't able to connect via our F5 VPN on our iphones to the portal authentication even though Explorer worked all OK.   We're talking to our local ESRI support and our internal cybersecurity to work out what is going on.    It might be that Survey123 is sending traffic outside the F5 VPN. 

We might be having similar issues with Collector also, though Collector is authenticating OK with Portal, it's not listing any Collector maps even though we're sure we've got Collector compatible maps - with "Use in Collector for ArcGIS" ticked.

Thanks,

Peter

[ZhifangWang]

GIS Unit PSBA‌,

Glad to know you can connect Survey123 website with your portal now and thanks for sharing the information with us.

For the Survey123 mobile app (field app) issue, did you mean when connecting to your VPN, ArcGIS Explorer works all as expected, ArcGIS Collector can sign in to the portal, bug Survey123 field app cannot even sign in? Do you know if there is any special setting on your VPN? E.g. allow special apps to communicate or only allow a pre-defined domain list.

[PeterT_Brisbane]

On the VPN Explorer works as expected, Collector is signing in but no maps are showing, and Survey123 won't even let us sign in.     Given Collector and Explorer can sign in to the Dev server and S123 can't??      Is the some strange traffic that goes via Survey123.arcgis.com?

We're not even getting to the stage in S123 where it's asking for the login, it just can't reach the portal.  "Connection refused"  

We're about to get access to two more Portals - one via VPN again and one external via the internet.  All 10.7.1 and all authenticating via Azure.   So I'll be testing all scenarios.

Meanwhile cybersecurity has access and maybe they can work out what's going on.

[JamesTedrick]

GIS Unit PSBA‌,

Continuing from Zhifang's questioning, can you provide details about the VPN setup? Is it  whole-device or per-app VPN?  It would also be helpful to get a troubleshooting log of the login attempt - see Troubleshoot—ArcGIS Survey123 | Documentation (you can turn on login without selecting a console to write it to a text file).

I will note that this may be more efficiently addressed through an Esri Support ticket than GeoNet.

[PeterT_Brisbane]

Hi James,

Thanks for replying. It's a whole device VPN.  

I got the log out of S123. addPortal error

We have a support ticket with ESRI Australia (submitted by a member of my team) - Still open.   

https://my.esri.com/#/support/cases/02662088