Mastering ArcGIS Enterprise Administration

The GIS Server role is core ArcGIS Server; it is the role that provided many of the ArcGIS Server capabilities prior to ArcGIS Enterprise 10.5. ArcGIS GIS Server is still offered in three editions, with each successive edition offering additional functionality:

With ArcGIS Image Server, formerly known as Image Server Extension, large collections of satellite imagery, aerial photos, and rasters can be served dynamically on the fly. Image Server can also run raster processing models allowing distributed analysis of imagery and rasters.

GeoEvent Server, known as the GeoEvent Extension prior to 10.5, enables the integration of real-time data into your enterprise GIS from a variety of sources and sensors. With GeoEvent Server, you can stream event data to client applications, view feature statuses with the Operations Dashboard for ArcGIS, filter geoevents, and detect and analyze the spatial proximity of events with geofences. With GeoEvent Server, real-time data can be published to a spatiotemporal big data store.

With ArcGIS GeoAnalytics Server, new at 10.5, big data analysis can be distributed across multiple ArcGIS Server machines, allowing users to perform analyses more quickly on even larger amounts of data than before.

ArcGIS Business Analyst Server, when used with ArcGIS Enterprise, enables your organization to host business analyst-based capabilities such as site analytics and custom reporting. Business Analyst Server also allows you to host the Esri GeoEnrichment service on-premise and behind your firewall.

As discussed earlier in this chapter, ArcGIS GIS Server is offered in three editions, with each successive edition offering additional functionality--Basic, Standard, and Advanced. Let's examine these editions a bit closer.

There also exist two levels of ArcGIS Enterprise--ArcGIS Enterprise and ArcGIS Enterprise Workgroup.

Licensing for ArcGIS Enterprise 10.5.1 is like licensing at 10.4. With your purchase of ArcGIS Enterprise is included a set of named user entitlements to be used within Portal for ArcGIS. A named user is a specified user for running ArcGIS Pro or a Premium App through ArcGIS Online of Portal for ArcGIS. The number of entitlements you receive depends on the edition and level of ArcGIS Enterprise purchased by your organization. Named user entitlements also differ for licensing under an Enterprise Licensing Agreement (ELA), education site license, or any other special licensing agreement with Esri.

The following are the named user entitlements:

Level 1 (L1) users are content viewers who can only view content shared with them through the organization. L1 users cannot own items or edit items. Level 2 (L2) users can view, create, edit, and share content and can be assigned into the Portal roles of User, Publisher, and Administrator. L1 access is no different than public anonymous (Share with Everyone), but allows named users to participate in focused sharing through groups.

ArcGIS Server is supported on Windows Server 2012 R2 Standard and Datacenter; Windows Server 2012 Standard and Datacenter; Windows Server 2008 R2 Standard, Enterprise, and Datacenter; and Windows Server 2008 Standard, Enterprise, and Datacenter. Flavors of Windows 10, 8.1, and 7 are also supported for basic testing and application development only, not for production environments. Throughout this book, we will focus on ArcGIS Server on Windows.

ArcGIS GIS Server, GeoEvent Server, Image Server, or Business Analyst for Server are recommended to have 8 GB of RAM per unique license role in a production environment. ArcGIS Server requires a minimum of 10 GB of available disk space.

ArcGIS Server requires several ports be open to allow communication with machines both externally on the internet and internally on an intranet. The following ports need to be allowed on your firewall:

ArcGIS Server comes preconfigured with a self-signed secure socket layer (SSL) certificate. Although not required, it is highly recommended that you purchase and install an SSL certificate from a trusted certificate authority (CA) or a local domain CA. SSL provides encryption of sensitive information (such as usernames and passwords for logging in to ArcGIS Server and Portal) and authentication to ensure that information is being sent where it is intended to go, and not to an imposter. The downside to SSL is that certificates do cost money, but at the time of this writing, SSL certificates can be purchased for around $70 USD, a small price to pay for peace of mind for you and your end users. See the SSL certificate installation section, discussed later in this chapter, for more information.

