SSL in Web App Builder

5777
20
Jump to solution
02-09-2016 07:42 AM
Syvertson
Occasional Contributor III

Hello.

I have just created an application with web app builder (This is using portal, not AGOL, and using the "Create Application using Web App Builder" in the portal)  Immediately we had errors saying that access was forbidden.  After a day or so, I realized that the problem is that the app builder creates a URL that is not SSL, and I have my web server set to only accept SSL.  The temp solution is to just add the "https://" to the URL in the address bar after it gives one that won't work.

How do I get the app builder to give me a good address using https from the start.  I know it must be able to be changed in the settings somewhere, but where???

Thanks.

Matt Syvertson

Tags (2)
0 Kudos
1 Solution

Accepted Solutions
Syvertson
Occasional Contributor III

Thanks to everyone's assistance.  I ended up opening up a tech support case, and found out that this is a known bug that is to be fixed in version 10.4.  Another bug showed up when I attempted to just change the URL (Which should be able to be done) in the App editor.  This bug will not save the changes.  Both bugs are listed below:

BUG-000088682: When a Portal for ArcGIS site is configured to use Secure Sockets Layer (SSL) only, ArcGIS Web AppBuilder applications are created through HTTP automatically and the URL cannot be updated.

This bug is marked as fixed in 10.4.

BUG-000091888: In Portal for ArcGIS 10.3.1, changes made to a web map application's URL do not persist after being saved.

This bug appears to be going through the review process still.  In the meantime, you can go through the workaround like we did on the phone:

  • Browse to the item's details page through My Content.
  • Copy the item ID from the URL.
  • Navigate to the ArcGIS Portal content directories using the item id.
    • For example: C:\arcgisportal\content\items\4b3a1b1a75cb495fbcb7f983624df263\esriinfo
  • Edit the iteminfo.xml file within the esriinfo folder for that item and change the URL to include https instead of http.
  • In Portal, you can now change the application's URL; all changes will now be saved.

View solution in original post

20 Replies
ChrisSmith7
Frequent Contributor

Have you enabled SSL?

FAQs—Web AppBuilder for ArcGIS (Developer Edition) | ArcGIS for Developers

You'll want to go with a domain/wild card CA-signed certificate rather than a self-signed cert, unless you're just developing/prototyping.

0 Kudos
Syvertson
Occasional Contributor III

Thanks Chris for your quick response.  I have a CA signed Certificate and I have SSL enabled.  The application works in SSL very well.  I just have to manually add the "Https://" to the URL that the web appbuilder creates.  So, if I find the App in the gallery, and I click on it, I get a "Forbidden" error message.  Then if I add the "Https://" to the front of the URL, you can proceed.

0 Kudos
ChrisSmith7
Frequent Contributor

I'm not a portal or WAB user, specifically, and I don't publish apps to the gallery (I use the JSAPI/ArcGIS Server) - but I might be able to help. I found an example of an app in the gallery using https:

http://www.arcgis.com/home/item.html?id=35158fa5622444a8ae4f614a254dd5e7

As I understand things, if the server says it needs ssl, the gallery will open it in ssl. Just a shot in the dark, is your Portal environment configured for https? https://doc.arcgis.com/en/arcgis-online/administer/configure-security.htm

0 Kudos
MichaelRobb
Occasional Contributor III

The example provided does not work because one is still able to hit http as seen here:

http://irenevanwinkel.maps.arcgis.com/apps/MapJournal/index.html?appid=35158fa5622444a8ae4f614a254dd...

Matthew can change the setting so that Anonymous is not allowed as seen here under My organization >> Edit Settings >> Security...

1.png

The above will work for Matthew

There are of course other ways such as URL Rewrite on IIS (portal Web adaptor) to always rewrite http with https.

0 Kudos
ChrisSmith7
Frequent Contributor

Michael,

When I found that example, I was thinking in terms of the default launch behavior of the app gallery (opening in https) - but not a working example of always reverting to https as you've pointed-out.

0 Kudos
RobertScheitlin__GISP
MVP Emeritus

Matthew,

   Chris is on the right path. Here are the specific steps.

If you go to your WAB Install [install dir]\server and delete the signininfo.json then when you restart your WAB it will prompt for your portal URL and AppID again. This time when you enter your protal url use https in the url. This should fix the missing https on your apps.

Syvertson
Occasional Contributor III

I think you guys are right IF I was doing this in a web app builder that I installed on my desktop and use the "node.js" environment to create it.  But in this case, this app is created using the built-in version of app-builder in the portal.  See screen shot below:

I am going to try using the desktop version of web app builder, but I still need to get this to work, because I don't want to have to build all the little apps, and this is a non techie person who is doing this particular app.  The process worked easy enough for him to make the  map and app he needs, without getting down in the weeds. 

I will continue to attempt finding these files/settings on the GIS Server, but I have not yet been successful.

0 Kudos
RobertScheitlin__GISP
MVP Emeritus

Matthew,

   Strange if you are talking about a local Portal install then https is required from the beginning and I am not sure why you would be getting any http urls...

0 Kudos
Syvertson
Occasional Contributor III

I agree.  Everywhere in my portal requires https.  Every page I go to is configured to display https, except the apps that are created using the method in the screen shot above. 

To answer a question from above, I tried to configure are "URL rewrite" in IIS, and then the portal did not function.  It is possible I did it incorrectly, but I followed a post that a Microsoft professional posted on a different site.  URL Rewrite for SSL redirection : The Official Microsoft IIS Forums

   <rule name="Force HTTPS" enabled="true">

         <match url="(.*)" ignoreCase="false" />

         <conditions>

             <add input="{HTTPS}" pattern="off" />

         </conditions>

         <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" />

     </rule>

0 Kudos