4

Goal: Develop a web application using ArcGIS Javascript API that has a single login experience for the end user and that enables them to edit feature layers hosted on ArcGIS Online.

Setup: We are using a closed Wordpress instance (registration is off, credentials provided to a small user group) to handle user login/logout. Some layers consumed by the application are hosted on ArcGIS Online, others are hosted on our own instance of ArcGIS Server.

Background: According to this documentation, there are two authentication options for protected layers: (1) user login, and (2) application authentication. We must use the first option because of the limitations associated with application authentication, specifically the inability to edit features.

In order to maintain our single login experience, we are trying to figure out the best way to bypass the ArcGIS Online signin dialog that is associated with user login.

Based on some research, one way to go about doing this is to (a) generate a token using a "generic AGOL user" that has access to the necessary data layers and then (b) use that token with every request of a secured layer.

We can use a post request to successfully generate this token using hard-coded credentials in a PHP file on the server. But, as this post suggests, it is unsafe to pass the token to the client, so it is best to use a proxy to do everything.

Question: We want to use the proxy service that generates a token from hard-coded AGOL credentials and then appends that token to every request to a secure layer made by our Javascript app. Are there any examples of this available for us to reference?

Improve this question

1 Answer 1

Reset to default
1

Application authentication does allow for editing of a hosted feature service.

Create/update/delete user's content
This limitation is a little misleading. 'User content' is more the items owned by the named user. e.g. editing an item to change the title or description as opposed to editing data in a feature service.

A proxy will still be required (to host your application secret in) and this needs to sit on a web server like IIS or Apache (tip: can spin up an small EC2 instance in the free tier to host this).

I cant't share, but I have set this up for a public geoform (hosted on S3), which accesses a secure hosted feature service in AGO (i.e. creates new records in this feature service.

A caveat to using Application Authentication, all edits under the default editor tracking will appear as the named user you register the custom application as.

You also need to ensure that the named user who owns the feature service is the same one that you register the custom application as. This then lets the application have control over all content owned by that same named user.

Improve this answer
4
  • Thanks, this has gotten me most of the way there. I successfully used a proxy to load the protected layer using client id/secret -- it seems to be editable because I can delete existing features. However, the out-of-the-box edit widgets (editor, attribute inspector) throw errors... and when I try to update or add a feature using a manual applyEdits call, I get a 400 "Invalid operation parameters" error telling me "Invalid object passed in, ':' or '}' expected." If I take that exact same JSON string and use it with the applyMethods rest endpoint while I'm signed into AGOL, it works.
    – Duncan Rager
    Apr 13, 2016 at 12:41
  • As a quick follow up, if I change the sharing of the feature layer to "public" and do not use the proxy, I can obviously add features normally using the widgets and manual applyEdits(). However, if I keep the sharing "public" and turn the proxy back on, the errors come back. So there's obviously a proxy configuration issue. Here's what I'm using (it's the basic setup shown in plenty of examples from ESRI): jsfiddle.net/duncanrager/9wersy1j
    – Duncan Rager
    Apr 13, 2016 at 14:27
  • Here is my proxy on my dev box: pastebin.com/UF2vi1TN This is likely not best practise, but try adding in those extra rules to begin with. Note the additional rules for HTTPS and also to the Item ID of the service. If it works, then strengthen/remove some of the rules and restrict the allowedReferers.
    – jakc
    Apr 14, 2016 at 0:01
  • Thanks for that. Unfortunately, still not there. Getting the invalid parameters error with standard proxy setup, even on a public layer. JSON string from the POST request works when copied and pasted in the applyEdits() rest endpoint. Very strange.
    – Duncan Rager
    Apr 19, 2016 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.