Latest Contributions by JeffSmith

Hi Zahid, That is expected behavior.  The option to store credentials when collaborating between Online and Portal does not exist when sharing a secured service.  If you want to store credentials for the service from the partner organization, the service url would need to be manually added to the Content page on your portal. ... View more

Yes, that issue is unique to 10.8.  It did not exist in earlier releases.  For the issue you are seeing at 10.6.1, is there a forward proxy in your Portal environment that is used to provide external access to the Internet?  You mentioned that you can access ArcGIS Online with the service account but that account might be using a proxy configured at the OS level. One way to check is to open Internet Options from the Control Panel, select the Connections tab, and click LAN settings.  This lists any proxy configurations. If you are using a proxy server, you would need to configure your Portal to use the same proxy.  Information on how to do that can be found here. Configure your portal to use a forward proxy server—Portal for ArcGIS (10.6) | Documentation for ArcGIS Enterprise  ... View more

Unfortunately this has not been solved in 10.8.1 and I'm not aware of a public BUG logged for this yet.  It might be helpful to contact our Support team to have one logged for this. ... View more

Yes, what you are seeing in the debug logs there is a separate issue (relatively minor in my mind).  When the linked enterprise group is added or changed, we have logic in place to automatically clear and refresh the group membership.  This works great for Windows or LDAP enterprise groups but cannot be done for SAML groups because there is no way to query a SAML idp.  The bug here is that with SAML groups enabled, it should only clear the existing group membership and not attempt to do a refresh.  Fortunately this does not appear to be breaking anything.  The group membership is still getting cleared as expected and the attempted refresh is simply failing.  It does cause confusion though when looking at the debug logs.   ... View more

Hi, Technically you should still be able to establish a distributed collaboration between 2 portals even if the host portal cannot reach the guest portal.  You might be running into a bug found in 10.8. BUG-000130268 -  Distributed collaboration fails to import response when host portal cannot resolve peer. This has been fixed in 10.8.1.  The workaround would be to follow the suggestions Thomas made to ensure the host portal can communicate with the guest portal when logged in as the portal service account. ... View more

Thanks for checking.  From your previous message it looks like you have all three of your SAML-TEST groups linked to the same 'gis-esriportal' group.  Is that correct?  There is an outstanding issue related to having multiple Portal groups linked to a single SAML enterprise group.  The behavior is inconsistent.  Can you confirm in your production environment if you have more than one Portal group linked to a single SAML group? ... View more

Based on the logs it looks like you might have a "Windows" group store configuration defined in Portaladmin > Security > Config.  Can you double-check that?  The refresh group membership logs that are appearing when it fails are unique to Windows or LDAP group store configurations.  The SAML enterprise group logs match the first one and the last one where it worked.   Currently it is possible to enable SAML enterprise groups when you configure SAML and also have an Active Directory or LDAP group store defined in portaladmin.  When this happens they conflict with each other and you see weird results.  We are working on an enhancement to only allow one or the other. ... View more

Nicholas, I agree with you.  It sounds like it has something to do with the old accounts that have been upgraded from earlier releases.  Have the enterprise accounts on your production system been through multiple upgrades or were those accounts created at 10.7.1?   I can't think of too much that was added for users between 10.7.1 and 10.8 but if they are older, there could be something else.  The group refresh is supposed to occur every time a user logs in, not just when the account gets created.  The debug logs should reveal the group refresh during login.  Do you see anything there? ... View more