AnsweredAssumed Answered

Redirect HTTP to HTTPS using Web Adaptor

Question asked by mschonlau on Oct 29, 2017
Latest reply on Nov 30, 2017 by mike.robb

Like • Show 0 Likes0
Comment • 13

I may be missing something in the documentation, but I cannot figure out how to redirect requests over port 80 to automatically redirect to my https-configured web adaptor. I can currently get to https://domain/webadaptor/rest, but do not get redirected to that url when going to http://domain/webadaptor/rest. I've tried setting up a rule in IIS with URL Rewrite, but no dice. Any advice on how to set this up? I am probably missing something obvious here because it seems like almost any organization would want this to happen. Users can't be expected to type in http:// everytime.

Thank in advance

Mike

mike.robb Nov 7, 2017 12:05 PM

Correct Answer

This has nothing to do with the web adaptor but everything with IIS. Also, you can still use Web adaptors when using NLB appliances.

Either you need an external appliance to redirect (e.g. F5, KEMP, Citrix etc)

or you install and configure URL Rewrite.

I can only suspect that the url rewrite rule applied to the IIS application (in this case, the Web adaptor) was incorrectly configured OR my other suspiciton is that you are unaware that installing the web adaptor,choosing 443 will change some IIS settings which the URL redirect may not work under.

Lets make sure your redirect (using URL Rewrite) is setup first..

using IIS 8.5

type in the http link to the web adaptor.. get a 403.

go to IIS

you will have already installed the urlrewrite either on its own or using the web platform installer.

e.g.

Here you can see 3.21 (JSAPI) and the arcgis web adaptor

You can create the new inbound rule to the site so that all child applications will get the redirect.

Add rules

Add a blank inbound rule

Name it, Redirects to HTTPS

pattern: (.*)

Add a condition

Condition input is {HTTPS}

Pattern: ^OFF$

Press OK

Go to ACTION pulldown panel

Action Type: Redirect

Redirect URL: https://{HTTP_HOST}/{R:1}

Redirect Type: See Other (303)

Click on APPLY

Verify the changes were successful

IIS will now look like so:

Lets refresh our default page.

yes... redirects.

try a JSAPI under 3.21

yes.. redirects

Try the web adaptor...

In your case, i 'suspect' that it will not work...

go to the SSL settings for the web adaptor:

If Require SSL is checked... uncheck it.

Make sure to apply and verify successful

*** what i have found is that when installing the web adaptor, choosing port 443 auto checks a setting interfering with the URL Redirect.

Now try your web adaptor link... (not even http just machine name...(or http)

and you should now get redirected to HTTPS

Of course, next step is to get a valid cert....

See the reply in context

1 person had this question

Outcomes

JQuinn-esristaff

Oct 30, 2017 10:09 AM

Have you taken a look at the Disable http access to ArcGIS Server section of the doc?

Actions

mschonlau @ JQuinn-esristaff on Nov 2, 2017 6:03 PM

Yes. That was the first thing I did in my process. I've configured ArcGIS Server many times before, but I typically use an AWS load balancer instead of the web adaptor. I can successfully connect to https://<my domain>/arcgis/rest, but when going to http://<my domain>/arcgis/rest, I see the error below:

Maybe I have something configured incorrectly in IIS? I have bindings for 80 and 443, with 443 using an SSL cert for <my domain>.

Actions

mike.robb Nov 7, 2017 12:05 PM

This has nothing to do with the web adaptor but everything with IIS. Also, you can still use Web adaptors when using NLB appliances.

Either you need an external appliance to redirect (e.g. F5, KEMP, Citrix etc)

or you install and configure URL Rewrite.

Lets make sure your redirect (using URL Rewrite) is setup first..

using IIS 8.5

type in the http link to the web adaptor.. get a 403.

go to IIS

you will have already installed the urlrewrite either on its own or using the web platform installer.

e.g.

Here you can see 3.21 (JSAPI) and the arcgis web adaptor

You can create the new inbound rule to the site so that all child applications will get the redirect.

Add rules

Add a blank inbound rule

Name it, Redirects to HTTPS

pattern: (.*)

Add a condition

Condition input is {HTTPS}

Pattern: ^OFF$

Press OK

Go to ACTION pulldown panel

Action Type: Redirect

Redirect URL: https://{HTTP_HOST}/{R:1}

Redirect Type: See Other (303)

Click on APPLY

Verify the changes were successful

IIS will now look like so:

Lets refresh our default page.

yes... redirects.

try a JSAPI under 3.21

yes.. redirects

Try the web adaptor...

