The Python API included with ArcGIS Pro 3.0 is unable to connect to ArcGIS Enterprise using Windows authentication in some scenarios

Description

When using the Python API included with ArcGIS Pro 3.0 to connect to ArcGIS Enterprise configured with Windows authentication, specifying a username and password inside the GIS() method fails with the following error:

Exception: A general error occurred: unsupported hash type md4

This worked in the Python API included in earlier versions of ArcGIS Pro (for example, version 2.9).

Cause

When specifying a username and password inside the GIS() method and connecting to ArcGIS Enterprise configured with Windows authentication, the NTLM protocol is always used. This is an outdated protocol that relies on an insecure hashing method that has been deprecated in OpenSSL 3.0. Since the Python API included with ArcGIS Pro 3.0 was updated to use OpenSSL 3.0, the NTLM protocol for Windows authentication is no longer supported.

Solution or Workaround

When connecting to ArcGIS Enterprise configured with Windows authentication, do not specify the username and password inside the GIS() method. An example is outlined in our help document Web-tier authentication secured with IWA for connecting to ArcGIS Enterprise with IWA. When no credentials are specified, the authentication is handled at the Operating System level by Windows; OpenSSL is not used.

This means the user that is logged in and running ArcGIS Pro or the Python API will be the user that connects to ArcGIS Enterprise. To connect as an alternate user, either ArcGIS Pro or the Python API script must be run as the desired user. This can be accomplished several ways including: logging in as the desired user, using the "Run as different user" option to open ArcGIS Pro or Python, or scheduling a Windows task to execute the script as the desired user.