Problem with federation about arcgis-powershell-dsc HOT 12 CLOSED

Hi @jbiendara,

your config with-ssl is missing some square-brackets. This part:

"SslRootOrIntermediate" : {
			"Alias":	"esri-root",
			"Path":		"C:\\data\\ArcGIS_Configuration\\Certificate\\esri-root.cer"
					 },

should be:

"SslRootOrIntermediate" : [{
			"Alias":	"esri-root",
			"Path":		"C:\\data\\ArcGIS_Configuration\\Certificate\\esri-root.cer"
					}],

Maybe this fixes also #90 Q5

Cheers

from arcgis-powershell-dsc.

Hi Rainer,

Unfortunately, adding the extra square brackets didn't change anything.

As soon as I add the “ssl per node” sections to the “AllNodes” part the procedure gets confused. Okay, the node ssl certificates get installed as well as does the root certificate.

But when it comes to federate the server (vsdev2371) with the portal (vsdev2370) the procedure requires a token from the server (vsdev2371), not from the portal (vsdev2370). The federation times out.

Without the “ssl per node” sections in the “AllNodes” part the procedure requires the token for the federation correctly from the portal (vsdev2370), the federation is done in seconds.

Why does the procedure gets mixed up?

Btw: I thought that the square brackets only designate the sections that need to be configured/filled in with the values of the environment or sections that are optional. Now it seems that they also do have a functional significance. Can you help me, what the (functional) difference between the square and the curly brackets is and what they both are used for in the context of the configuration scripts?

Thank you very much, best regards,
Jürgen

from arcgis-powershell-dsc.

Hi,

About the bracketts: The config is written in json-notation. Square-Bracketts are used for Arrays over there. You can see some more Information About Syntax e.g. here: http://www.json.org/

At the example configuration files there are also some square-bracketts inside of Quotation marks. These are meant as optional/filled Information which hast to be changed for use.

As soon as I add the “ssl per node” sections to the “AllNodes” part the procedure gets confused. Okay, the node ssl certificates get installed as well as does the root certificate.

For clarification: Are both certificates now installed in Portal Cert-Store?

Why does the procedure gets mixed up?

This could be a bug. On our Tests we had all WebAdaptors on the same machine and everything worked fine. Could your verify this?

from arcgis-powershell-dsc.

@jbiendara @spitzerr
Call for federation is made on server web adaptor. So when the web adaptors are on different machines the Portal WebAdaptor endpoint is wrongly inferred. This line is the cause of the error.

To get around the error use the following configuation.
WithSSLSections.txt

Ps. in this config, when a portal and portal webadaptor is on the same, the certificate is not installed Portal Cert-Store. It is installed in Machine Cert-Store.

from arcgis-powershell-dsc.

@jbiendara @spitzerr Pull request #95 should solve this bug. You can fork the PR and try it out.

from arcgis-powershell-dsc.

@shailesh91 from my perspective there is an additional timing Problem:
webadaptor waits until ArcGIS_Portal is finished to Register Portal in WA:

I'm not sure how to come around this. Maybe you have an idea.

from arcgis-powershell-dsc.

@spitzerr I will try to repro this issue (Can you send the config file you are using). I have a solution in mind for wmf5 that requires minimal change. But I am not sure how I will get this working in wmf4. Need to brainstorm a little more that.

from arcgis-powershell-dsc.

@shailesh91 please find attached the config which Fails on our site. As it is a racing condition I think it's hard to reproduce anyway.
Hope you can find a fix

config.json

from arcgis-powershell-dsc.

adding retries to ArcGIS WebAdaptor when it attempts to get a token and the Portal is restarting might be a good fix.

from arcgis-powershell-dsc.

@spitzerr just an FYI, support for global certs used is going away with the latest PR. You will have to use the node level certs.
@nshampur Will give the retry solution a try.

from arcgis-powershell-dsc.

@spitzerr The new commit (3d9697e) should solve the timing issue. Can you verify this.

from arcgis-powershell-dsc.

Closing the issue. Please open again if you have any further issues.

from arcgis-powershell-dsc.