Intermittent sign-out in a Portal for ArcGIS high-availability environment

Description

In a highly-available ArcGIS Enterprise (HA) deployment, users may experience abrupt, intermittent logouts during browsing sessions. This behavior suggests a potential issue related to session persistence, often caused by misconfigured load balancers or improper handling of sticky sessions, which are critical for maintaining continuous user authentication across multiple nodes in an HA environment.

Cause

In a highly-available ArcGIS Enterprise deployment, if the PrivatePortalURL property is not explicitly configured, it defaults to the Fully Qualified Domain Name (FQDN) of the primary portal machine—for example: https://machine-pfa1.domain.com:7443/arcgis. You can verify this setting via the Server Admin Directory under: Security > Config > Portal Properties.

The PrivatePortalURL is used by ArcGIS Server for back-end communication with the portal. When the primary portal is offline and only the standby is accessible, ArcGIS Server still attempts to reach the primary portal using the default FQDN. This mismatch causes login prompts, as the server is unable to successfully authenticate with the expected back-end portal.

Note: 
PrivatePortalURL tells the server how to reach the portal internally, typically through a load balancer or proxy URL configured for high availability.

Solution or Workaround

1. Configure the PrivatePortalURL property, that is, the Virtual IP set on top of both the portals.
2. If an external load balancer is not in place, verify both Portal Admin endpoints using their respective machine names and ports. If they display the same WebContextURL, you can set that value as the privatePortalURL. See the sample JSON configuration to update under Portal Admin > System > Properties:

{"WebContextURL":"https://fqdn.domain.com/portal","privatePortalURL":"https://fqdn.domain.com/portal"}

Note: 
The FQDN here stands as the public facing DNS Alias.

The above change allows for Server's back-end communication to go to both the primary and standby portals.