ArcGIS Online Web Connection Troubleshooting

Liz Sanderson
Liz Sanderson
  • Updated

Are you encountering issues connecting to ArcGIS Online (AGOL) from FME? Please read below for some common troubleshooting tips and resources.
 

Content Overview

 

General Troubleshooting

For FME Flow:
  • Has the connection been uploaded from FME Workbench and is it up-to-date?
  • Have you checked the FME Flow fmeoauth.log for errors or warnings? 
    • This log can be found from the FME Flow Web UI, under Resources > Logs > service > current > fmeoauth.log 
  • Have you checked the FME Flow fmeconnection.log and fmeserver.log files for error and warning?
    • These logs can be found from the FME Flow Web UI, under Resources > Logs > service > current > fmeoauth.log 
 

Getting Started

If you are not yet familiar with FME web connections and web services, please review Web Connections and FME

If you are having issues with your ArcGIS Online web connection (including the underlying web service), then it will help to have a good understanding of ESRI's OAuth 2.0 flow. ESRI’s documentation on the OAuth 2.0 flow used by FME Form can be found here . The process is essentially the same for FME Flow’s Server-enabled workflow , but a different redirect URI is used.

It’s important to note that there are two tokens involved in the process: an authorization token and a refresh token. ArcGIS Online authorization tokens only last 30 minutes. Once the authorization token has expired, FME Flow attempts to use a refresh token (also provided by ArcGIS Online) to obtain a new authorization token. 

Network complexity introduced by locked-down environments, proxies (outgoing), reverse proxies (incoming), and cloud environments all have the potential to interrupt this process and prevent it from completing successfully at different steps. 

If the answers to common issues below do not help resolve your problem, you may need to work with your IT department to monitor network traffic and determine where in the OAuth 2.0 flow the process is failing. A good initial test is to simply try logging into ArcGIS Online from a web browser on the machine where FME Form or FME Flow is installed.

 

Common Issues - FME Workbench and FME Flow

Before reviewing these issues, we highly recommend walking through the process of How to Create an ArcGIS Online Web Connection from start of finish.

 

“I see the error ‘401 Client Error: Unauthorized for URL’ in my translation or job log”
This is typically due to an expired ArcGIS Online connection or an invalid ArcGIS Online web service. 

See ArcGIS Online Web Connection Error: 401 Client Error: Unauthorized for URL .

First, try to reauthorize the web connection in FME Workbench or FME Flow, depending on where you are having the issue. If that doesn’t correct the issue, confirm your web connection and web service have been set up correctly. See How to create ArcGIS Online Web Connection for FME Flow (OAuth 2.0)

 

"I receive the error ‘Invalid redirect_uri Error: 400’ when I try to authorize my ArcGIS Online web connection.”
For FME Workbench, check the Redirect URI parameter in the ArcGIS Online web service. It should be the default: 
urn:ietf:wg:oauth:2.0:oob

This Redirect URI is included by default when you create an ArcGIS Online App, but can be removed, so check there as well. It must exist and match in both places.

For FME Flow, confirm that the Authorization URL in the FME Flow web service matches the Redirect URL in the ArcGIS Online App settings. The URL is <YOUR_FME_FLOW_URL>/fmeoauth. 

Please see How to Create an ArcGIS Online Web Connection (OAuth 2.0) for complete instructions.

 

“My web connection no longer works. I receive the error ‘Access to this application has been blocked.’ in my translation or job log .”
This behavior is linked to ArcGIS Online web connections that make use of FME's out-of-the-box ArcGIS Online web service. Your ArcGIS Online environment may have been changed to no longer permit connections from external apps, like the one that is used by the ArcGIS Online web service that comes with FME. We recommend you create your own ArcGIS Online Web Connection and Service .

Please see: Known Issue: ArcGIS Online connection - unable to set up or previously working connection no longer functional

 

“My connection times out while writing features to ArcGIS Online”
Occasionally, writing too many features in the same transaction can cause the connection to timeout which stops the transaction. This could be because the request sent to ArcGIS Online is too large, which can happen as a result of complex geometries, many attributes or very large attribute values.

You may receive the following error:
ERROR |ArcGIS Online Feature Service Writer: Could not connect to server. Check that you are connected to the internet and that no firewall is blocking outbound connections. The error was 'HTTPSConnectionPool(host='<URL>', port=443): Max retries exceeded with url

In combination with:
(Caused by ProtocolError('Connection aborted.', ConnectionAbortedError(10053, 'An established connection was aborted by the software in your host machine', None, 10053, None)))'

OR
(Caused by ProtocolError('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None)))'

To improve connection stability, reduce the Features Per Request parameter to a smaller number. You can find this within the Advanced settings in the Esri ArcGIS Online Reader and Writer. 

Even with a very small Features per Request size, some customers still experience issues after a certain number of requests. FME Workbench 2023 has introduced an Asynchronous Writes option to the advanced parameters of the ArcGIS Online Feature Server Writer. Setting this option to Yes may help resolve this issue in FME Workbench and FME Flow.
 
Documentation on the ArcGIS Online Feature Server Writer parameters can be found here.

 

Common Issues - FME Flow Only

For more general FME Flow web connection troubleshooting please read FME Flow Troubleshooting: Web Connections..
 
