Multiple ArcGIS Server Web instances for security

An ArcGIS Server instance supports only one combination of user location, role location, and authentication method (for more information on users and roles, see the Overview of setting up users and roles). If you need to support more than one type of authentication or user/role store, then you can set up multiple ArcGIS Server instances.

Normally, each ArcGIS Server system has one instance, which is tied to a single Server Object Manager (SOM). This section describes the configuration where multiple ArcGIS Server instances are tied to a single SOM.

For example, you may have users on your internal network and want to allow them to log in with their Windows accounts. But for external users on the Internet, you want to set up accounts in a SQL Server database. Since an ArcGIS Server instance only supports a single user location, you would set up separate instances for each user type.

You need to think about two issues when managing multiple instances:

Adding an ArcGIS Server instance

A utility for adding and removing instances is included at <ArcGIS Server installation directory>\DotNet\AddInstance.exe. You can double-click this executable from Windows Explorer to open the tool. Follow the instructions in the wizard for adding a new instance.

The name you choose for the instance will be reflected in the URL that others use to access the instance. For example, if you enter ArcGIS2, then the services URL might be http://myserver/ArcGIS2/services.

Once you finish the wizard, it can take several minutes to create the instance. If you decide later to remove an instance, you can use the same utility.

Using the new instance

The new instance has its own Manager. To access it, go to Start > (All) Programs > ArcGIS > ArcGIS Server for the Microsoft .NET Framework > ArcGIS Server Manager <instance name>. Use the new Manager to configure the user and role store for the new instance. You will notice that the Services panel lists the same services as the original Manager and that the permissions for services are also the same. See the next section for important information on managing permissions across multiple instances.

The new instance will not list the Web applications created with a different instance. Each instance maintains its own list of applications created with that instance.

Each instance is located in the IIS Web server directory where you created the instance. For example, if you created a new instance named ArcGIS2 in the Default Web Site on port 80, and the IIS server uses the default location, the location for the instance will be at C:\Inetpub\wwwroot\ArcGIS2. The new instance will contain the same set of folders as the original instance, including Rest, Services, and Security.

Managing permissions with multiple ArcGIS Server instances

Since permissions are stored in the SOM, multiple ArcGIS Server instances sharing the SOM will also share the same set of permissions for services. When you click the Permissions button for a service or folder, you will see the permissions for roles that have been added with either instance's Manager.

You must manage the permissions for folders and services so that users in both instances can access services appropriately. Since permissions are based on roles, rather than users, you must ensure that the roles for each instance are allowed for services as needed. Since administrators using either Manager see the same list of permitted roles, it would be possible to mistakenly remove a role that had been allowed in the other Manager.

One of the following two strategies is recommended for managing roles and permissions:

NoteNote:

If one of your instances uses ASP.NET membership, be aware that the three built-in roles (Everyone, Authenticated User, and Anonymous) will span all instances. For example, suppose you are using the Microsoft SQL Server membership provider for one instance and the Windows operating system users and groups for the second. If you grant access to the root Web service folder in the SQL Server instance, all Windows users will be able to see all Web services when they connect.


11/18/2013