Latest Contributions by JTessier

Thanks Angus.   Yeah our hostnames do not have "arcgis" in their hostnames.  We will have to reach out to esri support.  Something very funky going on with the environment we are in, it seems. ... View more

We also are seeing this issue on one of our boxes - very similar infrastructure in all regards.   Were you able to figure it out @angus?  Was FIPS encryption an issue?  We are looking to check that next, and then will reach out to support. ... View more

Same request as what John suggests above, but for Portal for ArcGIS. If the user is logged into Portal already (via a separate tab even) then why would a direct link to the resource data not work? ... View more

Excellent, thanks Jonathan! ... View more

Also, the doc specifically mentions this step for a hosted server, but I would now think based on your details above that it would apply to a non-hosted federated site as well, thus my next question below (came before this comment and replied incorrectly to full item). ... View more

Thanks Jonathan,  anyway to change the Private Portal Url after the AGS site has already been federated?  In a config file or registry somewhere on the ags servers? ... View more

Thanks Jonathan, we are in an HA configuration and thus will be setting that value.  So is the workflow in HA?: 1) AGS tries a machine name of the primary Portal server first.  2) If that doesn't respond it uses this Private Portal Url to try a second time (to get to the HA server)?  Or if this value exists, AGS always uses it to communicate to a Portal in an HA config? Next, how critical is it for this from the doc: (Step 8 - http://enterprise.arcgis.com/en/portal/10.5/administer/windows/configuring-a-highly-available-portal.htm) Note: Do not set the X-Forwarded-Host header for this URL. Finally, per this thread, does Pro or desktop use this url too? ... View more

Any more word on this Private Portal Url and what it is and isnt used for? ... View more

We also have this requirement, specifically for http headers and would like to know if it is possible. Thanks! ... View more

I also have this question, though my focus is on the main question from a performance standpoint and when the data is stored in SDE (Oracle): Which is the better solution in terms of performance and resource usage on the AGS Server - a max record count of 400K on a map service or creating a feature service for the layer? ... View more

Is adjusting the token-refresh the best/only way to solve the issue?  Is there not a simpler javascript timeout (or other) solution that might, similar to bank apps tell the user they have been inactive for 10 minutes and let them know their session will end without activity in 5 more minutes?  If no activity, delete the esri cookie after a certain amount of time and sign the user out?  ... View more

Is adjusting the token-refresh the best/only way to solve the issue?  Is there not a simpler javascript timeout (or other) solution that might, similar to bank apps tell the user they have been inactive for 10 minutes and let them know their session will end without activity in 5 more minutes?  If no activity, delete the esri cookie after a certain amount of time and sign the user out?  ... View more

Hi Tom,     It might be easiest to provide a certain scenario to paint the best picture.   Our organization is separated into different geographical regions and each Regional Manager needs to have some autonomy and control of the content they are (and aren't) sharing.  As you note, custom role privileges are portal-wide and thus if a role was setup that had Update all content for example, they could affect all content across the Org.  What they mostly need however is to control who can do what in the Regional Groups they have setup.  For example, they may want a 3 people in the region to contribute to a certain group and all the rest of the folks in that region need to be able to only view this content.  In the Portal at 10.3.1 (and I think beyond) only options for Contributors are: "All Members" or "only group owner."  So if you take the "only group owner" option, you have one person who has to re-share content of the other 2 folks if they want to meet this workflow.  And "re-sharing" is not a real supported workflow for non-built-in admin users (though it looks like it is due to a bug, but that is a different story and bug submission).  In fact the group owner in this situation would need to be part of a custom role that can re-assign ownership (uh-oh Portal-wide privilege!) , change ownership of the item to themselves, share it to the group, and then (hopefully) change ownership back to the other member who created it/maintains it.  Certainly not ideal as we don't want users from one region able to necessarily see or change ownership of the content for other regions.   Option 2:  Allow all members to contribute means that we could not provide that read-only view of the content to other specific members of our region.  Perhaps we could if we shared the group to the entire organization but then that opens up that content to a much wider audience than desired.  Again a situation the Regional Managers don't want.   Finally, it could be suggested that each region needs their own portal but that seems to be a wrong choice for several reasons: As of this writing, portals cannot federate with each other, and even if they could this would be super expensive and overkill for this one seemingly small group control that might be implementable for Groups. Let me know if you have any more questions.  We banged on Portal privileges for quite awhile trying to see if we could come up with a better solution than one of the above and couldn't.  Thus this idea/request. Thx, J ... View more