Unable to store credentials with a secured service item in Portal for ArcGIS

Description

When adding a secure ArcGIS Server web service as an item to Portal for ArcGIS, the option to store credentials with the item is not available. This prevents client applications from consuming a web map using the web service without an initial authentication process with the parent ArcGIS Server site. It also hampers the ease of use of these web maps and web services.

The following error message may be returned in the Portal for ArcGIS log files:

Error:   
Invalid SSL certificate found. PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.

Cause

The SSL certificates on the reverse proxy machine hosting the ArcGIS Server web adaptor are untrusted by Portal for ArcGIS.

Portal for ArcGIS uses the checkUrl.jsp utility to determine if it can make outbound requests to the service. If an error occurs during this execution, the option to store credentials is not presented.

Solution or Workaround

Import the full chain of certificates on the reverse proxy machine hosting the ArcGIS Server web adaptor into the Portal for ArcGIS trusted keystore.

1. Log on to the reverse proxy machine hosting the ArcGIS Server web adaptor, and export the full chain of certificates in the .cer file format. This is done by the organization's IT department.
2. Navigate to the Portal for ArcGIS admin endpoint, and log in with an administrator account.
3. Navigate to Security > SSLCertificates > Import Root or Intermediate.
4. Select the .cer files generated in Step 1. Portal for ArcGIS restarts after successfully importing the certificates.
5. Clear the browser cache.

The option to store credentials is presented when adding a secure ArcGIS Server web service as an item to Portal for ArcGIS.