For the latest system requirements, please consult the ArcGIS Enterprise online help.

In a single-machine deployment, all components of ArcGIS Enterprise are installed in one single machine, either physically or virtually. This means the one machine acts as a database server, application server, and web server. This is a minimalist configuration that can be used in a production environment, but it is better suited for a testing or development environment. For the purposes of this book, we will use a single-machine deployment in Amazon Web Services. In a minimalist, conceptual form, a single-machine deployment would look like the following diagram:

Esri recently released ArcGIS Enterprise Builder, which provides a simple installation and configuration experience for a base ArcGIS Enterprise single-machine deployment.

The multi-machine, or multi-tiered (where each machine is a tier), is the most common deployment scenario. Here, each component of ArcGIS Enterprise is installed on a separate virtual or physical machine. This means that there is a separate machine for each of the following:

Although more complex than the single-machine deployment, the multi-tiered deployment allows for isolation of the different components and distribution of the workload. A multi-machine configuration would conceptually look like the following diagram:

Within the multi-tiered deployment, it is possible to have multiple ArcGIS Server machines functioning as a single logical unit. These servers operate in conjunction with the ArcGIS Web Adaptor to form a collective unit referred to as an ArcGIS Server site. Within a site, all ArcGIS Servers share the same configuration store and ArcGIS Server directories. Once configured, the site can be administered from any of the servers within it. For more information on ArcGIS Enterprise deployment scenarios, consult the online documentation.

With Amazon Web Services (AWS), there are several options available for launching ArcGIS Enterprise architectures.

AWS Marketplace

Through the AWS Marketplace (https://aws.amazon.com/marketplace), you can purchase an Amazon Machine Image (AMI) with ArcGIS Enterprise that can be easily deployed from your AWS account. Using the Marketplace, you purchase an AMI and then launch it as a virtual machine through the AWS Management Console:

As with AWS, there are options for using Azure to deploy ArcGIS Enterprise.

Azure Marketplace

Much like the AWS Marketplace, in the Azure Marketplace, you can search for a wide variety of preconfigured, readily available machines ready to be purchased and easily launched in the Azure cloud. The following is an example of an ArcGIS Enterprise machine available for purchase in the Azure Marketplace:

Before starting the installation of ArcGIS Server, there are a few items to acquire:

If you will be utilizing an SSL certificate with your ArcGIS Server site, which is the recommended practice, Esri recommends installing this first before the installation of ArcGIS Server. The acquisition and installation of SSL certificates are quite often not well understood by GIS professionals. This is understandable, as SSL certificates are usually handled by systems administrators. That said, your systems administrator may indeed handle all aspects of SSL certificates within your organization, so contact them first before proceeding with purchasing one yourself. Regardless, let's demystify the process of acquiring and installing SSL certificates.

Acquiring an SSL certificate

Requesting and purchasing an SSL certificate is not as scary as it may seem. Armed with the knowledge of the process, it can be done in a few hours spread out over a few days in most cases.

Requirements

To acquire a basic SSL certificate, a few items are necessary:

• Web server access
• An account with a certificate authority
• A domain name and unique IP address

First, you will need administrative access to the web server that the ArcGIS Web Adaptor will be installed on. For our purposes here, we will be using IIS 8.5 on Windows Server 2012 R2. SSL certificates can, of course, be installed on any flavor of web server. See your web server's documentation for details on SSL certificate installation. Secondly, you, or someone in your organization, will need an account with a certificate authority, such as Digicert, GoDaddy, or Entrust, through which you will apply for and purchase the certificate. Again, check with your systems administrator before proceeding with the purchase of any SSL certificates. Finally, you will need a unique IP address and domain name to go along with it.

