Problem with 10.1 Web Adaptor

11026
17
07-03-2012 11:48 AM
by Anonymous User
Not applicable
Original User: cspurlock

I have done the 10.1 Server install and the Web Adaptor.  In Server Manager I have set up the server to use Windows Authencation.  Here is my problem.  I have published a service.  I remote into the server where I have ArcGIS 10.1 installed. I log into Server Manager and go to Manage Services.  I see the service I created.  Here is a screen shot:

[ATTACH=CONFIG]15732[/ATTACH]

If I select the Rest URL or Soap URL I get the following error:

[ATTACH=CONFIG]15733[/ATTACH]

I have ArcGIS Server and the Web Adaptor installed on the same server.
17 Replies
IainCampion
New Contributor III
I have had some problem with this as well ...

one solution u need to check is ..

make sure the IIS arcgis virtual directory has

Authentication
+nt auth enabled
+ anonymous disabled

also check out the providers once you have selected the windows authentication ... and select providers ..

make sure the NTLM is first ...

The rest service via IIS worked after I did this, but the non web adaptor port still doesn't for me ...

plus I have a few issues .. trying to publish map services now ..

hope this helps ...

Coomsie 😛
0 Kudos
by Anonymous User
Not applicable
Original User: cspurlock

I have had some problem with this as well ...

one solution u need to check is ..

make sure the IIS arcgis virtual directory has

Authentication
+nt auth enabled
+ anonymous disabled

also check out the providers once you have selected the windows authentication ... and select providers ..

make sure the NTLM is first ...

The rest service via IIS worked after I did this, but the non web adaptor port still doesn't for me ...

plus I have a few issues .. trying to publish map services now ..

hope this helps ...

Coomsie 😛


My authentication and providers are set up correctly.
0 Kudos
IainCampion
New Contributor III
And you have entered the shared key in both the web adaptor setup and the security dialog ..?
0 Kudos
by Anonymous User
Not applicable
Original User: cspurlock

And you have entered the shared key in both the web adaptor setup and the security dialog ..?


Yes I have.
0 Kudos
PF1
by
Occasional Contributor II
Have you granted permissions to any services (or the root) for the 'users' role/group?  I've had similar issues and solved it like coomsie did.  We followed this basic procedure and can get it to work ok. 

    ArcGIS Manager->Security->Settings: Configure the GIS 'SITE' for 'Windows Domain' user/role store. 

    ArcGIS Manager->Security->Settings: Configure the GIS 'SITE' for 'Web' Authentication tier

    ArcGIS Manager->Security->Settings: Generate 16 random chars for the shared key

    Windows Server: Install the web-adaptor on a seperate machine with IIS7

    IIS->Default Web Site->arcgis->Authentication: Disable Anonymous access to the 'arcgis' virtual directory

    IIS->Default Web Site->arcgis->Authentication: Enable Windows Authentication in the 'arcgis' virtual directory

    IIS->Default Web Site->arcgis->Authentication->Windows Authentication->Providers: Move 'NTLM' to the top of the list
    Restart IIS
    Configure ArcGIS Web-Adaptor: Username/password is the ArcGIS Server Primary account.  Shared key is same key as above when configuring security in the GIS 'Site'.  You can find the key if you've lost it by logging in to a server in your site and going to: http://localhost:6080/arcgis/admin/security/config
    ArcGIS Manager->Security->Roles: Configure an AD group to have 'User' access
    ArcGIS Manager->Services->Site(root) Security: Add the AD group (above) to the 'Allowed roles'