In your case, i 'suspect' that it will not work...

go to the SSL settings for the web adaptor:

If Require SSL is checked... uncheck it.

Make sure to apply and verify successful

*** what i have found is that when installing the web adaptor, choosing port 443 auto checks a setting interfering with the URL Redirect.

Now try your web adaptor link... (not even http just machine name...(or http)

and you should now get redirected to HTTPS

Of course, next step is to get a valid cert....

3 people found this helpful

Actions

mschonlau @ mike.robb on Nov 10, 2017 2:05 PM

Thank you for the detailed instructions, Michael. I actually already had my URL Rewrite rule set this way and did not have SSL settings checked. The redirect is working on the server now, but not from the outside. I will have to check with the IT folks to see if they are blocking 80, 443, 6080, or 6443 outside of the network.

Actions

mike.robb @ mschonlau on Nov 11, 2017 7:35 AM

Hi Michael,

Its good to have all the steps to help with troubleshooting.

Regarding the outside traffic. You would hit the web adaptor, which is port 443.

Port 6080 and 6443 is only between ArcGIS Server (AGS) and the machine with the web adaptor. you are saying this works on the server.

Is it possible that there are additional hardware, traffic manipulation occuring with the incoming traffic?

It sounds like you are one step closer.

Actions

mschonlau @ mike.robb on Nov 21, 2017 11:54 AM

Resolved. The IT folks were blocking something at the firewall. It's purring like a kitten now! Thanks for your help

Actions

mike.robb @ mschonlau on Nov 23, 2017 7:10 PM

them pesky network IT guys...

What specifically was being blocked? I am now curious how that could be broken becuase its only 443 going out.

Actions

mschonlau @ mike.robb on Nov 27, 2017 6:09 AM

Not sure. They must have been blocking 443 because it worked on the server itself. Thanks for all of your help.

Actions

JQuinn-esristaff

Nov 7, 2017 10:55 AM

I just went through the instructions in the link below and it seems to work:

Redirect from HTTP to HTTPS using the IIS URL Rewrite module – Damian Wiese

Have you taken a look at that?

Actions

mike.robb @ JQuinn-esristaff on Nov 7, 2017 12:07 PM

My guess is that would not solve knowing that installing the Web adaptor changes IIS settings, specifically the REQUIRE SSL setting which would interfere with URL Rewrite (redirect).

I've provided an extraction out of my documentation step by step which should get Michael up and running.

Actions

coloncm Nov 28, 2017 7:33 AM

The whole purpose of the web adaptor is so that ports may be omitted on URLs when browsed from a client browser. Using the port is actually by-passing the web adaptor, and being unable to reach the server using the port from a client browser would likely indicate that the network policies are presenting it.

Given the pic above, your server can only be reached via HTTPS, i.e., port 6443. If you want to change that, you'd have to change the security settings via https://<server>:6443/arcgis/admin on the server:

Otherwise, to get to the server's service directory (if not disabled), you'd have to browse to https://<server>/arcgis/rest/services WITHOUT a :6443 port designation from a client browser.

Actions

mschonlau @ coloncm on Nov 28, 2017 8:18 AM

I am not using any ports in my url. This discussion was about the automatic behind-the-scenes http-to-https redirect. We use either http://domain/webadaptor/rest or https://domain/webadaptor/rest. ArcGIS Server is set to HTTPS only.

Actions

mike.robb @ coloncm on Nov 30, 2017 9:49 PM

Hi Carlos,

Though this discussion had nothing to do with direct access to ArcGIS Server (ports - which are 6443/6080 by default - if your savvy can be changed to any port you want), I'd like to clarify some information.

Carlos Colón-Maldonado wrote:

The whole purpose of the web adaptor is so that ports may be omitted on URLs when browsed from a client

wrong.

The web adaptor allows integrating a web server with a GIS Site (remember, a site can have multiple GIS Machines / nodes). A web adaptor forwards calls to your ArcGIS Server nodes and will check your site to see removed or added machines.

A web adaptor also allows exposing the GIS Servers through the standard website port (80/443). Since this is a web standard, these ports are not visible from a clients perspective, but they are still there.

The web adaptor also provides the ability to restrict Desktop ArcGIS Server users from Admin and Publishing access.

