Can't Publish With OS Authentication - Can Publish Without OS Authentication???

troyturcott · ‎09-24-2012

I have two ArcGIS Server 10.1 installations on two separate servers. One uses Integrated Windows OS Authentication via IIS 7.5 with NTLM as the provider. The other just runs off of port 6080. I can publish from ArcGIS Desktop Standard 10.1 (ArcMap) without issue.
Once I enabled OS Authentication utilizing Active Directory for both Users and Roles on my other ArcGIS Server, the ability to publish is blocked and the Error message about "Package & Publishing Service tools not being started, etc..." pops up. However, I can save and import the service definition file to create a service without any issue.

Now the publisher connection was established using the ArcGIS Server internal administrative user name - this user name is maintained by ArcGIS Server, not Active Directory. Is this failing because the administrative user name is not part of Active Directory? I need to know ASAP because it's a royal pain (takes weeks sometimes dealing with overseas personnel) to procure a new user name in the organization I work for...

troyturcott · ‎09-27-2012

ESRI, Hello???

I went ahead and included a new Role from Active Directory, assigned "Publish" privileges to this Role via the ArcGIS Admin interfaces, but it still won't allow publishing.
I successfully created the "Publisher" ArcGIS Server connection using a member/user from the Role that was granted "Publish" privileges.
However, when the nodes under "System" for "Caching, Publishing or Reporting" tools are clicked/double-clicked & triple-clicked! nothing happens.
Now, when I expand these same nodes under my "User" connection I see several nodes???
In particular, the "Publish Service Definition" node, and when it's selected I get the dialog for the tool requiring the "Service Definition Package ID". What's going on here?

troyturcott · ‎09-28-2012

Raj,

It still doesn't work properly...I've done all those checks you enumerated several times and I still get the following error dialog:
[ATTACH=CONFIG]18081[/ATTACH]

I've tried granting "PUBLISH" and "ADMINISTER" privileges to the AD Role that has the username used to make the connection when adding the ArcGIS Server. I verified the privileges using "http://localhost:6080/arcgis/admin/security/users/getPrivilege" for both instances of "PUBLISHER" & "ADMINISTER". - Still, no luck...

It's not a show-stopper, but a real pain in the rear...creating a .sd, importing into ArcGIS Server, blah, blah...
Publishing works great if the Web Adaptor/Windows authentication isn't involved...

Please let me know if you have any other suggestions, because at this point my organization is ready to call it a bug...

Regards,

Troy

StevenGriffith · ‎09-28-2012

Raj,

It still doesn't work properly...I've done all those checks you enumerated several times and I still get the following error dialog:
[ATTACH=CONFIG]18081[/ATTACH]

I've tried granting "PUBLISH" and "ADMINISTER" privileges to the AD Role that has the username used to make the connection when adding the ArcGIS Server. I verified the privileges using "http://localhost:6080/arcgis/admin/security/users/getPrivilege" for both instances of "PUBLISHER" & "ADMINISTER". - Still, no luck...

It's not a show-stopper, but a real pain in the rear...creating a .sd, importing into ArcGIS Server, blah, blah...
Publishing works great if the Web Adaptor/Windows authentication isn't involved...

Please let me know if you have any other suggestions, because at this point my organization is ready to call it a bug...

Regards,

Troy

One last thing to try: Make sure that the user you're running as has full permissions to the C:\arcgisserver directory tree. Note, your drive letter may vary - and you may have an arcgisserver directory on multiple drives. Make sure that your user has "Full Control" permissions on all of these directories.

Steve G
County of SLO

RyanCoodey · ‎11-20-2012

Running into this exact same issue... Ever find a fix?

I followed all of Raj's steps except 4.1 because even if I leave the port 6080 off the wizard automatically adds it back.

Thanks for any updates!!!

CameronIrvine · ‎11-21-2012

Hi,

To publish from Desktop using Integrated Windows Authentication, please check if:

ArcGIS Server security has been configured to use Windows users\roles and Web Tier authentication.

The ArcGIS Web Adaptor has been configured to allow administrative access to the site.

IIS has "Anonymous" authentication disabled and "Windows" authentication enabled.

In the ArcGIS Desktop "Add ArcGIS Server" wizard:

The "Server URL" parameter has http://iishostname/arcgis and not http://arcgishost:6080/arcgis.

The "Authentication" section has the credentials of a Windows user(not the Primary Site Administrator) who is a member of a role with Publisher\Administrator privileges. Please use http://arcgishost:6080/arcgis/admin/security/users/getPrivilege to confirm the user's privilege

If you need instructions on configuring ArcGIS Server for Integrated Windows Authentication, please see the tutorial Securing web services with Integrated Windows Authentication

Regards,
Raj

Hi Raj,

Thanks for your post on resolving the issue with not being able to publish using Windows Authentication. Can you please ensure that your check list makes it in to the ArcGIS Server documentation? I spent a whole day trying to work out what was going wrong and found nothing in the documentation. It was only after finding your post that I was able to resolve this problem.

It all makes sense that you need to allow administrative access through the web adaptor and that you have to use the IIShostname and not the :6080 instance but this is not in the documentation. On the web adaptor page should it not say
something like "if you are using Windows Authentication please enable administrative access to your site through the Web Adaptor"

This would save people a lot of time in the future!

Cheers
Cameron

RyanCoodey · ‎11-21-2012

Hi Cameron,

So in ArcGIS Desktop you were able to make a GIS Server connection using just the iishostname without the 6080 port? In our setup the iishostname and the arcgishost are the same, and even if I leave the :6080 off it automatically adds it back... maybe this is a bug/issue when those two are the same. Is your web server seperate from the ArcGIS Server?

*UPDATE* I also tried http://iishostname:80/arcgis/admin but that gives me an error saying "Unable to acquire authentication token". I do have administration through the web adapter enabled and the URL works fine in a browser.

Thanks much!

BrianLeroux · ‎11-29-2012

I also had the same issue as described in this thread. After discussing with ESRI support we determined the issue was using the port number 6080 in the connection string. Once I removed that I was able to publish without any issue. Connection details are documenting here in the 10.1 Help Guide.

RobertJones2 · ‎04-03-2013

Same issue here, and whenever I try to make a connection without the port number ArcCatalog adds it back in.