I'm using a webadaptor with ArcGIS Server 10.4 to which I added an authentication filter (CAS client) via the web.xml. Everything works perfectly for the web application. However, when I try to connect via the ArcCatalog it will not authenticate my user. If I use the built-it siteadmin account, I can connect, but as that user does not exist in my enterprise identity store, it is clearly not authenticating at the web tier. I captured the traffic from ArcCatalog in my filter and can see that it initially requests:

GET /cas-web-adaptor/admin/publicKey?f=json

This leads me to believe that it is going to use the public key to encrypt the username/password on and send that as a second request. If it is doing that, then only ArcGIS Server would be able to decode the username/password so it would not be using web tier for authentication... Am I missing something here (I hope so...)? Or is ArcCatalog incapable of authenticating at the web tier?

  • 1
    The web tier is generally for clients not administration. To what endpoint are you trying to connect from Catalog? – Vince Mar 17 '16 at 21:14
  • @Vince, I wanted to be able to allow users from my enterprise LDAP (authenticated at the web tier) to connect with ArcCatalog to publish content. Are you saying I should have a second ArcGIS Server that is authenticated via LDAP but NOT at GIS server tier and direct my users to connect to that one from ArcCatalog? This seems really wonky (and expensive due to the need for a second server license)... – Lucas Mar 17 '16 at 21:33
  • 1
    Using two webadaptors is the solution preached in training (plus another for Portal) – Vince Mar 17 '16 at 22:30
  • I am actually using 3, one is plain unmodified web adaptor (for unrestricted services), one is CAS authenticated (protected services), and one is trusted authentication (blocked by firewall except for a single server behind our firewall). The problem is that the authentication for the ArcXxx (Map, Catalog, ...) clients appears to be going right through them to the ArcGIS Server even though authentication on the server is set to web tier... And since the authentication tier is set on the server, all web adaptors share that setting (unless i am missing something) – Lucas Mar 17 '16 at 23:42
  • 1
    I'd recommend that you talk directly to Tech Support about this. – Vince Mar 17 '16 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.