Questions or issues that you may encounter when working with ArcGIS Enterprise portals as well as possible solutions are listed below. If you don't find your particular question, you can also search for articles on the Esri Support center website.
Installation
Upgrading
- After upgrading, the portal website does not display correctly, displays an error message, or I can't log in. What's wrong?
- After upgrading, I don't see all of my items, groups, and users in the portal. What's going on?
- When I access the portal website after installing 12.0, I see a notice that the number of licenses assigned in the organization exceeds the number of licenses available. How do I resolve this issue?
- When attempting to create the initial administrator account when upgrading my portal, I receive the message There was an error creating your initial administrator account. How do I resolve this to complete the upgrade?
- When I open Organization > Settings > ArcGIS Online in the portal website to update subscriber and premium ArcGIS Living Atlas of the World content after upgrading the portal, I see an error message that credentials are invalid or ArcGIS Online cannot be accessed. What is wrong and how do I correct these issues?
Administration
- How do I configure Portal for ArcGIS to be highly available?
- What is the purpose of the initial administrator account? Can I demote or delete it?
- How do I connect to an ArcGIS Server site after federating it with my portal?
- When attempting to federate an ArcGIS Server site with my portal, a message displays in the Add ArcGIS Server dialog box stating There was an error communicating with the server. Please check your URL and your credentials and try again.
- Can I rename the machine where Portal for ArcGIS is installed?
- When I attempt to open the portal website in Internet Explorer, the website fails to load or a message is returned stating the website could not be displayed.
- How do I configure Portal for ArcGIS with my organization's reverse proxy server?
- Can I configure the same ArcGIS Web Adaptor to work with both ArcGIS Server and Portal for ArcGIS?
- If my portal uses Lightweight Directory Access Protocol (LDAP) groups, does the portal identity store update as soon as a new login is added to a group on my LDAP server?
- If my portal uses LDAP groups, are new LDAP groups automatically added to my portal when I add them to my LDAP server?
- If my portal uses LDAP accounts and groups, what happens when a user is deleted from my LDAP server?
- If my portal uses LDAP groups, what happens to the corresponding portal when an LDAP group is renamed or deleted from my LDAP server?
- I configured my organization's sign-in to use only OpenID Connect logins and turned off the option for members to log in using their built-in ArcGIS accounts. How do I re-enable this option?
- I configured my organization's sign-in to use only SAML logins and turned off the option for members to log in using their built-in ArcGIS accounts. How do I re-enable this option?
- After switching my portal's security configuration from LDAP to SAML, all SAML users are removed from their SAML-based groups every night. What's happening?
- It takes a very long time for Map Viewer to load in my web browser.
- Thumbnails for newly created web maps are not generated or do not display correctly.
- After configuring a new custom SSL certificate, my portal is inaccessible. How can I recover?
- When I open Organization > Settings > Living Atlas in the portal website, I see an error message that indicates credentials are invalid or ArcGIS Online cannot be accessed. What is wrong and how do I correct these issues?
Backups
Installation
Why does the setup prevent me from installing Portal for ArcGIS if the installation user has file handle limits of less than 65,535?
For the portal to run properly, the file handle limits for the installation user are required to be set to 65535. An installation diagnostics tool checks whether these limits are set properly in the /etc/security/limits.conf file. If the limits are set incorrectly, the diagnostics check will fail.
There are soft and hard limits for file handles on Linux. To determine the limits, use the following commands:
- Soft limit: ulimit -Sn
- Hard limit: ulimit -Hn
To increase the soft and hard limits, you need to edit the /etc/security/limits.conf file with superuser access. For example, add two lines in the file as follows:
<Portal for ArcGIS installation user> soft nofile 65535
<Portal for ArcGIS installation user> hard nofile 65535
After making this change, sign out and sign back in with the particular user information for the new values to take effect. To verify that the limits have been modified appropriately, use the ulimit -Sn and ulimit -Hn commands as described above.
Upgrading
After upgrading, the portal website does not display correctly, displays an error message, or I can't log in. What's wrong?
Clear your browser's cache (including cookies). These errors are typically due to information from the previous version of the website being cached in the browser. If you still can't log in, make sure you are using the initial administrator account or an account that has administrative privileges to the organization.