Getting the certificate

The first step in acquiring an SSL certificate is the generation of a certificate signing request or CSR. A CSR is a block of encoded text generated on the server where the certificate will be installed; it contains information that will be included in the certificate, such as the organization and domain name. Think of CSR as a digital signature for your server. To generate a CSR in IIS, follow these steps:

1. Launch IIS, select the machine name in the left Connections menu, then double-click on Server Certificates in Features View:

2. In the right Actions menu, click on Create Certificate Request...:

3. Fill out the Distinguished Name Properties, being careful to match these items (especially the Organization name) to those of the WHOIS record for your domain name. Click on Next:

4. For Cryptographic Service Provider Properties, select Microsoft RSA SChannel Cryptographic Provider with a Bit length of 2048; these are typical industry standards:

5. Specify a name and location for your CSR text file, as shown in the following screenshot:

6. Open your CSR in a text editor; it will look like the following screenshot:

The second step in acquiring an SSL certificate is to purchase the certificate from the certificate authority, or CA. All CAs are different, but the process is the same in principle. First, log in to your account and purchase your SSL certificate. There are different options, so research them and find out which is best for your needs. Next, purchase your certificate. After you make the purchase, it will be available to you in your account.

The final step in this process is to apply your CSR to the certificate in your account. Here, you are requesting the certificate with the certificate signing request from your web server--this will bind the SSL certificate to your server, ensuring your end users that the site they are going to is indeed your site. After a successful request of the certificate from the CA, you will be able to download the certificate as a ZIP file.

Installing the SSL certificate

On your web server, you are now ready to install your SSL certificate. Launch IIS and complete the following steps:

1. In the Connections pane, select your server. Next, in Features View, double-click on Server Certificates. Finally, in the Actions pane, click on Complete Certificate Request...:

2. Enter the path to your .crt SSL certificate, then enter the friendly name (your domain name) and select the Personal certificate store:

3. Your SSL certificate is now installed on your web server and should be listed in theServer Certificates pane, as shown here:

Setting your site bindings

Next, you need to bind your server's IP address and host header to port 443 with your SSL certificate. This is done through the Site Bindings settings in IIS. Again, open IIS and complete the following steps:

1. In the Connections left pane, select your website. In the right Actions pane, select Bindings...:

2. In the Site Bindings window, you will more than likely only have one binding for port 80 on http. Click on Add:

3. Add a binding for Type:https, IPAddress:AllUnassigned, Port:443. Select your SSLcertificate from the SSL certificate dropdown, as shown in the following screenshot, and then click on OK:

Your SSL certificate is now bound to port 443. In a browser, navigate to your site over https; in my case, it is https://www.masteringageadmin.com:

Now that your SSL certificate is in place and you have your software authorizations and installers from Esri, it is finally time to install ArcGIS Server. The installation of ArcGIS Server is a straightforward process; as such, we will walk through the process at a high level, while highlighting some of the more important sections:

Next, we come to the setup of the ever-important ArcGIS Server account. The ArcGIS Server account was discussed earlier in this chapter. If you will be using an existing domain account, enter it as domain\user along with the proper password. If you will be using a local account, you can stick with the default name of arcgis or change it. Remember to use a strong password, and it must meet the Windows password requirements. If you have previously saved a configuration file during a previous ArcGIS Server installation and would like to use the same account to run ArcGIS Server, you can use that here to avoid entering the ArcGIS Server account information:

Once the ArcGIS Server installation is completed, the Software Authorization Wizard launches. You can authorize with an authorization file you downloaded from https://my.esri.com, or authorize by email or additional extensions through the wizard.

