A reverse proxy server is a computer that is deployed within a perimeter network (also known as a demilitarized zone [DMZ] or screened subnet) that handles requests from the internet and forwards them to the machines in your internal network. The forwarding of requests on behalf of the reverse proxy server masks the identity of the machines behind your organization's firewall, thus protecting internal machines from being attacked directly by internet users. Additional security functions can be implemented in the reverse proxy server to further protect your internal network from outside users.
If your reverse proxy server supports a health check function, you can use the Portal for ArcGIS heath check end point to determine whether the portal is available to receive requests. This is useful to quickly determine whether there's a software or hardware failure in the site. For more information, see the portal Health Check topic in the ArcGIS REST API.
Caution:
The configuration detailed in this topic must be performed before federating any ArcGIS Server site with your ArcGIS Enterprise portal. Adding a DNS alias or reverse proxy after an ArcGIS Server site has been federated with your portal is not supported. If you need to change the hostname in your organization URL, please contact Esri Professional Services or another trusted consulting partner for guidance.
Unfederating an ArcGIS Server site has several significant consequences, and is not easily undone. To learn more, see Administer a federated server.
Add Portal for ArcGIS to your reverse proxy server
Before adding Portal for ArcGIS to your organization's reverse proxy server, you must complete the following:
- Configure HTTPS (HTTP and HTTPS or HTTPS-only) on the reverse proxy server. Portal for ArcGIS uses HTTPS for communication by default. Consult the product documentation for your proxy server to learn how to set up HTTPS.
- Configure ArcGIS Web Adaptor with your portal if your portal will use Integrated Windows Authentication. Portal for ArcGIS requires the use of ArcGIS Web Adaptor for this purpose, and this will allow the reverse proxy server to communicate with your portal correctly. For full instructions, see Configure ArcGIS Web Adaptor.
Verify that the proxy server supports gzip encoding and is configured to allow the Accept-Encoding header. This header allows HTTP 1.1 responses to be compressed using gzip encoding. For example, if the header is allowed, a request to load Map Viewer will return a compressed response of approximately 1.4 MB to the browser. If the header is not allowed or ignored, the request will return an uncompressed response of approximately 6.8 MB to the browser. If your network speed is slow, it may take a long time for Map Viewer to load if responses are not compressed. Esri highly recommends that you allow this header as part of your reverse proxy server configuration.
Add ArcGIS Web Adaptor to proxy server directives
After configuring ArcGIS Web Adaptor with Portal for ArcGIS, ArcGIS Web Adaptor can be used with your organization's reverse proxy server by adding the components directly to proxy server directives. For example, if you're using Apache as a reverse proxy server, you need to add ArcGIS Web Adaptor to the ProxyPass directives in the Apache web server configuration file httpd.conf:
ProxyPass /arcgis https://webadaptorhost.domain.com/webadaptorname
ProxyPassReverse /arcgis https://webadaptorhost.domain.com/webadaptornameThe ProxyPass directives must match the name designated for ArcGIS Web Adaptor (/webadaptorname in the sample above). If the URL to your site does not end with the default string /arcgis, specify the nondefault name of ArcGIS Web Adaptor (for example, /myorg).
Prepare your reverse proxy
Before deploying your reverse proxy server for use with the portal, Esri recommends you configure some of the reverse proxy's headers to ensure proper communication.
In the load configuration of the reverse proxy server, set an X-Forwarded-Host header to the host name of the reverse proxy. Portal for ArcGIS expects to see this property set in the header sent by the reverse proxy and will return requests that match the reverse proxy server's URL. If you aren't using ArcGIS Web Adaptor with your portal, set the Host header to match the host name of the machine where Portal for ArcGIS is installed.
Tip:
You can use the machines endpoint in the ArcGIS Portal Administrator Directory to view the host name of the machine running Portal for ArcGIS.
For example, a request to the Portal for ArcGIS REST endpoint (https://reverseproxy.domain.com/arcgis/sharing/rest) will be returned to the client as the same URL. If the property is not set, Portal for ArcGIS may return the URL of the internal machine where the request was directed (for example, https://portal.domain.com/arcgis/sharing/rest instead of https://reverseproxy.domain.com/arcgis/sharing/rest). This is problematic, as clients will not be able to access this URL (commonly noted as a browser 404 error). Also, this gives the client access to some information about the internal machine.
Along with the X-Forwarded-Host header, your reverse proxy server must be able to direct redirects (HTTP codes 301 or 302). You should also update its Location header to ensure that the fully qualified domain name (FQDN) and context of the response match the portal's WebContextURL value.
Set the WebContextURL property
The portal's WebContextURL property helps it construct the correct URLs on all resources it sends to the end user.
Note:
If you do not use ArcGIS Web Adaptor in your deployment, be sure that the reverse proxy server's context name only goes one URL level deep. For example, you can have a reverse proxy URL such as https://proxy.domain.com/enterprise, but you cannot have a reverse proxy URL such as https://proxy.domain.com/myorg/enterprise.
- Open a web browser and sign in to the ArcGIS Portal Directory as a member of the default administrator role in your portal organization. The URL is formatted https://portal.domain.com:7443/arcgis/portaladmin.
- Click System > Properties > Update Properties.
- On the Update System Properties dialog box, insert the following JSON, substituting your own reverse proxy server or DNS alias URL as seen by users outside your organization's firewall.
{ "WebContextURL": "https://reverseproxy.domain.com/enterprise" }Note:
Portal for ArcGIS only supports a single DNS.
Note:
You cannot use a non-standard port (that is, a port other than 7443) when setting the WebContextURL property.
- Click Update Properties.
Redo administrative tasks
Once you've configured the reverse proxy server with your portal, you'll now access your portal through the reverse proxy server URL instead of the ArcGIS Web Adaptor URL. Anything you access in the portal website or the ArcGIS Portal Directory will return the reverse proxy server URL.
The following administrative tasks should be redone using the reverse proxy server URL:
If you've previously added secured services as items in your portal, you'll need to delete the original items and add them again. This is because the original items use the ArcGIS Web Adaptor URL instead of the reverse proxy server URL. For instructions, see Connect to secure services.
After configuring your reverse proxy server with the portal, you may need to adjust its settings. For example, if operations or requests within your deployment fail with an error indicating the connection timed out, the problem may be that your reverse proxy server's time-out value is too short. To fix this error, consider increasing the time-out value to allow long-running requests, such as federating a server, to complete.