User prompted for credentials twice when adding a service from a stand-alone ArcGIS Server to a Portal web map using IWA

Description

When adding a service from a stand-alone ArcGIS Server to a new Portal web map using Integrated Windows Authentication (IWA), users are prompted to provide Portal authentication although they are logged in to the Portal.

Cause

This issue occurs if the Windows Authentication setting for the ArcGIS Server Web Adaptor has "Extended Protection" set to "Accept" within IIS. The response type for Windows Authentication is HTTP 401 Challenge, which, if using developer tools for Portal to troubleshoot, indicates the portal is making a call to the service through its internal proxy, and returns a 401 unauthorized error.

Using Fiddler to analyze the 401 response, the following Authorization messages in the web traffic are returned:

• No Proxy-Authenticate Header is present.
• WWW-Authenticate Header is present: NTLM
• WWW-Authenticate Header is present: Negotiate

The following are default Authorization messages in the web traffic when users add services from a stand-alone ArcGIS Server using IWA and are not prompted for Portal credentials:

• No Proxy-Authenticate Header is present.
• No WWW-Authenticate Header is present.

Solution or Workaround

Launch Internet Information Services (IIS) Manager on the affected machine, and complete the following steps:

1. In the Connections pane, expand the server name, expand Sites, and select the affected site, application or Web service.
2. Scroll to the Security section, and double-click Authentication.
3. In the Authentication pane, select Windows Authentication.
4. In the Actions pane, select Advanced Settings.
5. From the Extended Protection drop-down list, select Off and click OK.