“My web connection doesn’t stay authorized in FME Flow. I can authorize it, but it stops working shortly thereafter and I receive a ‘498 invalid token’ error.”

ArcGIS Online authorization tokens last 30 minutes. If the connection does not stay authorized, it is likely because the authorization token cannot be refreshed. There are two main reasons:
  1. The ArcGIS Online web connection and web service have not been set up correctly. See How to create ArcGIS Online Web Connection for FME Flow (OAuth 2.0). Make sure that the URLs in the FME web service have not been modified. While using organization-specific ArcGIS Online URLs, like www.myorganization.maps.arcgis.com in the web service URLs may allow you to authorize the connection initially, they can cause problems with the token refresh process. Do not modify the www.arcgis.com token URLs when creating a new web service.
  2. The ArcGIS Online web connection is being used on multiple FME instances. For example, on two different FME Flow instances or on FME Form and FME Flow. This is a known issue in ArcGIS Online. While many customers are able to do this without issue, ArcGIS Online may send a new refresh token to one of the FME instances, which invalidates the refresh token on the other. In this scenario, whichever FME instance received the new refresh token will typically continue to work, however, the connection will begin to fail on any other FME instances using the connection. If you encounter this scenario, please create a separate ArcGIS Online OAuth app and web connection for each FME instance. If you have multiple FME Flow instances each needing a separate ArcGIS Online connection, using a deployment parameter for the connection in your workspace may help. Please read Getting Started with Deployment Parameters to learn more. 

 

“I receive an ‘OAuth Service FAILED’ error trying to authorize my ArcGIS Online web connection.”
If the Authorization URL in the FME Flow web service matches the Redirect URL in the ArcGIS Online application settings, then:
  • Make sure the URL itself is correct. The URL is in the format <YOUR_FME_FLOW_URL>/fmeoauth. 
  • Try going to the URL in a web browser - in this case, you should receive the ‘OAuth Service FAILED’ error. If you receive a 404 error or other error, the url is incorrect. 
  • Make sure you are including the fully qualified domain name. For example, https://myfmeflow.myorg.com/fmeoauth instead of https://myfmeflow/fmeoauth. 
  • If you still receive an error, try your FME Flow server’s IP address instead of the domain name.
Another cause of this error is an incorrectly configured proxy. Confirm you have set up your proxy correctly in FME Flow. Please see the FME Flow Proxy documentation

If you are confident you have configured the proxy correctly and are still receiving the error, there may be DNS issues. Try using the proxy server’s IP address as the host name in the FME Flow proxy settings. The fmeoauth.log file error below is another symptom of this. 
929026:Error: http://exampleproxy.net
COM.safe.fmeserver.api.FMEServerException: 929026:Error: http://exampleproxy.net

 

“I receive a time out trying to authorize or use my ArcGIS Online web connection in a job.”
 
It’s possible that the OAuth 2.0 process is being prevented from completing successfully due to your organization’s network or firewall configuration. 

If your organization is using a proxy, make sure that the proxy has been correctly configured in the FME Flow UI. Please see the FME Flow Proxy documentation .

The FME Flow Core must be able to communicate with ArcGIS Online and the URLs involved with the OAuth 2.0 process. The Core provides the token to any FME Flow Engines needing it for a web connection. Log in to the FME Flow Core host machine and open a web browser. Confirm that:
  • You can successfully log into ArcGIS Online 
  • You are using the fully-qualified domain name (FQDN) for the redirect URI in both the ArcGIS Online app and FME Flow web service. Especially if your organization has restrictive network rules. For example, https://myfmeflow.myorg.com instead of https://myfmeflow. 
  • You can manually reach the ArcGIS Online OAuth URLs below
Authorization Code URL: 
https://arcgis.com/sharing/rest/oauth2/authorize?response_type=code&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=<Your_Client_ID>

That should return an ArcGIS Online authorization code to use in the Token URL below:
https://www.arcgis.com/sharing/rest/oauth2/token?redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=<Your_Client_ID>&client_secret=<Your_Client_Secret>&grant_type=authorization_code&code=<Authorization_Code>

If you cannot reach ArcGIS Online URLs above outside of FME using the web browser, then please discuss with your IT department. They may need to make changes to allow your FME Flow Core host machine to communicate with ArcGIS Online.

 

“When I try to update my ArcGIS Online web service on FME Flow using the web UI, I receive an error about invalid input parameters.”  
This issue affects FME Flow (formerly FME Server) versions 2021.2 through 2022.2. It has been resolved in build 2022.2 22785 and later.

ArcGIS Online Web Connections created from the ArcGIS Online Web Service template do not work on FME Flow. The workaround is to remove the template ArcGIS Online web service from FME Flow. Please see: Known Issue: Web Services on FME Server are Invalid
 

Additional Resources

Are you still experiencing issues? 
Please consider posting to the FME Community Q&A if you are still experiencing issues that are not addressed in this article. There are also different support channels available: How to Create a Great FME Server Support Case  

Have ideas on how to improve this? 
You can add ideas or product suggestions to our Ideas Exchange .

Was this article helpful?

Comments

0 comments

Please sign in to leave a comment.