How can I leverage ArcGIS Online sign in credentials/dialog box in a python add-in for Desktop?

Question

When a user has signed in to their ArcGIS Online account in ArcGIS for Desktop (File > Sign In) they have access to their AGOL maps and services and have the ability to publish services and run GP tools that need access to AGOL resources. For example, if I am already signed in to AGOL and open the Share Package tool, the username and password parameters are greyed out because the tool recognizes that the user is already authenticated. My assumption is that the tool recognizes the authenticated session and uses the stored token in its request to upload a package. Is that at all accurate?

Is it possible to achieve this with python/arcpy? I would like my add-in to recognize if the application (ArcGIS Desktop) is already authenticated or not, and if so, use the valid token to make future calls to AGOL using the REST API, for example. If the user has not signed in, it would be nice to have access to the small Internet Explorer window that prompts the user for their AGOL credentials when they are using File > Sign In (see image). I believe this method uses OAuth 2.0.

Either way, if my add-in needs access to a user's AGOL account to complete its job, how can I use an existing authentication (if the user has already established one with File > Sign In) without having to build my own dialog to ask the user for their username or password? Going along with this point of not wanting to request a username and password from the user...the Sign In To Portal (Server) tool is a legacy tool at 10.2. The documentation prompts the user to use the File > Sign In method.

I have also posted this question on GeoNet with no responses as of yet.

Answer 1

You are correct, that box is using OAUTH2. You have no method to force the box to appear from Python. Generally speaking, the app (Map/Catalog, etc) will pop the login box if you aren't connected and you perform an action that requires you to be logged in. For example, if I am NOT signed in and launch the Share Package tool - it'll popup the signin box automatically. And, as you note, once you signin, the tool has the credentials and allows you to share a package to ArcGIS.com.

At 10.2.2 (maybe 10.2, but I can't confirm exactly), we added the UseSSOIdentityIfPortalOwned token. This is handy as you can leverage the existing connection the app has made when you aren't in a situation to make the connection yourself. See how its used here in the ImportToolbox code. While on this point, note that you cannot make a connection from Python to ArcGIS.com. There are no hooks or methods to do this. The nature of OAUTH doesn't lend itself to this. [[It is something we here at Esri are thinking about, so possibly better python+oauth support in the future]]

I should note, that as long as you're signed in, you should be able to simply use tools like Share Package in your code (again, as long as you're inside the application). They'll just leverage the sessions authentication. The user/pass are optional in this case. As a note, if you were using a portal that doesn't use OAUTH as the authentication method, the tool would accept a username and password)

>>> arcpy.SharePackage_management(r'c:\temp\Book1_csv.lpk', "", "","summary1", "tags")
<Result 'true'>

If you have access to 10.3 or Pro, we added a couple other Python methods. Again, if you're signed into ArcGIS.com (or any portal for that mater) we added GetSignInToken and a couple other functions to help handle tokens, portals and credentials. Again, none of these can be used to sign in (you need to already be signed in), but the functions will hopefully provide some bits you need.

Answer 2

I think your best bet is to create a script tool that just takes a username and password as a hidden or encrypted string, then in your Python Add-In call the GPToolDialog function to pass in the credentials.