Generate ArcGIS Token without Username/Password Each Time

Question

I have an ASP.NET C# web application that authenticates a user via their username and password. Once the user is authenticated, the app generates an ArcGIS token using Esri's Generate Token operation (http://resources.arcgis.com/en/help/rest/apiref/generatetoken.html). Once the ArcGIS token is received, the web application can access secured map services from the ArcGIS server.

The web application is authenticating against the same LDAP directory as the ArcGIS server.

My problem is that if I need to generate a new ArcGIS token from the web application, I cannot do so without forcing the user to login again because I don't have the password (and I don't want to store the password). If the ArcGIS token expires, then the web application loses access to the secured map service. If in the future, I implement an authentication system that doesn't require a username or password (Oauth via Facebook for example), then I would never be able to generate the ArcGIS token.

Note: I have to use ArcGIS Server - I cannot use Portal or ArcGIS Online.

Is there another way to generate the ArcGIS token? Is there a way for me to specify, upfront, what the token value will be? Has anyone experience this before and come up with a solution?

Answer 1

I would recommend using a proxy. My team currently runs a similar setup, with multiple credentials for separate SDE instances, for separate clients. We use a separate proxy file to store credentials, then run things through there to avoid duplicate authentication requests. Here are some helpful articles on this:

https://developers.arcgis.com/javascript/3/jshelp/ags_proxy.html

http://server.arcgis.com/en/server/latest/administer/linux/using-a-forward-proxy-server-with-arcgis-server.htm