Using a reverse proxy server with Portal for ArcGIS
In this topic
A reverse proxy server is a computer that is deployed within a perimeter network (also known as a demilitarized zone [DMZ] or screened subnet) that handles requests from the Internet and forwards them to the machines in your internal network. The forwarding of requests on behalf of the reverse proxy server masks the identity of the machines behind your organization's firewall, thus protecting internal machines from being attacked directly by Internet users. Additional security functions can be implemented in the reverse proxy server to further protect your internal network from outside users.
Adding Portal for ArcGIS to your reverse proxy server
Before adding Portal for ArcGIS to your organization's reverse proxy server, you must complete the following:
- Configure HTTPS (HTTP and HTTPS or HTTPS-only) on the reverse proxy server. Portal for ArcGIS requires HTTPS for some communication. Consult the product documentation for your proxy server to learn how to set up HTTPS.
- If you've federated ArcGIS Server with your portal, you'll need to unfederate (remove) the server before proceeding. For full instructions, see Removing an ArcGIS Server site from your portal.
- Configure ArcGIS Web Adaptor with your portal. Portal for ArcGIS requires the use of ArcGIS Web Adaptor, and this will allow the reverse proxy server to communicate with your portal correctly. For full instructions, see the configuration topics for IIS, Java (Windows), or Java (Linux).
After removing any federated servers and configuring ArcGIS Web Adaptor with Portal for ArcGIS, ArcGIS Web Adaptor can be used with your organization's reverse proxy server by adding the components directly to proxy server directives. For example, if you're using Apache as a reverse proxy server, you need to add ArcGIS Web Adaptor to the ProxyPass directives in the Apache web server configuration file httpd.conf:
ProxyPass /arcgis https://webadaptor.domain.com/arcgis
ProxyPassReverse /arcgis https://webadaptor.domain.com/arcgisThe ProxyPass directives must match the name designated for ArcGIS Web Adaptor (/arcgis in the sample above). If the URL to your site does not end with the default string /arcgis, specify the nondefault name of ArcGIS Web Adaptor (for example, /myorg).
Verify that the proxy server supports gzip encoding and is configured to allow the Accept-Encoding header. This header allows HTTP 1.1 responses to be compressed using gzip encoding. For example, if the header is allowed, a request to load the map viewer will return a compressed response of approximately 1.4MB to the browser. If the header is not allowed or ignored, the request will return an uncompressed response of approximately 6.8MB to the browser. If your network speed is slow, it may take a long time for the map viewer to load if responses are not compressed. It's highly recommended that you allow this header as part of your reverse proxy server configuration.
Set the portal's WebContextURL property. This helps Portal for ArcGIS construct the correct URLs on all resources it sends to the end user. Do the following to change the WebContextURL:
- Open a web browser and sign in to the ArcGIS Portal Directory as an Administrator of your organization. The URL is formatted https://portal.domain.com:7443/arcgis/portaladmin.
- Click System > Properties > Update Properties.
- On the Update System Properties dialog box, insert the following JSON, substituting your own reverse proxy server or DNS alias URL as seen by users outside your organization's firewall.
{ "WebContextURL": "https://reverseproxy.domain.com/myorg" } - Click Update Properties.
Once you've configured the reverse proxy server with your portal, you'll now access your portal through the reverse proxy server URL instead of the ArcGIS Web Adaptor URL. Anything you access in the portal website or the ArcGIS Portal Directory will return the reverse proxy server URL.
The following administrative tasks should be redone using the reverse proxy server URL:
If you've previously added secured services as items in your portal, you'll need to delete the original items and add them again. This is because the original items use the ArcGIS Web Adaptor URL instead of the reverse proxy server URL. For instructions, see Connecting to secured services.