1

I am trying to access a Basic-Auth secured WMS Service. When requesting the Capabilities document, the service will always list some layers, even without authentication. But with authentications, more layers should be listed.

Unfortunately it won't work, only publicly available layers are listed in ArcGIS Pro. When I look at the HTTP request I can not see an Authorization header.

What kind of authentication is used in ArcGIS Pro (or ESRI products in general) when adding username/password in the "Add WMS Server Connection" Dialog? How is this intended to work?

I am completely in control of said service, it is possible to debug and configure any way we like. At the moment it supports HTTP Basic only but other methods could be implemented. I tested this service with a Browser and QGIS, where everything works as expected.

  • Can you test using an authkey in the WMS URL? – Ali Jul 4 at 14:46
  • While that probably would work, it is not secure at all. I hope we don't have to resort to that, since all GIS clients should support Basic Auth, no? – Bruno Schäpper Jul 5 at 7:09
  • Just another test to cover all bases. Check out PolyGeo's answer to a similar question. – Ali Jul 5 at 8:37
  • Thanks for the link. We tried contacting ESRI before, but this lead to no satisfying answer. What I'm trying to find out is this: How is it actually supposed to work with ArcGIS? I don't get any errors, nor can I see any HTTP Headers. – Bruno Schäpper Jul 5 at 10:31
1

Unlike QGIS for example, ArcGIS Pro won't just happily send user credentials in the initial Request. It tries without Authorization header first, expects a 401 Unauthorized Status and a WWW-Authenticate Basic Header in return. Then, and only then, the Authorization header with user credentials will be set. This is per the Spec, but happens to be a bit inconvenient.

In our case, we always want to answer with a Capabilities document, because we need authentication only for some layers. An unauthorized user will therefore just get a much shorter list of layers. An additional mechanism for distinguishing users is needed, I opted for an additional HTTP GET parameter in the URL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.