POST
|
Ok, so after lot of debugging, we were able to identify that ArcGIS Server blows the server up when starting one specific service: RAM goes up to 40 Go ! This is the reasons why increasing "non-interactive desktop heap size" did not solve the issue. It seems like there is memory leak somewhere... Debugging with support in progress...
... View more
06-13-2024
12:25 AM
|
0
|
0
|
277
|
POST
|
Hmmm pretty sure this article will help: https://support.esri.com/en-us/knowledge-base/problem-unable-to-publish-new-or-start-existing-service-000001218 Will give it a try...
... View more
06-11-2024
02:06 AM
|
0
|
0
|
364
|
POST
|
Did you try to open the URL once logged on the VM hosting ArcGIS Server ? It might be that your personnal computer has the required CA intermediate certificate but maybe not the server running ArcGIS Server. Just making sure it is not the same issue.
... View more
06-11-2024
12:59 AM
|
0
|
0
|
674
|
POST
|
Hello, Migrated to 11.3, I am facing an issue: ArcGIS Server keeps crashing after reboot. Running on Windows Server 2022 which each component of ArcGIS Enterprise installed on its own machine: 16 CPU and 60 Go RAM which seems to me like a good VM. After restarting the services, it crashes and the VM is freezed (required a reboot from cloud interface). In Windows event viewer the following is logged: In ArcGIS Server logs, I have: <Msg time="2024-06-11T09:00:54,317" type="SEVERE" code="8003" source="Secu/Risks_Prod_Site.MapServer" process="9996" thread="33" methodName="" machine="GISSERVER.COMPANY.COM" user="" elapsed="0.0" requestID="">Failed to initialize server object 'Secu/Risks_Prod_Site': 0x80043007: </Msg> for few services and then it stops suddenly requiring several reboots to make it back alive but then the issue occurs once again. The issue only occurs on federated server and not hosted. It has around 80 services published... Any help would highly appreciated ! Thanks
... View more
06-11-2024
12:56 AM
|
0
|
2
|
413
|
POST
|
Hi @Cory__Williams, Thanks for your reply. I believe I found the problem: it's an issue with SSL certificate. If you try to browse the URL of the external service from the ArcGIS Server's machines, do you get a certificate error ? In my case it was the case. There was a misconfiguration on my side. It's fixed now. But with external services, that might be more difficult.
... View more
06-10-2024
08:31 PM
|
0
|
1
|
692
|
POST
|
Hello @Cory__Williams , Thanks for sharing ! Currently debugging the same issue. Can't print our secured services since the upgrade to 11.3. Eithter from a custom print service I am getting the following: ` ConvertWebMapToArcGISProject return webmap_tuple(*_convertArcObjectToPythonObject(arcgisscripting._mapping.ConvertWebMapToArcGISProject(*_gp_fixargs([webmap_json, template_pagx, mapframe_name, notes_gdb, report_template], True)))) RuntimeError: Failed to create layer from service at` Or from the MapViewer. This is really bad news 😕
... View more
06-07-2024
09:26 PM
|
1
|
0
|
840
|
POST
|
Thanks @Scott_Tansley for your reply. But that what I mean: export site / import site on standby does not behave the same as a webgisdr restore. When I tried that, the standby ArcGIS Server started pointing to my production shared directories ! I wonder if it did not deploy the folder to them as well ! Fortunately, it was without consequences...
