Latest Contributions by JeffSmith

Hi Dean, No, Esri has not released an official mitigation script to address any of these log4j 1.x vulnerabilities.  That being said, we are actively working on patches for all components of ArcGIS Enterprise that will update the log4j 2.x jar files to 2.17.1 and remove the vulnerable classes from the log4j 1.x jar files.  We can't provide a release date for them but they are taking the highest priority right now. As you and Randall have mentioned, there are dependencies on some of the log4j 1.x so those jar files cannot just be deleted and replaced with the 2.x jar files.   ... View more

Unfortunately that is one downside to storing credentials for a secured service.  When editing a secured feature service with stored credentials, I'm not aware of a way to capture the org member's username instead of the username from the stored credentials.   ... View more

Not sure if you've gotten this resolved yet or not.  It sounds like when you stopped the ArcGIS Server service, the javaw.exe process did not stop correctly.  This would keep a lock on those jar files and generate the error you observed.  If you kill that process, that should allow you to run the script. To check if all processes are stopped after stopping the service, I use the task manager and sort the processes by the username.  If you are using a unique service account for ArcGIS Server, it is pretty easy to confirm nothing else is running.  This of course won't work if the service account is used for other services as well. ... View more

Hi @MarcoMattioli  Yes, Portal fully supports using secured cookies.  I'm not sure what version of Portal you are using but if your Portal is configured to use HTTPS only (under Organization > Settings > Security), then the esri_auth cookie should have the secure flag enabled automatically. ... View more

@Anonymous User  Thanks for the suggestion.  I will review the documentation and try to add a warning concerning the potential impact of having SAML enterprise groups enabled along with an Active Directory or LDAP group store defined in portaladmin.  Regarding your question on groups, yes, when SAML enterprise groups are enabled, you can still create Portal groups whose memberships are managed by the group owner.  This option is never disabled. When SAML enterprise groups are enabled, you still go through the same workflow when creating new groups.  You are just provided an additional option for how members are managed: managed by the group owner or managed by SAML logins.  If the membership is managed by SAML, only enterprise users can be members and they are only added to the group after they login.  Built-in portal members cannot be added to these groups.  If the membership is managed by the group owner, there are no restrictions and both enterprise or built-in portal members can be added or removed as desired. ... View more

No, unfortunately the issue related to having multiple Portal groups linked to a single SAML enterprise group is not fixed in 10.9.  We are hoping to have it addressed in 10.9.1. ... View more

You can completely disable the map viewer beta by editing the config.js file located under <Portal install directory>\customizations\10.8.1\framework\webapps\arcgis#home\js\arcgisonline. Once opened, search for "newMapViewerEnabled" and set it to false.  After saving and restarting the Portal service, you should no longer get any map viewer beta pop-ups. ... View more

Hi Zahid, That is expected behavior.  The option to store credentials when collaborating between Online and Portal does not exist when sharing a secured service.  If you want to store credentials for the service from the partner organization, the service url would need to be manually added to the Content page on your portal. ... View more

Yes, that issue is unique to 10.8.  It did not exist in earlier releases.  For the issue you are seeing at 10.6.1, is there a forward proxy in your Portal environment that is used to provide external access to the Internet?  You mentioned that you can access ArcGIS Online with the service account but that account might be using a proxy configured at the OS level. One way to check is to open Internet Options from the Control Panel, select the Connections tab, and click LAN settings.  This lists any proxy configurations. If you are using a proxy server, you would need to configure your Portal to use the same proxy.  Information on how to do that can be found here. Configure your portal to use a forward proxy server—Portal for ArcGIS (10.6) | Documentation for ArcGIS Enterprise  ... View more

Unfortunately this has not been solved in 10.8.1 and I'm not aware of a public BUG logged for this yet.  It might be helpful to contact our Support team to have one logged for this. ... View more

Yes, what you are seeing in the debug logs there is a separate issue (relatively minor in my mind).  When the linked enterprise group is added or changed, we have logic in place to automatically clear and refresh the group membership.  This works great for Windows or LDAP enterprise groups but cannot be done for SAML groups because there is no way to query a SAML idp.  The bug here is that with SAML groups enabled, it should only clear the existing group membership and not attempt to do a refresh.  Fortunately this does not appear to be breaking anything.  The group membership is still getting cleared as expected and the attempted refresh is simply failing.  It does cause confusion though when looking at the debug logs.   ... View more