After installing the software and specifying the initial administrator account, you must reindex the portal. This step completes the upgrade of the portal. Initially, you may not see all of your items, groups, and users because the reindex is not complete. Depending on the number of users and volume of content in your organization, it may take some time for the reindex to complete. For example, a small organization (hundreds of users and content items) running Portal for ArcGIS on a machine with 8 cores may take 15 minutes to reindex. Conversely, a large organization (tens of thousands of users and content items) running Portal for ArcGIS on a machine with 8 cores may take more than 3 hours to reindex.
You can check the status of the reindex by following the steps below. When the store and index counts are equal, the reindex and upgrade processes are complete.
- Open the Portal Administrator Directory and sign in with the initial administrator account. The URL is formatted https://portal.domain.com:7443/arcgis/portaladmin.
- Click System > Indexer > Index Status.
- Refresh the page to obtain the latest status.
When I access the portal website after installing 12.0, I see a notice that the number of licenses assigned in the organization exceeds the number of licenses available. How do I resolve this issue?
You cannot have more users assigned licenses than what the ArcGIS Enterprise portal is licensed for. This notice shows whether you have more add-on licenses or user types assigned than you have available. Users assigned licenses that exceed the number of licenses available may not be able to access the portal. To resolve this issue, go to the Licenses tab and reassign licenses that are in overdraft. Alternatively, to add licenses, obtain a new portal license file. See Manage licenses to learn more about assigning licenses in the portal.
When attempting to create the initial administrator account when upgrading my portal, I receive the message There was an error creating your initial administrator account. How do I resolve this to complete the upgrade?
Information in the portal logs can help you resolve the issue. This error can occur if network connectivity was temporarily lost when creating the account. To access the logs, browse to the logs directory and open the most recent log file (for example, <Portal for ArcGIS installation directory>/arcgisportal/logs/<machine name>/portal/portal-20141201.095803-8596-0.0.log). If necessary, users in the United States can contact Esri Support and international users can contact their distributor for additional help.
When I open Organization > Settings > ArcGIS Online in the portal website to update subscriber and premium ArcGIS Living Atlas of the World content after upgrading the portal, I see an error message that credentials are invalid or ArcGIS Online cannot be accessed. What is wrong and how do I correct these issues?
The portal must validate your ArcGIS Online credentials before you can update subscriber and premium ArcGIS Living Atlas content. If it cannot, one of the following messages is returned in the portal website and in the logs for the hosting server:
- The credentials used to access subscriber and/or premium Living Atlas content are invalid. Update credentials with valid ArcGIS Online organizational account credentials before you upgrade Living Atlas content.—ArcGIS Enterprise connected to the ArcGIS Online organization and determined that your existing credentials are invalid. Make sure the password has not changed for your ArcGIS Online account and, for premium content, that the account still has credits available.
If the password changed or if you need to provide a new account to access subscriber and premium ArcGIS Living Atlas content from ArcGIS Online, update credentials. If you updated credentials as part of upgrading Portal for ArcGIS, click Upgrade Content to complete the ArcGIS Living Atlas content upgrade.
- ArcGIS Online cannot be accessed from this portal. Check your firewall settings or portal proxy settings before you upgrade Living Atlas content.—ArcGIS Enterprise cannot connect to the ArcGIS Online account associated with your credentials. In most cases, this is due to issues on your network that are preventing communication with ArcGIS Online.
- Cannot validate credentials used to access subscriber and/or premium Living Atlas content, therefore you cannot upgrade the content. Contact Esri technical support or your international distributor.—In rare cases, problems with the Portal for ArcGIS upgrade can prevent you from upgrading ArcGIS Living Atlas content. If you see this message, contact Esri technical support (in the United States) or your international Esri distributor (outside the United States) to identify and correct the problem.
Administration
Portal for ArcGIS is configurable and supported in a highly available environment. For full instructions, see Configure a highly available portal.
After you've installed Portal for ArcGIS and configured it for use, you can access the portal website. At this time, you need to provide the name, password, email, and identity question and answer for a new account that you will initially use to sign in to the website and administer the portal. This account is called the initial administrator account.
