So, let's say I have this application built via WebAppBuilder, the user is already logged in via a ArcgisOnline organization, but I have a separate python server that does some custom geoprocessing and need to be authorized.

Questions :

1) How do I retrieved an already logged in user information? I won't have access to his password but probably can get a token or something (Javascript API 3.X Preferably).

2) How do I authorize the information retrieved above in a python script?

Pseudo example (Python server code):

def authenticate(request):
  token = request.token #Or whatever other information is necessary
  valid = arcpy.isAuthenticated(token) #Just a pseudo example
  if valid:
    return Response.ok()
  return Response.fail()

closed as too broad by PolyGeo May 7 at 10:24

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Your question is based on the premise that the token generated in the Javascript application will be usable in Python. I think you need to manually verify that you can hijack and reuse a token in that way. Further, you wont use the token to "authorize" inside the Python script. The token (if it works) is already 'authorized'. You'd append it to a request that is made, most likely through HTTP libraries like Requests or URLLIB – KHibma Mar 4 at 13:45
  • @KHibma I won't actually be making any requests to ArcGIS Rest API in Python, I only want to know if the user from Javascript has a valid token – Mojimi Mar 4 at 14:15
  • If that's the case, why are you going to the trouble of calling into an independent service (like a geoprocessing service running python)? Why don't you just try to check the expires of a token in JS and if necessary refreshToken(): developers.arcgis.com/javascript/3/jsapi/credential-amd.html – KHibma Mar 4 at 14:36
  • @KHibma because the point is not to validate the token, but add authentication to the python service so that it's not public. I'm trying to do it in a way that won't require an extra login – Mojimi Mar 4 at 15:48