... View more
06-06-2024
12:47 AM
|
0
|
1
|
403
|
POST
|
Hello, Running quite often webgisdr backup and restore to standby environment to maintain availability while upgrading the "master" one, I really miss a functionnality: being able to restore a single specific component (ArcGIS Datastore, ArcGIS for Server, Portal for ArcGIS). Something like: webgisdr --import --file C:\propfiles\toimport.properties --component Server It happened quite few times a full webgisdr restore fails at some step (eg: restore of Federated Server or Portal for ArcGIS). For example, lately I got a "Connexion reset" after restoring an ArcGIS Server. Rebooting Server fixed it strangely... But then I had to rerun a full webgisdr restore and wait again 10 hours for unzipping / restore relational datastore / restore tileCache datastatore / restore hosting server. It's a big waste of time and very annoying when planning an intervention ! You basically need to postpone for the next day. I don't think this functionnality exists. There are the export/import site operations avaible for both Portal for ArcGIS and ArcGIS for Server but I am under the impression that it is solely meant to be used on the "master" environment and not the standby. For example, ArcGIS Server directory paths must be the same while with webgisdr it is not required: https://enterprise.arcgis.com/en/portal/latest/administer/windows/overview-disaster-recovery-replication.htm#ESRI_SECTION1_C2CCF3D59BAE4F93AAF841EED439FE2F So I guess webgisdr is doing some additional/different configurations while importing the exported site located in the webgisdr zip file. Any thought about it @JonathanQuinn maybe ? Did I miss anything ? I would love to be wrong ! Thanks, Best regards, Nicolas
... View more
06-06-2024
12:35 AM
|
0
|
4
|
420
|
POST
|
Hi @simoxu , Thanks for your reply. Been tried on WS2019 and WS2022. Requirements are met (if CPU is a different model than the one I listed, it works). The error message seems to be related to CPU: [JDK-8271324] [lworld] java/foreign/* tests fail with "guarantee(sect->end() <= tend) failed: sanity" - Java Bug System (openjdk.org)
... View more
06-03-2024
04:54 AM
|
0
|
3
|
834
|
POST
|
Hello, I am facing an issue with the new 11.3 setups of ArcGIS Server and ArcGIS Datastore: service won't start after a successfull installation. Portal for ArcGIS works. I found out there is an installation log at 11.3 in "C:\Program Files\Arcgis\Server\framework\support", where the following error is logged: # A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (codeBuffer.cpp:972), pid=7088, tid=3008
# guarantee(sect->end() <= tend) failed: sanity
#
# JRE version: (17.0.10+7) (build )
# Java VM: OpenJDK 64-Bit Server VM (17.0.10+7, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, windows-amd64)
# Core dump will be written. Default location: C:\Windows\system32\hs_err_pid7088.mdmp
#
# An error report file with more information is saved as:
# C:\Windows\system32\hs_err_pid7088.log But as if it was not a systematic issue, I understood it was related to the CPU of the VM which is: Intel(R) Xeon(R) Gold 6326 CPU @ 2.90GHz On some other CPU, it works. With previous versions of the setup (11.1/11.2), it works. Anyone else ? I guess one shall verify the setup works on the same CPU as the VM which is upgraded otherwise it could be a big issue I guess ! I feel lucky I realized this issue before upgrading a VM with a problematic CPU ! Thanks, Nicolas /cc @CedricDespierreCorporon
... View more
05-31-2024
06:58 AM
|
0
|
9
|
957
|
IDEA
|
Hi @AnninaHirschiWyss, Thanks for the support ! I keep pushing every month for this feature without any success so far... We will have to implement it our own unfortunately viewModel I am afraid 😕
... View more
05-30-2024
05:17 AM
|
0
|
0
|
261
|
POST
|
Actually, this BUG is a duplicate. This security vulnerability is known and logged since 2022 and still being analysed as: BUG-000150121: When Portal for ArcGIS participates in an SLO SAML flow, it fails to redirect to the identity provider (IDP) following the session invalidation
... View more
04-25-2024
08:35 AM
|
0
|
0
|
266
|
POST
|
Logged as: BUG-000166664: There is a security issue because of Portal for ArcGIS SAML logout behavior: it does not propagate logout to identity provider and as a consequence, users remains logged in which is a security vulnerability
... View more
04-12-2024
03:06 AM
|
0
|
0
|
299
|
POST
|
It's really weird, the bug does not evolve... Still being analyzed while support was able to reproduce... I am afraid it won't even make it to 11.3 at this speed...
