This @#$# issue is making me crazy.
We have a Portal instance, using the distributed model:
1 Portal machine, with Web Adaptor
1 Federated and hosting server with Web Adaptor. - the federation validates successfully, and I see items published there directly in my content in Portal)
1 server for Datastore (not really in play for this issue, I don't think)
I published a bunch of layers as REFERENCED feature layers through the hosting server (we need the data to be live).
These layers will not draw on a map - 'Access-Control-Allow-Origin' has no value. So, on the Portal server, I go in to IIS, at the web adaptor level, and add 'Access-Control-Allow-Origin' with a value of * - it then says this is not allowed either if credentials are being passed (I think that's what the message means) -
I'm about to give up, move to the country, make an honest living. The Access Control Allow Origin issue comes up from time to time, and I simply cannot find a real solution.
I have tried adding the header at all levels of IIS (default website, web adaptor level, machine name level) - currently, for testing, there are no entries on IIS on either the hosting server or the Portal server, and no custom headers in the webconfig file at wwwroot.
We are enforcing HTTPS only in the portal site, certificates all in place and bound in IIS, plus the root/intermediate ones uploaded into Portal/Server Admin pages, and neither Portal nor Server are using the default self-signed certs - both using the same wildcard domain certs that are our standard.
I'm at a complete loss to make this work, much less know where to look for what the best practice is.
Any insight is hugely appreciated.