I'm looking for some advice / experience in ArcGIS Server security with a Windows domain. Normally in this situation I would do some prototyping but I don't have access to a domain.
I'm planning to create ArcGIS map services that are restricted by roles stored in a domain. These map services will be used by a map page in a custom .NET application. Both the application and ArcGIS Server will run on the same domain and potentially in the same IIS site (e.g. Default Web Site).
The .NET application will immediately require Windows authentication, so I know that IE users will pass through seamlessly but other browsers will prompt for a login. It's not clear to me if non-IE users will also be prompted for a login when first accessing a restricted map service.
- Q1: In the above configuration (same domain, same IIS site) would non-IE users get prompted a second time to access a restricted map service (e.g.
http://domain_name/ArcGIS/.../service_name), or would the credentials they provided for
http://domain_name/application/be used for ArcGIS?
- Q2: Would this change if a different IIS site (but still the same domain) was used for ArcGIS Server and the .NET application?
the user's name, expiration time and other information (source)
- Q3 does this 'other information' include anything that restricts the token to the IP or user-agent of the requestor - anything that will stop my server creating it on behalf of my client?
EDIT from further research it seems that a token can be explicitly bound to a given IP (provided when creating it) or to a referrer. In this case Q3 is answered 'no'
Any thoughts on these three questions would be super welcome. Thanks