Latest Contributions by ChristopherPawlyszyn

Hopefully this documentation covers what you are looking for, but let me know if you have any additional questions. ArcGIS Server is typically the only core component that would be connecting to the underlying databases directly.   Update information for a registered or managed database | Register your data with ArcGIS Server https://enterprise.arcgis.com/en/server/latest/manage-data/windows/registering-your-data-with-arcgis-server-using-manager.htm#ESRI_SECTION1_01665D7E33384062B6A57DE89A52C2FA ... View more

Can you test locally with port 7443 for each Portal machine and the web adaptor (if present)? That would tell us whether the delay is indeed introduced by the ELB or if there is something else going on in the deployment. Additionally it may be useful to enable access logging on the ELB for some insight into the web requests in transit. ... View more

Did you make sure proper permissions were applied for the new service account?   The service account should have full control over the arcgisportal directory (C:\arcgisportal by default) and all subdirectories within the installation location (C:\Program Files\ArcGIS\Portal by default) with the exception of License, scripts, support, and zips, which are read access. ... View more

Did you configure a WebContextURL in Portal Admin -> System -> Properties? If not, you may want to confirm your web adaptor is registered using the proper public-facing URL in Portal Admin -> System -> Web Adaptors -> <WA_ID>. If the URL is listed as the FQDN of the machine, you can either update the WA registration to the correct URL by appending /edit to the URL or you can set the WebContextURL. ... View more

Since ArcGIS Notebook Server notebooks run in the context of a Linux container, the two approaches for making files available within the container are to upload to the user's workspace or mount a data directory for all users to access.   Work with content in the user workspace—ArcGIS Notebook Server | Documentation for ArcGIS Enterprise https://enterprise.arcgis.com/en/notebook/latest/use/windows/work-with-content-in-a-user-workspace.htm Configure ArcGIS Notebook Server directories—ArcGIS Notebook Server | Documentation for ArcGIS Enterprise https://enterprise.arcgis.com/en/notebook/latest/administer/linux/configure-and-manage-arcgis-notebook-server-directories.htm#ESRI_SECTION1_77CF490C030C4578BC8BB87869204E18   Hopefully that matches up with what you're trying to accomplish. ... View more

Portal for ArcGIS uses the alias 'samlcert' to define which keypair is used for encryption/decryption of the assertion or signing of the SAML request. The steps are listed in the documentation, but essentially you delete the 'samlcert' certificate that was shipped with the product, then import a new certificate using the same alias. In a high availability Portal for ArcGIS site, you'll need to use the same certificate for both machines.   "The Encrypt Assertion and Enable signed request settings use the certificate samlcert in the portal keystore. To use a new certificate, delete the samlcert certificate, create a certificate with the same alias (samlcert) following the steps in Import a certificate into the portal, and restart the portal." From https://enterprise.arcgis.com/en/portal/latest/administer/windows/configure-adfs.htm ... View more

Further down in that document it describes the specific IAM permissions required for Portal for ArcGIS and ArcGIS Server when using S3/DynamoDB, the resource policy you attached is for the deployment IAM user when using the CloudFormation templates or Cloud Builder application. I've attached the ArcGIS Server subsection as a reference below, hope that helps!   Store the ArcGIS Server configuration store directory in S3 and DynamoDB https://enterprise.arcgis.com/en/server/latest/cloud/amazon/iam-roles.htm#ESRI_SECTION1_5D9D294F8701436F9C99C5CB03A16B1E ... View more

You'll need to try to work with Support through a case on this, there are multiple cautions against modifying the group sharing and ownership settings of those items sprinkled through the documentation and each situation would be slightly different in terms of approach.   Configure ArcGIS Living Atlas content—Portal for ArcGIS | Documentation for ArcGIS Enterprise https://enterprise.arcgis.com/en/portal/latest/administer/windows/configure-living-atlas-content.htm ... View more

The samlcert alias is a self-signed certificate used for signing SAML requests to an external identity provider. Since it's self-signed, you can just use the 'Generate' operation from the machine endpoint of the Portal Admin API. I've attached the reference documentation plus a screenshot of the appropriate settings (just replace <FQDN> with your machine's fully-qualified domain name), that should put things back in place!   Generate a new certificate | Import a certificate into the portal | Portal for ArcGIS https://enterprise.arcgis.com/en/portal/latest/administer/windows/import-a-certificate-into-the-portal.htm#ESRI_SECTION1_31E574D0346C4DF1BBC9EDECE722A8F4 ... View more

In a federated ArcGIS Server site, the Portal for ArcGIS site that it is federated with takes over the control of the security of the site. This means that redirection to the OAuth2 endpoint for Portal will verify the redirect URI and make sure it's one of the recorded, allowed entries. In this case, only the Services and Admin URLs used during federation would be allowed URIs for secured services, otherwise any other DNS alias or the IP address will return the invalid redirect error message.   Are you having issues with accessing the REST Services page using the correct URLs? ... View more

Here's the documentation regarding the restriction of the proxy capability, you would need to add the hostname of the Admin URL to that value to allow the proxy to pass traffic. Hope that helps!   Restricting the portal's proxy capability—Portal for ArcGIS | Documentation for ArcGIS Enterprise https://enterprise.arcgis.com/en/portal/latest/administer/windows/restricting-the-portal-s-proxy-capability.htm ... View more

To login with users from two separate domains when using Integrated Windows Authentication, the domains must be part of the same AD forest. There are additional considerations you'd need to work with your IT team on, especially making sure that the specified user is allowed to query both AD domain users and groups (if used) as well as confirm the Portal identity store configuration is pointed at a global catalog domain controller within the forest.   "Using an Active Directory identity store, ArcGIS Enterprise supports authentication from multiple domains with a single forest, but does not provide cross-forest authentication." From https://enterprise.arcgis.com/en/portal/latest/administer/windows/use-integrated-windows-authentication-with-your-portal.htm   Configure the domain controller used by Portal for ArcGIS—Portal for ArcGIS | Documentation for ArcGIS Enterprise https://enterprise.arcgis.com/en/portal/latest/administer/windows/configuring-the-domain-controller-used-by-portal-for-arcgis.htm ... View more

If an SSL certificate chain trust issue is still present, you would typically see an entry in the Portal warning-level logs that a PKIX path-building error occurred, the certificate expired, or a CN/SAN mismatch was present. The Portal needs to trust the certificates presented by the Admin URL of the federated Server site(s) to query that information, so that's a good place to start. Another possibility is that the host in the Admin URL is not in the 'allowedProxyHosts' if those are locked-down in your Portal's security config (located in the Portal Admin endpoint).   Support should be able to help you identify the issue if you're able to submit a case. ... View more