Skip To Content

Use a reverse proxy server with Portal for ArcGIS

A reverse proxy server is a computer that is deployed within a perimeter network (also known as a demilitarized zone [DMZ] or screened subnet) that handles requests from the Internet and forwards them to the machines in your internal network. The forwarding of requests on behalf of the reverse proxy server masks the identity of the machines behind your organization's firewall, thus protecting internal machines from being attacked directly by Internet users. Additional security functions can be implemented in the reverse proxy server to further protect your internal network from outside users.

If your reverse proxy server supports a health check function, you can use the Portal for ArcGIS heath check end point to determine if the portal is available to receive requests. This is useful to quickly determine if there's a software or hardware failure in the site. For more information, see the portal Health Check topic in the ArcGIS REST API.

Caution:

The configuration detailed in this topic must be performed before federating any ArcGIS Server site with your ArcGIS Enterprise portal. Unfederating an ArcGIS Server site has several significant consequences, and is not easily undone. To learn more, see Administer a federated server.

Add Portal for ArcGIS to your reverse proxy server

Before adding Portal for ArcGIS to your organization's reverse proxy server, you must complete the following:

  • Configure HTTPS (HTTP and HTTPS or HTTPS-only) on the reverse proxy server. Portal for ArcGIS requires HTTPS for some communication. Consult the product documentation for your proxy server to learn how to set up HTTPS.
  • Configure ArcGIS Web Adaptor with your portal if your portal will use Integrated Windows Authentication. Portal for ArcGIS requires the use of ArcGIS Web Adaptor for this purpose, and this will allow the reverse proxy server to communicate with your portal correctly. For full instructions, see the configuration topics for IIS, Java (Windows), or Java (Linux).

After configuring ArcGIS Web Adaptor with Portal for ArcGIS, ArcGIS Web Adaptor can be used with your organization's reverse proxy server by adding the components directly to proxy server directives. For example, if you're using Apache as a reverse proxy server, you need to add ArcGIS Web Adaptor to the ProxyPass directives in the Apache web server configuration file httpd.conf:

ProxyPass /arcgis https://webadaptorhost.domain.com/webadaptorname
ProxyPassReverse /arcgis https://webadaptorhost.domain.com/webadaptorname

The ProxyPass directives must match the name designated for ArcGIS Web Adaptor (/webadaptorname in the sample above). If the URL to your site does not end with the default string /arcgis, specify the nondefault name of ArcGIS Web Adaptor (for example, /myorg).

Verify that the proxy server supports gzip encoding and is configured to allow the Accept-Encoding header. This header allows HTTP 1.1 responses to be compressed using gzip encoding. For example, if the header is allowed, a request to load Map Viewer will return a compressed response of approximately 1.4 MB to the browser. If the header is not allowed or ignored, the request will return an uncompressed response of approximately 6.8 MB to the browser. If your network speed is slow, it may take a long time for Map Viewer to load if responses are not compressed. It's highly recommended that you allow this header as part of your reverse proxy server configuration.

Set the portal's WebContextURL property. This helps Portal for ArcGIS construct the correct URLs on all resources it sends to the end user. Do the following to change the WebContextURL:

  1. Open a web browser and sign in to the ArcGIS Portal Directory as a member of the default administrator role in your portal organization. The URL is formatted https://portal.domain.com:7443/arcgis/portaladmin.
  2. Click System > Properties > Update Properties.
  3. On the Update System Properties dialog box, insert the following JSON, substituting your own reverse proxy server or DNS alias URL as seen by users outside your organization's firewall.
    {
       "WebContextURL": "https://reverseproxy.domain.com/myorg"
    }
  4. Click Update Properties.

Once you've configured the reverse proxy server with your portal, you'll now access your portal through the reverse proxy server URL instead of the ArcGIS Web Adaptor URL. Anything you access in the portal website or the ArcGIS Portal Directory will return the reverse proxy server URL.

The following administrative tasks should be redone using the reverse proxy server URL:

If you've previously added secured services as items in your portal, you'll need to delete the original items and add them again. This is because the original items use the ArcGIS Web Adaptor URL instead of the reverse proxy server URL. For instructions, see Connect to secure services.