Web Proxy NTLM Authentication Error

2533
6
02-07-2017 09:29 AM
DanMay
by
New Contributor

ArcEarth 1.4 does not appear to support NTLM proxy authentication, which is an issue which we encountered with previous versions as well. After launching AE on a computer with correctly configured system level internet options, two error messages appear: 

"Failed to use proxy: the credentials are invalid Unable to connect to the remote server"

"The Remote server returned an error (407) Proxy Authentication Required"

Manually configuring the correct proxy server (using IP or hostname), username (with and without domain suffix) and password results in the same errors.  Overwriting the config.xml file in the AppData/Roaming folder or the Program Files/ArcGIS/Earth/Bin folders does not change the outcome.

The sign-on window for ArcGIS online loads and is able to navigate the proxy, but it appears to use Internet Explorer so that's not surprising. ArcEarth itself does not login, displaying the two errors listed above after "Sign In" is clicked.

Analysis of packet traffic suggests that ArcEarth might not be correctly responding to the proxy server's notification that NTLM is required. Compare the packet traffic shown below:ArcEarth proxy packet traffic

ESRI tech support referred us to this forum for assistance, we'd love to get this application working in our organization.

0 Kudos
6 Replies
ShengtaoDing
New Contributor

Hi Dan May,

ArcGIS Earth 1.4 or older version do not support ntlm proxy authentication. We will support it in the following version.

We will feel grateful if you can provide any test data.

thanks a lot,

Shengtao

DanMay
by
New Contributor

Shengtao Ding‌, I'd be happy to provide any additional data or application testing that might be helpful in resolving this issue. Feel free to contact me at dan.may@deq.idaho.gov 

0 Kudos
XuewenZhang
Esri Contributor

Hi Dan,

ArcGIS Earth V1.5 has been released, you can get it from ArcGIS Earth | ArcGIS. Could you help to check whether your issue has been fixed with the V1.5?

Thanks,

Xuewen

0 Kudos
DanMay
by
New Contributor

Hi Xuewen,

The issue with using local windows credentials to get through a proxy server does not appear to be resolved in version 1.5

The following steps were taken:

  • Uninstall ArcGIS Earth
  • Delete C:\Users\[username]\AppData\Roaming\ESRI\ArcGISEarth\
  • Delete C:\Users\[username]\AppData\Local\ESRI\*ArcGISEarth*\
  • Ensure proxy settings are correctly configured in Windows Internet Options
  • run ArcGIS_Earth_x64_Setup_1.5.exe as administrator
  • run ArcGISEarth.msi as an administrator (for all users, no config file specified)
  • Earth launches, arcgis online sign in page loads correctly
  • after entering in valid logon credentials, Error message "unable to connect to the portal. Please make sure the specified portal is up, running and the URL is correct." Entering in invalid credentials results in the page rejecting the login attempt with the error "invalid username or password".
  • Going to Settings->advanced, use a proxy is unchecked (even though use a proxy is enabled in windows internet options) and no credentials are specified.
  • checking use a proxy, and entering in a valid proxy IP address or hostname, username (with or without domain suffix or fully qualified domain name) and a valid password results in the error 'failed to used proxy: the credentials are invalid. Unable to connect to the remote server."

Our proxy server logging indicates that attempts are being made to contact it, and when incorrect passwords are entered in the config, no bad password attempts are logged. Examination of Wireshark packet logging indicates that the problem documented in the original post still exists, when the proxy server responds with 407 proxy authentication required, ArcEarth retries the connection without the NTLMSSP_NEGOTIATE flag.

I realize that our environment may be hard to replicate, so we're more than happy to run builds with additional logging or test experimental builds to provide feedback.please contact me directly at the email above with developments.

0 Kudos
DanMay
by
New Contributor

Apologies, when it says "Our proxy server logging indicates that attempts are being made to contact it," it should say "Our proxy server logging indicates that no attempts are being made to contact it,"

0 Kudos
Bing_AnChen
Esri Contributor

Hello @DanMay ,

 

With support from our developers, Earth supported NLTM proxy authentication in the latest V1.17 release. Please have a try and get back to us if you need any more assistance. 

Thank you and happy New Year!

 

Bing‘An

0 Kudos