Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ArcGIS 10.1 Server instance exposing secured mapservices on the Internet. My need is to code down a client application (which I am currently building using the 3.3 version of the ArcGIS Javascript API) enabling the user to view those secured webservices:

I think this online ESRI example is a good start.

My will is not to have the user prompted for EACH mapservice authentication because I already know that ALL of the mapservices belong to her/him and therefore are accessible by her/him under the same username&password. In my idea, the prompt for credentials should appear just ONCE and therefore the JS code should feed credentials to each of the mapservice via some sort of RESTful login call. To me it doesn't seem like the ArcGIS Server REST API is providing such a call...maybe I am wrong.

Is therefore this "RESTful" way to login to secured mapservices feasible with ArcGIS Server (making it possible to access secured services programmatically)? If so, can any of you provide examples or links to web resources explaining this?

Thanks in advance

share|improve this question
Please let us know ArcGIS GIS Server version (10.0 OR 10.1) ?? – Sunil Jan 29 '13 at 12:15
Sunil, I forgot to write it, it's 10.1! – csparpa Jan 29 '13 at 13:03
are you using arcgis security store and not windows auth? – Brad Nesom Jan 29 '13 at 17:41
@Brad Nesom for the moment my ArcGIS Server instance is using a built-in security store (with users and roles), but I'm planning to link the instance to an external LDAP server for authentication purposes – csparpa Jan 30 '13 at 9:01
up vote 9 down vote accepted

I finally found what I was looking for: a proper ArcGIS Server web endpoint that I could use to generate tokens!

The call is this:

GET http://<arcgisserver_host:port>/arcgis/tokens?request=getToken&username=<usr>&password=<usr>&expiration=<token_lifespan>

which gives back the token into the HTTP response body, and one can send it along to any further request to secured resources without being prompted for credentials again. The token must be the value for the Cookie request header, as it is currently stored into a cookie on the client side.

But...damn! This token generator is NOT part of the ArcGIS Server REST API!!! I couldn't find it in the online API documentation! Where in the world could I found it???

This means that ArcGIS Server does not have a RESTful authentication framework.

In example, if we have this mapservice exposed under the ArcGIS REST API: /arcgis/rest/services/myDir/myMapService/MapServer/layers and we try to GET this resource, what we get from ArcGIS Server is a response having a 200: OK status code and an HTML document in the body (the HTML is a login form). From a would-be-RESTful login, I would expect that the request gave me back a 401: Authentication Required status code along with a WWW-Authenticate header... I tested this whole thing out myself using a REST client program.

share|improve this answer
Sadly most "RESTful" implementations are not RESTful :) Some years ago I gave up on being super-strict about this because the truth is that most implementations are "REST-like". For your particular use case, I usually take a different approach. I use the built-in authentication system of choice and proxy open ArcGIS requests. So if I was handling authentication with Django autentication, or ruby's, or .net's or whatever, I use that system. Then, when that system says it is OK, you can proxy the requests to an internal ArcGIS server/port that is locked fom the outside world. – Ragi Yaser Burhum Jan 31 '13 at 16:58
Hi @Ragi Yaser Burhum, you are right: we will never live in a fully RESTful world ;-) I also considered an approach like yours: I like the idea of having a proxy (which could also handle requests to webservices other than ArcGIS Server's, as well) but I'm in the need of keeping the complexity of the whole architecture as low as possible. So, after discovering that there IS a straight way to programmatically authenticate users to mapservices, I'll walk it! Thanks anyway! – csparpa Jan 31 '13 at 17:22
Maybe this is too old question, but hopefully you can see Esri REST API now have the GenerateToken method:… – goldenlimit Feb 16 '15 at 21:48

Please have a look at How ArcGIS Server Security works.

Basically, you will need to make users and groups, and give a particular User rights over certain services.

Once you have done that, then you need to use Token based security in your JavaScript Application. What this means is that, you ask the User for their UserName & password. That is sent to the ArcGIS Server, which validates the Credentials, and sends back a token. This token is used to validate the user whenever a resource is requested.

You as a programmer will send this token to every mapservice, query service etc.

This page details how to use Token Based Services.

The ArcGIS Javascript API already comes with a Class, the IdentityManager to do this.

Here are a couple of samples on how to use the Identity Manager.

share|improve this answer

In the ArcGIS API for JavaScript, there's a widget called the Identity Manager that addresses exactly what you want to do. Check out samples that use the identity manager to see how it works.

The sample linked by Devdatta, while valid, is the pre-Identity Manager way of doing this and involves a lot more code that is necessary now that authentication for secure services is baked into the API.

share|improve this answer
I had just taken the sample link for ESRI's documentation. Can the documentation be updated to point to the new samples? – Devdatta Tengshe Jan 30 '13 at 3:22
Folks, thanks for your hints but I think you didn't get my point. The scenario is: my user is going to access N secured mapservices, which means he's going to be bothered N times with a login prompt. Because ALL user's mapservices can be accessed using the same credentials, I would like my app to ask JUST ONCE for them and then use them to automatically authenticate each mapservice. At this stage, I guess that I should use a proxy page to handle multiple mapservice auth with ArcGIS Server. Sounds good? Any more straightful alternative? Thanks in advance, hope I made my needs clear.. – csparpa Jan 31 '13 at 14:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.