And very important, the web adaptor allows leveraging enterprise security from a web-tier level.

using IWA (integrated windows authentication) MUST use a web adaptor on a web server level, the web adaptor WA (windows authentication) - e.g. NTLM or Kerberos PASSES these credentials to ArcGIS Server for all secure services. ArcGIS Server identity store would be tied to Active Directory (for example). This means, only traffic through the web adaptor can only see locked secure services with valid credentials... even if the user had access directly to arcgis server using port (e.g. 6443 - going around the web adaptor)- they would get an unauthorized response because ArcGIS Server is expecting valid credentials from traffic through the web adaptor.

Actions

13 Replies

JQuinn-esristaff Oct 30, 2017 10:09 AM
Mark Correct
Correct Answer
Have you taken a look at the Disable http access to ArcGIS Server section of the doc?
Like • Show 0 Likes0
Actions
- mschonlau @ JQuinn-esristaff on Nov 2, 2017 6:03 PM
  Mark Correct
  Correct Answer
  Yes. That was the first thing I did in my process. I've configured ArcGIS Server many times before, but I typically use an AWS load balancer instead of the web adaptor. I can successfully connect to https://<my domain>/arcgis/rest, but when going to http://<my domain>/arcgis/rest, I see the error below:
  Maybe I have something configured incorrectly in IIS? I have bindings for 80 and 443, with 443 using an SSL cert for <my domain>.
  Like • Show 0 Likes0
  Actions
mike.robb Nov 7, 2017 12:05 PM
Unmark Correct
Correct Answer
This has nothing to do with the web adaptor but everything with IIS. Also, you can still use Web adaptors when using NLB appliances.
Either you need an external appliance to redirect (e.g. F5, KEMP, Citrix etc)
or you install and configure URL Rewrite.
I can only suspect that the url rewrite rule applied to the IIS application (in this case, the Web adaptor) was incorrectly configured OR my other suspiciton is that you are unaware that installing the web adaptor,choosing 443 will change some IIS settings which the URL redirect may not work under.

Lets make sure your redirect (using URL Rewrite) is setup first..

using IIS 8.5

type in the http link to the web adaptor.. get a 403.

go to IIS
you will have already installed the urlrewrite either on its own or using the web platform installer.
e.g.
Here you can see 3.21 (JSAPI) and the arcgis web adaptor

You can create the new inbound rule to the site so that all child applications will get the redirect.

Add rules
Add a blank inbound rule

Name it, Redirects to HTTPS
pattern: (.*)

Add a condition
Condition input is {HTTPS}
Pattern: ^OFF$

Press OK

Go to ACTION pulldown panel

Action Type: Redirect
Redirect URL: https://{HTTP_HOST}/{R:1}
Redirect Type: See Other (303)

Click on APPLY

Verify the changes were successful

IIS will now look like so:

Lets refresh our default page.
yes... redirects.
try a JSAPI under 3.21
yes.. redirects

Try the web adaptor...
In your case, i 'suspect' that it will not work...

go to the SSL settings for the web adaptor:

If Require SSL is checked... uncheck it.
Make sure to apply and verify successful

*** what i have found is that when installing the web adaptor, choosing port 443 auto checks a setting interfering with the URL Redirect.

Now try your web adaptor link... (not even http just machine name...(or http)
and you should now get redirected to HTTPS

Of course, next step is to get a valid cert....
3 people found this helpful
Like • Show 0 Likes0
Actions
- mschonlau @ mike.robb on Nov 10, 2017 2:05 PM
  Mark Correct
  Correct Answer
  Thank you for the detailed instructions, Michael. I actually already had my URL Rewrite rule set this way and did not have SSL settings checked. The redirect is working on the server now, but not from the outside. I will have to check with the IT folks to see if they are blocking 80, 443, 6080, or 6443 outside of the network.
  Like • Show 0 Likes0
  Actions
  - mike.robb @ mschonlau on Nov 11, 2017 7:35 AM
    Mark Correct
    Correct Answer
    Hi Michael,
    Its good to have all the steps to help with troubleshooting.
    Regarding the outside traffic. You would hit the web adaptor, which is port 443.
    
