Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

I'm doing my best to secure my AGS (9.3.1) services, but have struggled with tokens. As you can see, my nw account belongs to the agsadmin and agsusers roles:

enter image description here

I have assigned these same roles to my service and its containing folder:

enter image description here

Generating a token is no problem:

enter image description here

But alas, upon logging in to the REST interface, I am presented with this Unauthorized access message:

enter image description here

I found a post on the ESRI forums describing the same problem, but responses are inconclusive. ("Please make sure that the Security settings for this map service is correct.", blah blah.)

Has anyone encountered this? What could I be doing wrong?

Update: we have abandoned AGS-based security because of its many flaws and capricious inconsistencies. Beware!

share|improve this question
    
I know it doesn't help you now, but security in AGS 10.1 is vastly improved (up to and including allowing/disallowing feature creation/deletion). –  Michael Todd Jul 12 '11 at 21:28
add comment

1 Answer

up vote 4 down vote accepted

If you use Fiddler when you are firing a token authentication you can see the response (403 Forbidden etc).

I used this when first setup FME Server with security - this uses the same Token method and is not unique to ArcGIS REST but REST with security. It is likely to be either software security issues or the webserver refusing the users request.

This Token Security (via proxy) on an ArcGIS Server (Javascript) might be useful for your application http://forums.arcgis.com/threads/33714-Token-Security-on-an-ArcGIS-Server-%28Javascript%29

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.