2

I am using ArcGIS 10.2 for Server.

I've been asked if it is possible to restrict access to certain map services so that only a few whitelisted IP addresses are allowed to connect. What is the easiest and most straightforward way of accomplishing this?

I was thinking about putting an .htaccess file in the service directory and allowing and blocking IPs with that, but I'm not sure what the actual service directory is located. (So as example I want to block http://devmymapservices.mydomain.local/dev/rest/my_map_service/MapServer?f=jsapi so that is only accessible by my IP address) how would I do that?

Improve this question
4
  • 2
    At IIS domain level forums.iis.net/t/…
    – Mapperz ♦
    Commented Jul 24, 2014 at 20:33
  • I see. How do I access the IIS server that is serving the map services?
    – Samuel Henderson
    Commented Jul 24, 2014 at 21:01
  • 1
    That is up to your IT people.
    – Mapperz ♦
    Commented Jul 24, 2014 at 21:09
  • But will this allow me to restrict access of an individual map service and leave the rest open?
    – Samuel Henderson
    Commented Jul 25, 2014 at 13:15

3 Answers 3

Reset to default
2

It depends on what you are using to consume the service and how you want to use the services. If you are using ArcGiS Online (AGOL) or Portal then no, this is not possible because the request to the server hosting the service is coming from the server hosting the web-application (Portal or AGOL). You can add a secure service to AGOL or Portal and store the username and password and use the limit usage tool. But the domain and IP restrictions that you can put in place are relative to the server hosting the web application not a users machine. ESRI wants named users/groups to be used to implement service level restrictions. And if the user is viewing the map in AGOL or Portal then they are logged in and therefore they fall under the username/group security umbrella in which case you can restrict access.

If you are trying to restrict access on the service level to a specific users then you could use a reverse proxy. If you are using Web adaptor you can place the reverse proxy in front of the WA. But this has limited value because in most cases (99.999%) a service is not very useful until it is added to some mapping application and once that occurs it is the apllications domain/IP making the requests for a service not a user.

Basically we are stuck with named users or restricting access to services based on the mapping-application.

Improve this answer
1

You want to look into ArcGIS Portal. It is a server extension. They describe it as

Portal for ArcGIS gives your organization a platform for managing all of its geospatial content. It enables secure and private sharing within the organization and leverages mobile, server, and desktop clients. It is ideal if you have high confidential and proprietary data, conduct confidential research, or have regulated data restrictions

It might not be the cheapest option, but it is one that ESRI has set up already. Take a look at their site HERE

Improve this answer
1

You would need to set up a seperate folder for each service. And use the iis settings to allow a list of ips for each folder you have. So I assume the restricted IPs are outside of your network. This is a feature of latitude geocortex.
Which allows federated security. Setup an allowed domain or any number of single email accounts. This would still require login.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.