User does not have permissions to access 'system/publishingtools.gpserver

8405
4
02-07-2013 01:58 PM
TysonHaverkort
New Contributor III
Hi There,

Sorry for the tome...

My server setup:

ArcGIS for Server 10.1 sp1
ArcGIS for Desktop 10.1
Windows 2008 R2 VM
Web Adapter installed with Admin access through web adapter enabled (no shared key configured)
Cross domain policy installed
The database was successfully added to the Data Store

I have an MXD with source data from SDE (SQL Server installed on a different machine).  When I attempt to publish the MXD as a service, it creates the SD file, but fails on the publishing:

'Packaging succeeded, but publishing failed.  Unable to connect to publishing tools service.  Verify the service is up and running.  Please consult the GP Results Window for enhanced error description'. 

The service name contains no invalid characters.  I get the same error when attempting to create the service from Server Manager.

The next thing I did was to log into Server Manager.  All existing Map services seem to be running ok, can be restarted, and viewed in ArcMap.  Then I checked the System services to make sure the PublishingTools service is running ok, which is was.  However, when I clicked on Capabilities then on the rest service, I noticed that I didn�??t have permissions to view it (which may be a red herring): 

'User does not have permissions to access 'system/publishingtools.gpserver'.

Then I went into security, and added my Admin and Publishing roles to the service permissions, however, that didn�??t solve the problem.  I restarted the PublishingTools service.  It restarted fine, but didn�??t help. 

Eventually I was able to create one service in Server Manager by changing the URL from http://localhost:6080/arcgis/manager/ to http://localhost/arcgis/manager/

I'm still not able to create a service from ArcMap directly, even after I've confirmed that the server connection I've specified is running through IIS (http:///localhost/arcgis/admin)

Does anyone have any thoughts as to why I am not able to created a service from ArcMap?  Should I be able to see the REST details for the Publishing Tools system service?

Thanks,
Tyson
0 Kudos
4 Replies
JustinRodriguez
Occasional Contributor
Hello
Can you try the following please:

Can you make a user connection to your server from ArcMap?

Can you make an admin connection to your server from ArcMap?

Can you confirm that your ArcMap installation is on the same server as your ArcGIS for Server installation

Can you confirm that your ArcMap installation is 10.1

Can you confirm that your ArcGIS for Server installation is 10.1

Thank you very much-
0 Kudos
TysonHaverkort
New Contributor III

Can you make a user connection to your server from ArcMap?

Can you make an admin connection to your server from ArcMap?

Can you confirm that your ArcMap installation is on the same server as your ArcGIS for Server installation

Can you confirm that your ArcMap installation is 10.1

Can you confirm that your ArcGIS for Server installation is 10.1

Thanks for the reply. The answer is yes to all. I haven't installed the Service Pack 10.1 sp1 for Desktop yet. Maybe I'll try that next.


Thanks again,
Tyson
0 Kudos
JustinRodriguez
Occasional Contributor
Tyson,
This issue seems very strange to me.
So you can make an admin connection from ArcCatalog, but cannot publish.
You can create an SD, and publish the document from manager while being logged in as the same user from the admin connection in arccatalog.

It just seems like we are missing something here.

Lets do this:
1. Install ArcGIS for Desktop on your server.

2. Make a super small map document from some of the tutorial data that comes with the installer. Please download it from your customer care portal if needed.

3. Make an admin connection from arccatalog using http://localhost:6080/arcgis/  Ensure you are using the Primary Site Administrator Account!!!

4. Can you publish the map document?

4a. If that works, please try to mimic the connection settings on a computer on the network and see if that works.


**Also, Desktop and Server should always be at the same version (including service pack), although I doubt that is the specific issue in this case.**

Thank you very much-
0 Kudos
TysonHaverkort
New Contributor III
Ok, the ESRI folks and I have figured this out.

The symptoms:
Every time I would try to publish a map service from ArcMap, I would get an error.  Checking into it, the underlying error was:
'User does not have permissions to access 'system/publishingtools.gpserver'.  This would happen even though I was using the ArcGIS Manager account (the non-domain account used to log into Server Manager) when I would create my connection to the service.  I have a Windows Domain user store, ArcGIS Server Built-in Role Store, GIS Server Authentication Tier (which I'm going to change), and ArcGIS Tokens ad the Authentication Mode.  I have Admin and Publisher roles that contain my domain accounts.

The problem:
So after John O from ESRI (big thanks) had me install Fiddler and we looked through the more detailed messages, the error was that the token that was returned by the ArcGIS Manager Account was being denied.  We took a close look at why this was happening, and it turned out that even the ArcGIS Manager account did not have permissions on the System services, though this may have been the result of me changing the security settings to use domain accounts (we're still looking into that part).  Regardless, no users had permissions to access those system services such as system/publishingtools.gpserver.  We checked this by logging into Manager as the ArcGIS Manager account, clicking Services > System, then clicking the lock icon on the System item (where you set the security settings for all system resources).  We could see that the security was set to Private, and there were no groups in the Allowed Roles.  Still, one would think that the Server Manager would have permissions....

The fix:
Once in System > Security settings, the settings were changed to Public, and a test service was published successfully from ArcMap.  Then we went back in, and change the System > Security settings to Private, and added the Admin and Publisher ArcGIS Roles (which contained domain accounts).  At this point, I am able to publish map services from ArcMap, as long as I create my ArcMap server connection using a domain account.

I hope this helps somebody else.
0 Kudos