The initial administrator account user name and password are stored by Portal for ArcGIS. The initial administrator is not an operating system account, and it has no relation to the Portal for ArcGIS account. Later, you can specify other accounts as administrators, demote the initial administrator to a role with fewer privileges, or delete the initial administrator account.
When you federate an ArcGIS Server site with the portal, the portal's security store controls all access to the server. The users and roles you previously used with ArcGIS Server are no longer valid for accessing the server; instead, you perform all connections to the server using portal accounts.
The only exception is the ArcGIS Server primary site administrator account. You can always log in to the ArcGIS Server Administrator Directory using this account if you connect directly through port 6080 or 6443. However, you cannot use this account to log in to ArcGIS Server Manager when the server is federated with the portal.
To learn more about how to connect to an ArcGIS Server site when it's federated with a portal, see Administer a federated server.
When attempting to federate an ArcGIS Server site with my portal, a message displays in the Add ArcGIS Server dialog box stating There was an error communicating with the server. Please check your URL and your credentials and try again.
You may encounter this error for any of the following reasons:
- The Server URL or the Administrator URL value you entered for the ArcGIS Server site is incorrect or unreachable. Verify the following:
- If the ArcGIS Server site includes ArcGIS Web Adaptor, the Server URL value is the Web Adaptor address, for example, http://webadaptorhost.domain.com/webadaptorname. If no Web Adaptor is present, the Server URL value is the same as the Administrator URL value, for example, http://gisserver.domain.com:6080/arcgis.
- If your organization requires HTTPS for all communication, use https in the URL.
- The URL includes the fully qualified domain name (FQDN) of the machine. The FQDN is required.
- The communication protocol of the ArcGIS Server site has been updated to use HTTP and HTTPS or HTTPS only.
- The communication protocol matches that of the portal. For example, if the portal requires HTTPS for all communication, ArcGIS Server should also be configured as HTTPS only. Conversely, if the portal does not require HTTPS, the server communication protocol should be HTTP and HTTPS.
- If the ArcGIS Server site includes ArcGIS Web Adaptor, ArcGIS Web Adaptor must be reconfigured with ArcGIS Server after updating the site's communication protocol.
- Your firewall allows communication between ArcGIS Server and your portal. For information about the specific ports to open, see Ports used by ArcGIS Server and Ports used by Portal for ArcGIS.
- Web-tier authentication is disabled and anonymous access is enabled on the ArcGIS Server site. Although it may sound counterintuitive, this is necessary so your site is free to federate with the portal and read the portal's users and roles.
- You entered an incorrect Username or Password:
- For Username, specify the user name of the primary site administrator account that was used to initially log in to ArcGIS Server Manager and administer the server. If this account is disabled, you must reenable it. No other account can be used.
- For Password, provide the password of the primary site administrator account.
For more information, see Federate a site.
To configure Portal for ArcGIS with a reverse proxy server, you need to provide information about the proxy server. For full instructions, see Integrate your portal with a reverse proxy or load balancer.
If my portal uses Lightweight Directory Access Protocol (LDAP) groups, does the portal identity store update as soon as a new login is added to a group on my LDAP server?
No. If the organization-specific account already exists in the portal and the LDAP group is linked to a portal group, the identity store refreshes when the new member signs in to the portal or the next time the portal identity store automatically refreshes, whichever occurs first. By default, the identity store updates each day at midnight. The portal administrator can alter the frequency and time the identity store refreshes using the Update Identity Store operation in the Portal Administration API to alter values for the membershipRefreshIntervalHours and membershipRefreshStartTime parameters.
If the organization-specific account is not a member of the portal, adding the login to an LDAP group that is linked to a portal group does not automatically add the account to the organization. As the administrator, you don't want every login ever added to the LDAP server to automatically be added to your organization.
If my portal uses LDAP groups, are new LDAP groups automatically added to my portal when I add them to my LDAP server?
No. The portal administrator manually configures a group in the portal to use an LDAP group. When the administrator finishes configuring the portal group, any existing portal organization-specific accounts that are members of the LDAP group automatically become members of the portal group.