Using an authorization file from https://my.esri.com is usually the easiest and most common method of authorization. To authorize with an authorization file, follow these steps:

If you are installing ArcGIS Server on a single application server, or you are doing the first of several installations in a multi-machine environment, then you will create a new site:

To begin, go to https://localhost:6443/arcgis/manager in a web browser. There is also an installed shortcut on the Start menu called ArcGIS Server Manager:

In a multi-machine ArcGIS Server configuration, once the first server in the site is stood up and an ArcGIS Server site is configured there, you will add subsequent ArcGIS Server machines to that first site. This process is referred to as joining to an existing site. Before joining an ArcGIS Server machine to an existing site, make sure it meets the following criteria:

To join a new ArcGIS Server machine to an existing ArcGIS Server site, follow these steps:

The ArcGIS Web Adaptor comes as a separate installer that you can download from http://my.esri.com.

Web Adaptor for ArcGIS Server installation

The ArcGIS Web Adaptor installation process is quick and easy:

1. Double-click on the installation executable to launch it.
2. Select a location to unpack the installation files to; a known temporary location is best for easy cleanup later.
3. After the installation files are unpacked, launch the setup program.

4. The ArcGIS Web Adapter for IIS requires certain components of IIS to be installed. At 10.5, there is a verification step in the installer that will detect what components are missing, and it will install them for you. Click on I Agree to install the missing IIS components, if any:

5. Click on Next and agree to the license agreement.
6. Select a port to install the Adaptor to. Since we installed and configured our SSL certificate already, port 443 is available to us. Select port 443 and click on Next:

7. Specify the name of the ArcGIS Web Adaptor for your ArcGIS Server instance. The default here is arcgis. This is an important step in the process, as the Adaptor name will be in your services URL; for example, https://www.masteringageadmin.com/arcgis/rest:

8. Click on Install to begin the installation and click on Finish when done.

Web Adaptor for ArcGIS Server configuration

Once the Web Adaptor for the ArcGIS installation process is complete, the configuration page should open in your default web browser (https://localhost/arcgis/webadaptor). To configure the Web Adaptor for ArcGIS Server, do the following:

Note

There is also a Web Adaptor shortcut in the Windows Start menu named ArcGIS Web Adaptor - <web-adaptor name> (port), such as ArcGIS Web Adaptor - arcgis (443).

1. First, select the product to configure with the Web Adaptor. Here, we are configuring the Web Adaptor for ArcGIS Server. Later, we will also configure a Web Adaptor for Portal for ArcGIS. When we get to the Portal Web Adaptor configuration later, this configuration page will tell us that a server IS configured with our Web Adaptor. Here, select ArcGIS Server and click on Next:

Next is the final and main configuration page.

2. Enter your ArcGIS Server URL. This is the URL to any one of the ArcGIS Server machines in your ArcGIS Server site (remember that all the machines in a site function together as one). The URL should take the form of https://gisserver.domain.com:6443 or http://gisserver.domain.com:6080 if you do not have SSL in place. Here, my ArcGIS Web Adaptor server is not on a domain, so my URL takes the form of my machine name, that is, https://WIN-25FPFGEMUA9:6443:

3. Enter your primary site administrator account credentials or the credentials of another administrative account.
4. Finally, choose whether or not to allow administrative access to your ArcGIS Server site through the Web Adaptor. Esri recommends disabling administrative access, but there are considerations, which are as follows:

• If disabled, administrators cannot access ArcGIS Server Manager and the ArcGIS Server Administrator Directory through the Web Adaptor URL. More importantly, ArcGIS Desktop users cannot establish administrative or publisher connections to ArcGIS Server, meaning publishers cannot publish services directly from their desktops (user connections can still be made regardless of this setting). However, if ArcGIS Server's internal URL is accessible, these connections can be made from there.
• If your ArcGIS Server will be configured with web-tier authentication (more on that later), you must enable administration through the Web Adaptor, allowing administrative and publisher users in the enterprise identity store to publish services from ArcGIS Desktop.

