Accessing WMS with Basic Authentication?

Question

I am trying to access a Basic-Auth secured WMS Service. When requesting the Capabilities document, the service will always list some layers, even without authentication. But with authentications, more layers should be listed.

Unfortunately it won't work, only publicly available layers are listed in ArcGIS Pro. When I look at the HTTP request I can not see an Authorization header.

What kind of authentication is used in ArcGIS Pro (or ESRI products in general) when adding username/password in the "Add WMS Server Connection" Dialog? How is this intended to work?

I am completely in control of said service, it is possible to debug and configure any way we like. At the moment it supports HTTP Basic only but other methods could be implemented. I tested this service with a Browser and QGIS, where everything works as expected.

Answer 1

Unlike QGIS for example, ArcGIS Pro won't just happily send user credentials in the initial Request. It tries without Authorization header first, expects a 401 Unauthorized Status and a WWW-Authenticate Basic Header in return. Then, and only then, the Authorization header with user credentials will be set. This is per the Spec, but happens to be a bit inconvenient.

In our case, we always want to answer with a Capabilities document, because we need authentication only for some layers. An unauthorized user will therefore just get a much shorter list of layers. An additional mechanism for distinguishing users is needed, I opted for an additional HTTP GET parameter in the URL.