3

In order to restrict service usage when sharing a REST endpoint I'm looking for a way to control access of service based on an IP range with the ESRI web adapter. I know that this can be done with a reverse proxy but they only documentation I have found for doing this with ESRI's web adapter is cross domain restriction.

Not all of my services require the same amount of security, some are public while others are not, so the solution needs to target individual services with different security needs.

If this can't be accomplished with the above method, what is the best method for restricting service REST endpoint access. Using the ESRI server OOB users and roles restrictions does not prevent username and password sharing, when sharing url's. I have to be certain unauthorized users are unable to access specific published services.

Server is AWS based on Linux (RHEL)

Improve this question
6
  • Have you tried editing the firewall rules using iptables on the machine that's running the ESRI Web Adapter?
    – Mintx
    Jan 4, 2016 at 22:30
  • That would target the entire server. And not allow one service to be public and another private
    – risail
    Jan 4, 2016 at 22:35
  • What type of security do you have on the secured services? (Web tier, token, etc)
    – Mintx
    Jan 4, 2016 at 22:40
  • Portal, it's a federated server, some services are distributed through named users and groups within portal, there are also needs for a client to have the endpoint.
    – risail
    Jan 4, 2016 at 22:42
  • This sounds like a fairly complex deployment, and I would definitely have a chat with an ESRI representative. We use two web adaptors (one for secure and one for public access) but we use Web Tier authentication. I don't think Portal works with Web Tier.
    – Mintx
    Jan 4, 2016 at 22:58

2 Answers 2

Reset to default
2

One possible solution would be to use two web adaptors as outlined in this ESRI article:

If you chose the Web Tier authentication security setting, you'll need to install two ArcGIS Web Adaptors. The Web Adaptors provide two entry points into your site: one for public access and one for private access. You can install both Web Adaptors on a single web server or install them on separate web servers.

If you install them on separate web servers, you can restrict the IP addresses on the private server without affecting public access.

Improve this answer
1
  • Expanding this a little: It does not matter which authentication method you use in this case. You can do as @mintx suggests and have a web server for each web adaptor. Or put a reverse proxy in front of your existing webserver and manage server access with the reverse proxy while continuing to allow the web adaptor to handle load balancing. This method also allows for either a single web adaptor or the option of multiple web adaptors to be deployed on the same server –
    – risail
    Jan 6, 2016 at 16:08
0

I have discovered a better solution to this problem with this ESRI document. Either Portal or AGOL can act as a reverse proxy to your server. A secure service can be shared or added to your organizations AGOL or Portal domain and the username and password is stored within that environment. The secure service is then passed a new url via portal or AGOL finally with rate limits IP and DNS based restrictions can be implemented, for sharing the service.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.