5. Click on Configure to continue. When the Web Adaptor configuration is successful, you will be presented with the following message telling you that your server is successfully configured with the Web Adaptor:

Note

For a secure production environment, it is not recommended to allow administrative access through the same Web Adaptor used to host the REST services. Rather, install a second Web Adaptor with administrative access enabled through the Web Adaptor, possibly on an internal server that is only accessible to local users. This configuration ensures that public users are not presented with the option to access the ArcGIS Server Manager application. If an internal server is not available, a second Web Adaptor with additional security applied to it (Integrated Windows Authentication) that only publishers/administrators have access to can be installed on the same server.

Once the Web Adaptor is successfully configured, you can access your ArcGIS Server site without the port number, such as http://www.masteringageadmin.com/arcgis/rest/services.

Portal for ArcGIS is supported on Windows Server 2016 Standard and Datacenter 64-bit; Windows Server 2012 R2 Standard and Datacenter 64-bit; Windows Server 2012 Standard and Datacenter 64-bit; Windows Server 2008 R2 Standard, Enterprise, and Datacenter 64 bit; and Windows Server 2008 Standard, Enterprise, and Datacenter 64 bit. Windows 10, 8.1, and 7 64-bit are also supported for basic testing and application development only, not for production environments.

Portal for ArcGIS 10.5 requires one four-core processor for every 100 concurrent users, 8 GB of RAM, and 10 GB of disk space minimum for installation.

Like ArcGIS Server, Portal communicates through several predetermined ports. You must ensure that your firewall allows traffic through these ports:

Again, much like ArcGIS Server, Portal for ArcGIS comes preconfigured with a self-signed server certificate suitable for installations and initial testing. However, Portal for ArcGIS requires that you must request a SSL certificate from a trusted certificate authority and configure your Portal to use it. This is especially important if you will be federating your ArcGIS Server with your Portal.

The ArcGIS Web Adaptor is a required component of Portal for ArcGIS; Portal for ArcGIS cannot be deployed without the Web Adaptor, unless you are implementing Portal in a highly available configuration with a load balancer.

The ArcGIS Web Adaptor comes as a separate installer you can download from http://my.esri.com. A completely additional, separate installation of the ArcGIS Web Adaptor is required for Portal for ArcGIS, in addition to any you already have installed for ArcGIS Server.

Portal for ArcGIS Web Adaptor configuration

See the earlier section, Web Adaptor for ArcGIS Server configuration, for more details on the Web Adaptor configuration parameters. To configure the Portal for ArcGIS Web Adaptor, do the following:

1. Select the Portal for ArcGIS radio box.

2. Your Portal URL must be the fully qualified domain name and port to your Portal. This URL must be reachable from the server you are installing your Portal Web Adaptor to. This means that all required ports for Portal must be open inbound on your Portal server. In our case here, our Portal URL is https://www.masteringageadmin.com:7443. The administrator username and password are your Portal PSA--typically, portaladmin:

3. Upon successful configuration, you will be informed of the machine that has been configured with your Web Adaptor.

With the configuration of the ArcGIS Web Adaptor, your Portal for ArcGIS installation and initial configuration is now complete. You can proceed to your Portal from your Portal server at https://<machine name>:7443/arcgis/home or, externally, at your fully qualified URL, such as https://www.masteringageadmin.com/portal, and log in as your Portal PSA.

ArcGIS Data Store is supported on Windows Server 2016 Standard and Datacenter 64-bit; Windows Server 2012 R2 Standard and Datacenter 64-bit; Windows Server 2012 Standard and Datacenter 64-bit; Windows Server 2008 R2 Standard, Enterprise, and Datacenter 64-bit; and Windows Server 2008 Standard, Enterprise, and Datacenter 64-bit. Flavors of Windows 10, 8.1, and 7 64-bit are also supported for basic testing and application development only, not for production environments.

Esri recommends installing ArcGIS Data Store on machines with large quantities of available disk space. The minimum amount of disk space required to install ArcGIS Data Store is 13 GB, but this does not include any data stores or backups. An empty relational data store alone uses up to 2.5 GB of disk space.

The ports used by ArcGIS data store are as follows: