I originally posted this in the geonet, but unfortunately got crickets.

I'd like to fetch an ArcGIS Server token with a python web service and an encrypted password. I have it working nicely with plain text, but I'd rather avoid this method since using passwords in plaintext is always a bad idea, even on a server side script. Essentially, my python script will instead store the encrypted information, which will be used to access secure resources. This way, if worse case scenario, the server is compromised, the plain text passwords won't be available.

The reason I'm storing the user's password is so that I can periodically refresh the token without requiring the user to login again when the token times out.

The arcgis server generate token page has a certain functionality that encrypts the password using javascript before its sent to the server. It uses the arcgis server public key/modulus to create an encrypted string. Then it passes encrypted=true and the encrypted data.

I would like to replicate this function in my python web service. However, I cannot find any documentation on this encryption technique anywhere. I have done a little researching and had figured out how to do the encrypting here: https://stackoverflow.com/questions/40094108/i-have-a-rsa-public-key-exponent-and-modulus-how-can-i-encrypt-a-string-using-p

But this method hasn't yielded any fruit yet, as arcgis server doesn't seem to accept the encrypted data. Has anyone dealt with this situation before or know of any resources available to figuring it out?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.