- URL:
- https://<root>/security/config/update
- Methods:
POST- Required Capability:
- Access allowed with either the "Security and Infrastructure" or "Servers" privileges
- Version Introduced:
- 10.1
Description
The update operation updates the security configuration, including TLS protocols and cipher suites, for your ArcGIS Server site.
This operation causes the SOAP and REST service endpoints to be redeployed (with the new configuration) on every server machine in the site. If the authentication tier is GIS, the ArcGIS token service is started on all server machines.
When the authentication occurs at the Web Adaptor, the server does not participate in authenticating the user.
If you updated the communication protocol as part of this operation, it takes the ArcGIS Web Adaptor 1 minute to recognize changes to the communication protocol of your site. If you want the ArcGIS Web Adaptor to immediately recognize the changes, you can reconfigure it by following the instructions in Configure ArcGIS Web Adaptor after installation.
Request parameters
| Parameter | Details |
|---|---|
| Specifies the HTTP protocol to be used for communication to and from the ArcGIS Server site. If set to When an ArcGIS Server site is created, all communication to and from the site is sent over HTTP, which is not secure. This means that your credentials sent over an internal network or the Internet are not encrypted and can be intercepted. To prevent the interception of communication, it's recommended that you configure ArcGIS Server and ArcGIS Server Manager (if installed) to enforce Secure Sockets Layer (SSL). When you create a site, a warning-level message in the logs recommends that you update the communication protocol of the site to use SSL. Values: |
| The TLS protocols ArcGIS Server will use. Example |
| The cipher suites ArcGIS Server will use. The Valid cipher suites section below outlines the ciphers enabled by default, as well as valid ciphers that can be enabled. Example |
| A Boolean that indicates whether HTTP Strict Transport Security (HSTS) is being used by the site. To enable this property, the Values: |
| A Boolean that indicates whether the server's virtual directories are secure and require authentication. When this property is set to Values: |
| Introduced at 10.9.1. A Boolean that controls the value of the Access-Control-Allow-Private-Network response header in a CORS preflight request to a REST service URL. This property supports the Private Network Access web specification (previously CORS-RFC1918), which aims to restrict websites accessed over a private network from making internal cross-origin requests. Values: |
| Specifies the tier at which requests to access GIS services will be authenticated. It is recommended that you do not modify these values using the Administrator Directory. Instead, use ArcGIS Server Manager to configure web tier authentication or use the Enterprise portal to federate an ArcGIS Server with your organization. Values: |
| A Boolean that indicates whether a user with administrator privileges can access the server through port 6080. If Before disabling administrative access on port 6080, ArcGIS Server must be configured to use web tier authentication ( To fully disable access on port 6080, you can optionally disable the primary site administrator account. If ArcGIS Server Manager becomes unavailable or the web server cannot authenticate users who have administrator privileges, you cannot administer the site. To recover this site, re-enable the primary site administrator account and connect to the site through port 6080 with this account. Values: |
| The properties used when federating ArcGIS Server with Portal for ArcGIS. See Portal properties for more information. |
| A comma separated list of client machine IP addresses that are allowed access to ArcGIS Server. This can be used as an additional security measure to prevent unauthorized access to the site. |
| The response format. The default response format is Values: |
Portal properties
| Property | Details |
|---|---|
| The portal mode. This must be Example |
| The key obtained after federating ArcGIS Server with Portal for ArcGIS. Example |
| The URL of Portal for ArcGIS in the following format: Example |
| The internal URL of Portal for ArcGIS is in the following format: Example |
| The ID of the server federated with the portal. Example |
| The external URL of the server federated with the portal in the following format: Example |
Valid cipher suites
The following cipher suites are enabled by default:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_AES_256_GCM_SHA384,
TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_128_GCM_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_AES_256_GCM_SHA384,
TLS_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAThe following cipher suites are not enabled by default, but are valid and can be added using this operation:
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
TLS_CHACHA20_POLY1305_SHA256,
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_3DES_EDE_CBC_SHAExample usage
The following is a sample POST request for the update operation:
POST /webadaptor/admin/security/config/update HTTP/1.1
Host: machine.domain.com
Content-Type: application/x-www-form-urlencoded
Content-Length: []
Protocol=HTTPS&httpsProtocols=TLSv1.2,TLSv1.3&cipherSuites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256&HSTSEnabled=false&virtualDirsSecurityEnabled=false&allowInternetCORSAccess=true&authenticationTier=GIS_SERVER&allowDirectAccess=true&allowedAdminAccessIPs=&f=pjsonJSON Response example
{"status": "success"}