cannot add Map Services to ArcMap

[TerryGiles]

Config info -
Running Server 10.1 SP1 on Win2008R2; web adaptor via IIS; Security = Win AD users, built in Roles; Security @ web server (IIS)
ArcGIS Desktop 10.1 SP1 on Win7 64 bit ...

We have Server set up and it has several services running on it which we can see in our web apps.  The other day someone tried to add a service to ArcMap, we can't get it to work.  If the user, who is in an Admin role on Server, expands the server connection in Catalog, he can see our services at the root and in subfolders; if he tries to drag/drop a service into ArcMap it returns the error in the attached image.  If he tries to a connection from a User Role, no services/folders show up what so ever - no error message about failing to connect or anything just.

To add to the mystery, we tried adding a service on a PC running 10.0 SP4 and it works just fine....

Anyone have any idea what's going on or where to even begin troubleshooting??

Thanks, Terry

[ZacharyHart]

Terry, that is a bit mysterious. Did you ever find an answer?

[TerryGiles]

I haven't had much time to mess with it, but here's what I've tried and what I think might be happening.  Any input from others, esp. Esri would be appreciated.

Had Fiddler open while trying to connect to the service via the Admin connection -
Connects fine, Fiddler logs 8 different requests going to the server -

http://<server>:6080/arcgis/admin/services/?f=json&token=<big long token string>
http://<server>:6080/arcgis/admin/services/?f=json&detail=true&token=<big long token string>
http://<server>:6080/arcgis/admin/services/<service1>.MapServer/?f=json&token=<big long token string>
http://<server>:6080/arcgis/admin/services/<service1>.MapServer/status/?f=json&token=<big long token string>
http://<server>:6080/arcgis/admin/services/<service3>.MapServer/?f=json&token=<big long token string>
http://<server>:6080/arcgis/admin/services/<service3>.MapServer/status/?f=json&token=<big long token string>
http://<server>:6080/arcgis/admin/services/SampleWorldCities.MapServer/?f=json&token=<big long token string>
http://<server>:6080/arcgis/admin/services/SampleWorldCities.MapServer/status/?f=json&token=<big long token string>
http://<server>:6080/arcgis/admin/services/<service2>.MapServer/?f=json&token=<big long token string>
http://<server>:6080/arcgis/admin/services/<service2>.MapServer/status/?f=json&token=<big long token string>

Looks like this is the initial contact with the server, getting a listing of the services and if they're running or not.

Now when I try to add Service1 to the map, Fiddler shows a request to http://<server>:6080/arcgis/services/<service1>/MapServer which returns a 403 error & the response contains the following body

[HTML]
<h1>HTTP Status 403 - </h1><HR size="1" noshade="noshade">
<p><b>type</b> Status report</p>
<p><b>message</b> <u></u></p><p><b>description</b> <u>Access to the specified resource () has been forbidden.</u></p>
<HR size="1" noshade="noshade">
<h3>Apache Tomcat/7.0.27</h3>
[/HTML]

In the Auth tab in Fiddler it says 'Not Authorization Header is present'.  What I'm guessing is that since I have Server set up to Authorize at the Web Server (IIS w/ Win Auth) making calls from ArcMap bypasses this and are not passing in any kind of user credentials.  But like I said, that's just a guess.  If that's the case, do it mean if your Web Server does Authorization users cannot add services to ArcMap??  What am I missing here??

Thanks, Terry

[TerryGiles]

Just as a follow up if anyone else has similar issues -  it's a bug but there's an easy work around until it's fixed.  Info from tech support -
Bug NIM088319

ANALYSIS: It appears that ArcGIS for Desktop always attempts an HTTPS connection to the web adaptor regardless of its configuration.  If the initial connection over HTTPS is confirmed by IIS, ArcGIS for Desktop will take this to mean that ArcGIS Server is listening on HTTPS and attempt subsequent HTTPS connections.  If one of those connections fails, ArcGIS for Desktop will fail-over to a logic pattern of connecting to port 6080 on the same machine.

Workaround: Either remove the HTTPS binding on IIS for the site on which the web adaptor is hosted, or configure ArcGIS Server to listen on HTTPS thereby closing the loop.
To configure HTTPS on the ArcGIS Server go to the admin console >Security > config > Update and select "HTTP and HTTPS."