I'm building a custom web mapping application for a client. The application will be hosted externally to ArcGIS Online, but the application is registered with AGOL. The application will access the client's secured AGOL web map services.

I'd like for the user to be able to log in to AGOL, open the application, and not have to log in again. However, each request for a secured resource from AGOL results in a login challenge.

I've set up the web proxy to avoid this problem, but it seems that the web proxy allows anyone access to the secured AGOL web map services.

So, it seems that my options are:

  1. Allow all users access to the client's secured AGOL web map services (hint: not an option).
  2. Require users to provide their login information each time a request is made to a secured AGOL service (hint: again, not an option).

Is it possible to do this?

  • Are you using the JSAPI IdentityManager?
    – GavinR
    Sep 14, 2015 at 2:50
  • 1
    @GavinR Yes, as indicated in the API reference, I've add the following to the require statement: ` "esri/IdentityManager",` In fact, what I'm deploying is just a customization of the GeoForm template, which has this included. Sep 14, 2015 at 14:42

1 Answer 1


Assuming that you have a list of users that will be accessing this resource, then if they have an AGOL login, or are using an org with enterprise login support you could share the secured services with just the organization or you could share the services to just a group that all these users are a part of. This will restrict the access so the public cannot access these services.

If you are using an ArcGIS Server service that is secured you could add this as an item to AGOL, embed credentials into the item and then share the item to a group or organization. This also protects the server URL from anyone hitting the web map b/c it will appear just as a utility.arcgis.com URL in the web map JSON.

  • Yes, each user will have an AGOL account as a part of the organizational account. The secured services are hosted in AGOL and shared only within the organization. As per the original post, the problem is that there doesn't seem to be a way, within a custom application, to restrict access to just the organization's users. Sep 14, 2015 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.