2

I am using ArcGIS 10.2 for Server.

I've been asked if it is possible to restrict access to certain map services so that only a few whitelisted IP addresses are allowed to connect. What is the easiest and most straightforward way of accomplishing this?

I was thinking about putting an .htaccess file in the service directory and allowing and blocking IPs with that, but I'm not sure what the actual service directory is located. (So as example I want to block http://devmymapservices.mydomain.local/dev/rest/my_map_service/MapServer?f=jsapi so that is only accessible by my IP address) how would I do that?

  • 2
    At IIS domain level forums.iis.net/t/… – Mapperz Jul 24 '14 at 20:33
  • I see. How do I access the IIS server that is serving the map services? – Samuel Henderson Jul 24 '14 at 21:01
  • 1
    That is up to your IT people. – Mapperz Jul 24 '14 at 21:09
  • But will this allow me to restrict access of an individual map service and leave the rest open? – Samuel Henderson Jul 25 '14 at 13:15
2

It depends on what you are using to consume the service and how you want to use the services. If you are using ArcGiS Online (AGOL) or Portal then no, this is not possible because the request to the server hosting the service is coming from the server hosting the web-application (Portal or AGOL). You can add a secure service to AGOL or Portal and store the username and password and use the limit usage tool. But the domain and IP restrictions that you can put in place are relative to the server hosting the web application not a users machine. ESRI wants named users/groups to be used to implement service level restrictions. And if the user is viewing the map in AGOL or Portal then they are logged in and therefore they fall under the username/group security umbrella in which case you can restrict access.

If you are trying to restrict access on the service level to a specific users then you could use a reverse proxy. If you are using Web adaptor you can place the reverse proxy in front of the WA. But this has limited value because in most cases (99.999%) a service is not very useful until it is added to some mapping application and once that occurs it is the apllications domain/IP making the requests for a service not a user.

Basically we are stuck with named users or restricting access to services based on the mapping-application.

1

You want to look into ArcGIS Portal. It is a server extension. They describe it as

Portal for ArcGIS gives your organization a platform for managing all of its geospatial content. It enables secure and private sharing within the organization and leverages mobile, server, and desktop clients. It is ideal if you have high confidential and proprietary data, conduct confidential research, or have regulated data restrictions

It might not be the cheapest option, but it is one that ESRI has set up already. Take a look at their site HERE

1

You would need to set up a seperate folder for each service. And use the iis settings to allow a list of ips for each folder you have. So I assume the restricted IPs are outside of your network. This is a feature of latitude geocortex.
Which allows federated security. Setup an allowed domain or any number of single email accounts. This would still require login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.