If you use LDAP groups, only logins in the group you specify are added to the portal group; members of nested groups are not. For example, if you specify a top-level LDAP group, only the logins that are existing portal members are added to the portal group; no logins from a nested group are included. You can, instead, specify a nested group. In that case, only logins in the nested group that are existing portal members are added to the portal group.
If my portal uses LDAP accounts and groups, what happens when a user is deleted from my LDAP server?
If the deleted organization-specific user exists in the portal, the member is removed from any portal LDAP groups the next time the identity store refreshes (by default, that's each day at midnight). However, the member is not removed from the portal identity store. Since the corresponding LDAP account no longer exists, the member cannot sign in to the portal, but the portal administrator must manually reassign any items or groups owned by the member and delete the account to free the portal license.
If my portal uses LDAP groups, what happens to the corresponding portal when an LDAP group is renamed or deleted from my LDAP server?
If the LDAP group is linked to a portal group, members are removed from the group the next time the portal identity store refreshes (either when each member logs in or at the scheduled identity store update time). Once members are removed, only the group owner or portal administrator can access the group. The portal administrator or group owner can delete the group, or the portal administrator can reassign the portal group to a different LDAP group.
I configured my organization's sign-in to use only OpenID Connect logins and turned off the option for members to log in using their built-in ArcGIS accounts. How do I re-enable this option?
If you need to provide access to the portal through built-in accounts again, you can do so by following the steps below.
- Navigate to the following location on Portal for ArcGIS: /portal/tools/security/.
- Run the enableArcgisLogins shell script to re-enable the option for members to log in with their built-in ArcGIS accounts.
Members who access the sign in page will then see the button to log in to the portal using an identity provider account as well as the Using Your ArcGIS Account button.
I configured my organization's sign-in to use only SAML logins and turned off the option for members to log in using their built-in ArcGIS accounts. How do I re-enable this option?
If you need to provide access to the portal through built-in accounts again, you can do so by following the steps below.
- Navigate to the following location on Portal for ArcGIS: /portal/tools/security/.
- Run the enableArcgisLogins shell script to re-enable the option for members to log in with their built-in ArcGIS accounts.
Members who access the sign in page will then see the button to log in to the portal using an identity provider account as well as the Using Your ArcGIS Account button.
After switching my portal's security configuration from LDAP to SAML, all SAML users are removed from their SAML-based groups every night. What's happening?
When you switch the portal's security configuration to SAML, you must restart Portal for ArcGIS to completely clear the previous settings for LDAP. When Portal for ArcGIS is configured to use users and groups from LDAP, group membership for each user is automatically cleared and updated every night. This group membership refresh is not required when SAML-based group memberships is used. If group membership refresh is run when SAML is configured, SAML users will lose their group membership each time the group refresh call is made.
If you're using a reverse proxy server or load balancer with the portal to handle requests from the internet, verify that the reverse proxy server or load balancer supports gzip encoding and is configured to allow the Accept-Encoding header. This header allows HTTP 1.1 responses to be compressed using gzip encoding. For example, if the header is allowed, a request to load Map Viewer will return a compressed response of approximately 1.4 MB to the browser. If the header is not allowed or ignored, the request will return an uncompressed response of approximately 6.8 MB to the browser. If your network speed is slow, it may take a long time for Map Viewer to load if responses are not compressed. It's recommended that you allow this header as part of the reverse proxy server configuration.
You may encounter this problem if the web maps contain ArcGIS Server services that use HTTPS. If this is the case, check whether the portal is configured with a print utility service from an ArcGIS Server site. The print service may be running on a machine that does not trust Certificate Authority (CA) signed certificates from the ArcGIS Server site providing the HTTPS services. Each machine running the print service must be configured to trust these CA certificates at the operating system level. See Enable HTTPS using a new CA-signed certificate for details on how to do this.
If you incorrectly configured the SSL certificate and cannot sign in to the portal, follow the steps below to recover.
- Stop Portal for ArcGIS.
- Back up the \ArcGIS\Portal\framework\runtime\tomcat\conf\server.xml file.
- Open ArcGIS\Portal\framework\runtime\tomcat\conf\server.xml in a text editor.
- Locate the SSL connector by searching for the <Connector SSLEnabled="true" string.
