ArcGIS Server 10.3.1, Web Adaptor and Windows Authentication

Question

This is probably a long shot but here it is.

We have ArcGIS Server 10.3.1 installed and a simple map service deployed on it. We are accessing the map service via custom javascript/html applications (one of which is ESRI's Roadway Characteristics Editor or RCE).

Accessing the unsecured map service via http://mapserver:6080 presents no problems nor does accessing it via the ESRI Web Adapator url (http://mapserver/arcgis).

However, enabling security through the Windows Domain at the Web Tier causes the following errors to start appearing in our web application calls to the map service.

GET http://dev-gis/arcgis/rest/info?f=json
XMLHttpRequest cannot load http://dev-gis/arcgis/rest/info?f=json. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://dev-app' is therefore not allowed access. The response had HTTP status code 401.

Now, it appears that there is a CORS error, however the CORS policies were enabled with Web Adaptor (which should only apply for Silverlight and Flex anyways) and there are no CORS issues when the Windows Domain authentication is not enabled.

This is how the security is configured for the Web Adaptor in IIS

I have tried enabling CORS via the web.config for the Web Adaptor (although this shouldn't be necessary) by adding the following lines.

<httpProtocol>
   <customHeaders>
     <add name="Access-Control-Allow-Origin" value="*" />
   </customHeaders>
 </httpProtocol>

which gets me to here

GET http://dev-gis/arcgis/rest/info?f=json 401 (Unauthorized)

Obviously this is a problem for any of our applications if we are trying to access via domain authentication.

The question is, has anyone else run into this problem and if so, how did you solve it. I believe that I have tried everything in my bag of tricks at this point and am out of ideas.

Update 1

Per Mintx question, the GIS Server is configured with the Web Adaptor

and Web Tier authenction has been enabled for ArcGIS Server.

Answer 1

I was having the same exact problem. What finally worked for me is adding the following to the ROOT site and NOT the application for the web adapter. Does it make sense? Not to me. But it worked for me.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
      <httpProtocol>
       <customHeaders>
         <add name="Access-Control-Allow-Origin" value="*" />
       </customHeaders>
      </httpProtocol>