2

I'm looking for some advice / experience in ArcGIS Server security with a Windows domain. Normally in this situation I would do some prototyping but I don't have access to a domain.

I'm planning to create ArcGIS map services that are restricted by roles stored in a domain. These map services will be used by a map page in a custom .NET application. Both the application and ArcGIS Server will run on the same domain and potentially in the same IIS site (e.g. Default Web Site).

The .NET application will immediately require Windows authentication, so I know that IE users will pass through seamlessly but other browsers will prompt for a login. It's not clear to me if non-IE users will also be prompted for a login when first accessing a restricted map service.

  • Q1: In the above configuration (same domain, same IIS site) would non-IE users get prompted a second time to access a restricted map service (e.g. http://domain_name/ArcGIS/.../service_name), or would the credentials they provided for http://domain_name/application/ be used for ArcGIS?
  • Q2: Would this change if a different IIS site (but still the same domain) was used for ArcGIS Server and the .NET application?

Another (perhaps simpler) option I'm considering is having my map page's server-side code generate a security token on load by making a request to the ArcGIS token service with expiry time calculated as # hours until 17:30. This token would be passed to the client in JavaScript. In this approach only a single account needs access to the map service. The security token contains

the user's name, expiration time and other information (source)

  • Q3 does this 'other information' include anything that restricts the token to the IP or user-agent of the requestor - anything that will stop my server creating it on behalf of my client?

EDIT from further research it seems that a token can be explicitly bound to a given IP (provided when creating it) or to a referrer. In this case Q3 is answered 'no'

Any thoughts on these three questions would be super welcome. Thanks

| improve this question | |
  • Q3- only if you are using Long-lived tokens will restrict the to the IP - Short Lived does not use that method. The most secure route is HTTPS (SSL) en.wikipedia.org/wiki/HTTP_Secure#Acquiring_certificates – Mapperz♦ Sep 14 '12 at 20:05
  • @Mapperz thanks for the info on tokens, are you sure about long-lived IP-binding? From ESRI: A long-lived token can be obtained from the Token server, and this token may be included in the client-side page. The token is then included in the request for the service resources.arcgis.com/content/enterprisegis/10.0/web_security I have no requirement for server certificates (intenal network), although I might consider client certificates for explicit access control if all other options fail – tomfumb Sep 14 '12 at 20:37
1

When you connect to a secured web site with a non-IE Browser, the login credentials you use will be re-used when you connect to the same web site.

If you are using two different web sites, then the user will be prompted again when their browser tries to connect to the second web site.

You are certainly able to generate a token for a client to consume later. However, I would recommend just using the integrated authentication for both your viewer and the ArcGIS Server, as generating a token on-the-fly will sometimes lead to problems if the client does not provide sufficient information for your to generate the token. (for example, Silverlight running in Firefox will not provider a Referer header if the request was a GET)

Here's how my test machine is set up for Windows authentication:

Screenshot of ArcGIS Administrator

| improve this answer | |
  • ok thanks, point noted on tokens. In my case I hope to specify the client IP, rather than the referrer, and also I'm only using JavaScript so I expect more standard behaviour. Is it actually possible to use Windows Integrated Authentication with a REST Map Service? From my reading I'm starting to think these are always token-based – tomfumb Sep 14 '12 at 23:19
  • Yes, just choose "Windows Users and Groups" when you enable security, and also un-check the box to require token authentication. That's [Integrated] Windows authentication. – mwalker Sep 14 '12 at 23:32
  • Sorry I'm just trying to find the 'require token authentication' option - I'm lost. Is this actually 'Enable ArcGIS Server token service on this computer'? – tomfumb Sep 14 '12 at 23:58
  • Possibly, I normally use ArcGIS Server Manager (the website) rather than ArcCatalog to manage my server. – mwalker Sep 15 '12 at 0:15
  • That's what I'm using too – tomfumb Sep 15 '12 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.