... View more
04-03-2024
09:20 AM
|
0
|
0
|
558
|
POST
|
Hello, Many users in my organization are complaining about a security issue because of Portal for ArcGIS SAML logout behavior: it does not propagate logout to identity provider and as a consequence, users remains logged in which is a security vulnerability. I noticed the following: "Propagate logout to Identity provider" only works if logged in directly on Portal for ArcGIS (ie: OAuth client id ="arcgisonline"). If you are logged in on Portal for ArcGIS through an OAuth application (ie: OAuth client id ="o8WEYheNpQcE2dwwh"), then when signing out from another application, Portal for ArcGIS does not propage the logout and instead displays the following window: Let's illustrate this workflow with the diagram below: source: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02_html_m50a2ba3e.gif Let's say "sp2.example.edu" is Portal for ArcGIS. 1. Working scenario when logged in directly on Portal for ArcGIS: User is logged in on both Portal for ArcGIS and sp1.example.com and the user request a global logout from sp1.example.com. At step 3, Idp make a POST to sharing/rest/oauth2/saml/signout and the reply is the following: <!DOCTYPE html>
<html>
<head>
<title>Posting request..</title>
<link href="/geoportal/sharing/rest/files/gw.css" rel="stylesheet" type="text/css"/>
<script language="javascript">
window.onload = function(e) {
document.forms[0].submit();
};
</script>
</head>
<body>
<form name="f" action="https://idp.example.org/auth/realms/company/protocol/saml" method="post">
<input type="hidden" name="SAMLRequest" value="foo" />
<input type="hidden" name="RelayState" value="bar" />
</form>
</body>
</html> Note the form that will POST to Idp with "SAMLRequest" and "RelayState" parameters in order to sign out from Idp. It corresponds to step 4 and it works. Now, let's compare it with the broken scenario: 2. Broken scenario when logged in indirectly on Portal for ArcGIS through an OAuth application: User is logged in on Portal for ArcGIS indirectly through an OAuth application and on sp1.example.com and the user request a global logout from sp1.example.com. At step 3, Idp make a POST to sharing/rest/oauth2/saml/signout but this time the reply is the following: <html>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<meta name="referrer" content="origin">
<title>Sign In</title>
<script src="/geoportal/sharing/files/scripts/detector.min.js?__ARTIFACTID__"></script>
<link rel="stylesheet" href="/geoportal/sharing/files/css/site.min.css?__ARTIFACTID__">
<script src="/geoportal/sharing/files/scripts/theme.min.js?__ARTIFACTID__"></script>
<script>
var oAuthInfo = {"contextPath":"/geoportal/sharing","originSignin":false}
window.setTheme(oAuthInfo, "/geoportal/sharing");
</script>
<script src="/geoportal/sharing/files/scripts/oauth2.js?__ARTIFACTID__"></script>
</head>
<body>
<div class="content"></div>
</body>
<script>
oAuthInfo.locale = ((oAuthInfo.locale && oAuthInfo.locale === "iw") ? "he" : oAuthInfo.locale);
require.config({
baseUrl: "/geoportal/sharing/files/scripts/",
locale: oAuthInfo.locale && oAuthInfo.locale.toLowerCase() || ""
});
require(["signout-new", "domReady!"], function (signUp) {
signUp.startup(oAuthInfo);
});
</script>
</html> which ends up to the page "You have been successfully signed out". So coming back to our diagram, there is no longer a POST back to IDP and the logout process from IdP is broken in the middle because of Portal for ArcGIS. As a consequence, users are still logged in and as mentionned in the documentation: If the user's web browser cache is not cleared, attempting to immediately sign back in to Portal for ArcGIS using the enterprise login option will result in an immediate login without needing to provide user credentials to the SAML identity provider. This is a security vulnerability that can be exploited when using a computer that is easily accessible to unauthorized users or to the general public. Note that if you disable the "Propagate logout to Indentity Provider" option, you will have the same phenomena as in "Broken scenario when logged in indirectly on Portal for ArcGIS through an OAuth application" when logged in directly to Portal for ArcGIS. As a conclusion, to me, the option "Propagate logout to Indentity Provider" should apply for all oauth client application ("argisonline" and all the others) and not solely to Portal for ArcGIS client. Anybody else observing the same phenomena ? Any comments ? Did I miss anything obvious ? Thanks, Nicolas /cc @CedricDespierreCorporon
... View more
03-21-2024
12:51 AM
|
0
|
2
|
587
|
Title | Kudos | Posted |
---|---|---|
1 | 07-27-2024 12:23 AM | |
1 | 06-14-2024 08:27 AM | |
1 | 06-14-2024 11:54 AM | |
1 | 06-07-2024 09:26 PM | |
1 | 03-04-2024 11:37 PM |