    Port 6080 and 6443 is only between ArcGIS Server (AGS) and the machine with the web adaptor. you are saying this works on the server.
    Is it possible that there are additional hardware, traffic manipulation occuring with the incoming traffic?
    It sounds like you are one step closer.
    Like • Show 0 Likes0
    Actions
    - mschonlau @ mike.robb on Nov 21, 2017 11:54 AM
      Mark Correct
      Correct Answer
      Resolved. The IT folks were blocking something at the firewall. It's purring like a kitten now! Thanks for your help
      Like • Show 0 Likes0
      Actions
      - mike.robb @ mschonlau on Nov 23, 2017 7:10 PM
        Mark Correct
        Correct Answer
        them pesky network IT guys...
        What specifically was being blocked? I am now curious how that could be broken becuase its only 443 going out.
        Like • Show 0 Likes0
        Actions
        mschonlau @ mike.robb on Nov 27, 2017 6:09 AM
        Mark Correct
        Correct Answer
        Not sure. They must have been blocking 443 because it worked on the server itself. Thanks for all of your help.
        Like • Show 0 Likes0
        Actions
JQuinn-esristaff Nov 7, 2017 10:55 AM
Mark Correct
Correct Answer
I just went through the instructions in the link below and it seems to work:

Redirect from HTTP to HTTPS using the IIS URL Rewrite module – Damian Wiese

Have you taken a look at that?
Like • Show 0 Likes0
Actions
- mike.robb @ JQuinn-esristaff on Nov 7, 2017 12:07 PM
  Mark Correct
  Correct Answer
  My guess is that would not solve knowing that installing the Web adaptor changes IIS settings, specifically the REQUIRE SSL setting which would interfere with URL Rewrite (redirect).
  I've provided an extraction out of my documentation step by step which should get Michael up and running.
  Like • Show 0 Likes0
  Actions
coloncm Nov 28, 2017 7:33 AM
Mark Correct
Correct Answer
The whole purpose of the web adaptor is so that ports may be omitted on URLs when browsed from a client browser. Using the port is actually by-passing the web adaptor, and being unable to reach the server using the port from a client browser would likely indicate that the network policies are presenting it.

Given the pic above, your server can only be reached via HTTPS, i.e., port 6443. If you want to change that, you'd have to change the security settings via https://<server>:6443/arcgis/admin on the server:
Otherwise, to get to the server's service directory (if not disabled), you'd have to browse to https://<server>/arcgis/rest/services WITHOUT a :6443 port designation from a client browser.
Like • Show 0 Likes0
Actions
- mschonlau @ coloncm on Nov 28, 2017 8:18 AM
  Mark Correct
  Correct Answer
  I am not using any ports in my url. This discussion was about the automatic behind-the-scenes http-to-https redirect. We use either http://domain/webadaptor/rest or https://domain/webadaptor/rest. ArcGIS Server is set to HTTPS only.
  Like • Show 0 Likes0
  Actions
- mike.robb @ coloncm on Nov 30, 2017 9:49 PM
  Mark Correct
  Correct Answer
  Hi Carlos,
  Though this discussion had nothing to do with direct access to ArcGIS Server (ports - which are 6443/6080 by default - if your savvy can be changed to any port you want), I'd like to clarify some information.
  Carlos Colón-Maldonado wrote:
  
  The whole purpose of the web adaptor is so that ports may be omitted on URLs when browsed from a client
  wrong.
  
  The web adaptor allows integrating a web server with a GIS Site (remember, a site can have multiple GIS Machines / nodes). A web adaptor forwards calls to your ArcGIS Server nodes and will check your site to see removed or added machines.
  A web adaptor also allows exposing the GIS Servers through the standard website port (80/443). Since this is a web standard, these ports are not visible from a clients perspective, but they are still there.
  
  The web adaptor also provides the ability to restrict Desktop ArcGIS Server users from Admin and Publishing access.
  
  And very important, the web adaptor allows leveraging enterprise security from a web-tier level.
  using IWA (integrated windows authentication) MUST use a web adaptor on a web server level, the web adaptor WA (windows authentication) - e.g. NTLM or Kerberos PASSES these credentials to ArcGIS Server for all secure services. ArcGIS Server identity store would be tied to Active Directory (for example). This means, only traffic through the web adaptor can only see locked secure services with valid credentials... even if the user had access directly to arcgis server using port (e.g. 6443 - going around the web adaptor)- they would get an unauthorized response because ArcGIS Server is expecting valid credentials from traffic through the web adaptor.
  Like • Show 0 Likes0
  Actions

GeoNet

The Esri Community

Redirect HTTP to HTTPS using Web Adaptor

Outcomes

Related Content

Recommended Content