Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm doing my best to secure my AGS (9.3.1) services, but have struggled with tokens. As you can see, my nw account belongs to the agsadmin and agsusers roles:

enter image description here

I have assigned these same roles to my service and its containing folder:

enter image description here

Generating a token is no problem:

enter image description here

But alas, upon logging in to the REST interface, I am presented with this Unauthorized access message:

enter image description here

I found a post on the ESRI forums describing the same problem, but responses are inconclusive. ("Please make sure that the Security settings for this map service is correct.", blah blah.)

Has anyone encountered this? What could I be doing wrong?

Update: we have abandoned AGS-based security because of its many flaws and capricious inconsistencies. Beware!

share|improve this question
I know it doesn't help you now, but security in AGS 10.1 is vastly improved (up to and including allowing/disallowing feature creation/deletion). – Michael Todd Jul 12 '11 at 21:28
up vote 6 down vote accepted

If you use Fiddler when you are firing a token authentication you can see the response (403 Forbidden etc).

I used this when first setup FME Server with security - this uses the same Token method and is not unique to ArcGIS REST but REST with security. It is likely to be either software security issues or the webserver refusing the users request.

This Token Security (via proxy) on an ArcGIS Server (Javascript) might be useful for your application

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.