- Change the value of the keyAlias parameter back to the default value, which is keyAlias="portal", and save your changes.
- Log in to the Portal Administrator Directory as a member with administrative privileges.
- Choose Security > SSLCertificates and click Update. On the next page, confirm Update without modifying any parameters.
- The portal automatically restarts.
When I open Organization > Settings > Living Atlas in the portal website, I see an error message that indicates credentials are invalid or ArcGIS Online cannot be accessed. What is wrong and how do I correct these issues?
The portal requires valid ArcGIS Online credentials to access subscriber and premium ArcGIS Living Atlas. If the portal cannot access ArcGIS Online using the credentials you used when you enabled ArcGIS Living Atlas subscriber and premium content, one of the following messages is returned in the portal website and in the logs for the hosting server:
- The credentials used to access subscriber and/or premium Living Atlas content are invalid. Update credentials with valid ArcGIS Online organizational account credentials.—ArcGIS Enterprise connected to the ArcGIS Online organization and determined that your existing credentials are invalid. Ensure the password has not changed for your ArcGIS Online account and, for premium content, that the account still has credits available.
If the password changed or if you need to provide a new account to access subscriber and premium ArcGIS Living Atlas content from ArcGIS Online, update credentials.
- ArcGIS Online cannot be accessed from this portal. Check your firewall settings or portal proxy settings.—ArcGIS Enterprise cannot connect to the ArcGIS Online account associated with your credentials. In most cases, this is due to issues on your network that are preventing communication with ArcGIS Online.
- Cannot validate credentials used to access subscriber and/or premium Living Atlas content, therefore you cannot upgrade the content. Contact Esri technical support or your international distributor.—An uncommon internal error has occurred that cannot be identified. If you see this message, contact Esri technical support (if you're in the United States) or your international distributor (if you're outside the United States.) to identify and correct the problem.
Backups
The portal stores incremental transaction logs in a subdirectory of the portal content directory, which allows you to create incremental backups of the portal. The default location is /home/<user>/arcgis/portal/usr/arcgisportal/backup/walarchive).
Once you create a full backup using the webgisdr tool, the initial size limit is no longer enforced; however, each time the tool is run, existing transaction logs are removed. In the event where this subdirectory size exceeds 5 GB, the following message is logged:
The transaction logs of the portal are consuming more than 5 GB of disk space. Run a full backup using the webgisdr tool to clear out these logs.
By default, there is a 50 MB limit on transaction logs for backups. If your environment doesn't support geographic redundancy where you restore to a secondary data center, set BACKUP_RESTORE_MODE to backup instead of full.
To learn more about the webgisdr tool, see Create an ArcGIS Enterprise backup.
This error occurs when an item is still present in the portal's internal database but is not present in the content directory. This is the result of an incomplete item deletion. Normally, when you delete an item, it is deleted from the internal database as well as the content directory. However, sometimes an item is not successfully deleted from the internal database.
If this is the case, when you create a backup, a WARNING error is logged, indicating that the item must be deleted manually. Note the itemID value or values provided by the error message. Unless this item is owned by Esri, you can follow the steps below to delete the item.
Tip:
You can also contact Esri Technical Support for help with these steps.
- Sign in to the ArcGIS Portal Directory (Sharing API) as an administrator (https://portal.domain.com/webadaptor/sharing/rest).
- Search for the item in the API using the /search endpoint. For the Search Text parameter, enter id: using the itemID from the log message.
- In the search results, click the link identifying the owner of the item. The owner's information page appears.
- Under Related Resources, click User Content.
- Click the itemID from the logs. A message appears indicating an Internal Server Error.
- Append /delete to the item endpoint's URL. Confirm the delete operation.
- Repeat steps 2–6 for each item that appeared in the log message.
When you try to restore a backup using the Import Site operation in the Portal Administrator Directory, it generates a token that expires after one hour. If the restore operation doesn't complete within an hour, the import process will fail.
If it takes longer than an hour to restore, generate a token using the sharing API and specify the expiration time to be longer than the default. Use this token to access the Portal Administrator Directory:
- If you are using the directory in a web browser, append the new token to the Administrator Directory URL for the Import Site operation.
- If you are calling the operation from a script, include the new token in this API call.