To generate the random chars we wrote a real simple pythons script:
import random
random.seed()


def listToString(_list,delimiter):
 try: 
  return delimiter.join(_list)
 except:
  return delimiter.join(["%s" % el for el in _list])

def getRandChars(num):
 chars=["'","1","2","3","4","5","6","7","8","9","0","-","=","q","w","e","r","t","y","u","i","o","p","[","]","\\","a","s","d","f","g","h","j","k","l",";","'","z","x","c","v","b","n","m",",",".","/","~","!","@","#","$","%","^","&","*","(",")","_","+","Q","W","E","R","T","Y","U","I","O","P","{","}","|","A","S","D","F","G","H","J","K","L",":","\"","Z","X","C","V","B","N","M","<",">","?"]
 out_chars=[]
 i=1
 while i<=num:
  indx=random.randint(0,len(chars)-1)
  out_chars.append(chars[indx])
  i+=1
 return out_chars
 

print listToString(getRandChars(16),"")


We do have some minor issues publishing services from ArcMap or ArcCatalog following procedures like these here: http://resources.arcgis.com/en/help/main/10.1/#/Tutorial_Publishing_a_map_service/0154000003vt000000...

We get an error that 'Packaging Succeeded, but publishing failed.' and further 'Error: unable to connect to the publishing tools service'.  We did verify that te 'publishing tools service' is started and permissions are granted to the 'Publishers' and 'Administrators' roles.  We can however create a .sd file and use the web manager to create a web-service from the .sd file.  We've got an open trouble ticket with ESRI on that issue.  Similar thread post here: http://forums.arcgis.com/threads/56212-Cannot-publish-services-to-Prerelease-10.1-Server

Best of luck!
0 Kudos
by Anonymous User
Not applicable
Original User: cspurlock

I have followed your steps except for the following:

  1. I have the web adaptor installed on the same server as ArcGIS server.  The documentation says this is okay.

  2. When I go IIS > Default Web Site > arcgis > Authentication > Windows Authentication, I enabled Windows Authentication but I don't have an option to select 'Providers'.  Under 'Advanced Settings', the 'Enable Kernel-mode authentication' is checked.

0 Kudos
PF1
by
Occasional Contributor II
I have followed your steps except for the following:

  1. I have the web adaptor installed on the same server as ArcGIS server.  The documentation says this is okay.

  2. When I go IIS > Default Web Site > arcgis > Authentication > Windows Authentication, I enabled Windows Authentication but I don't have an option to select 'Providers'.  Under 'Advanced Settings', the 'Enable Kernel-mode authentication' is checked.



Hi Curtis,

It *should* be ok that the web-adaptor/IIS is on the same server as your GIS server. 

If you go to 'IIS > Default Web Site > arcgis > Authentication' and highlight the 'Windows Authentication' item then there should be a 'Providers...' link that you can select in the 'Actions' pane on the right.  Then you should see the 'providers' window pop-up that allows you to move 'NTLM' to the top of the list. 

See attached picture with the red box [ATTACH=CONFIG]15872[/ATTACH]
0 Kudos
by Anonymous User
Not applicable
Original User: cspurlock

Here is what my IIS screen looks like:

[ATTACH=CONFIG]15873[/ATTACH]

Here is the IIS version on my server:

[ATTACH=CONFIG]15874[/ATTACH]
0 Kudos
PF1
by
Occasional Contributor II
Here is what my IIS screen looks like: 

[ATTACH=CONFIG]15873[/ATTACH] 

Here is the IIS version on my server: 

[ATTACH=CONFIG]15874[/ATTACH]


Hi Curtis,

I am using the web-adaptor with IIS7. You might find these articles useful (for IIS6):
How to configure IIS to support both the Kerberos protocol and the NTLM protocol for network authent...

Setting NTAuthenticationProviders at an Application level in IIS 6


Just heed the important warnings: Important This article contains information about how to edit the metabase. Before you edit the metabase, verify that you have a backup copy that you can restore if a problem occurs. For information about how to do this, see the "Configuration Backup/Restore" Help topic in Microsoft Management Console (MMC).

I'm not sure if enabling NTLM will solve your problem or if it is even required. I just know that it took me 2-3 days to get the web-adaptor with WINDOWS OS user/role and web authentication working properly and I did move the NTLM setting to the top. Best of luck!
0 Kudos